commit 3d7cb6b04c3f3115719235cc6866b10326de34cd Author: Linus Torvalds Date: Sun Jul 31 14:03:01 2022 -0700 Linux 5.19 commit 334c0ef6429f261c7f53dc035632435ffbc0c60d Merge: 89caf575400a9 8dc592c41f387 Author: Linus Torvalds Date: Sun Jul 31 09:52:20 2022 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One-liner fix of a NULL pointer deref in the Allwinner clk driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: Fix H6 RTC clock definition commit 89caf575400a9296e45b7de97b07d2fbf249c1f5 Merge: 5e4823e6dab8f ea304a8b89fd0 Author: Linus Torvalds Date: Sun Jul 31 09:26:53 2022 -0700 Merge tag 'x86_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Update the 'mitigations=' kernel param documentation - Check the IBPB feature flag before enabling IBPB in firmware calls because cloud vendors' fantasy when it comes to creating guest configurations is unlimited - Unexport sev_es_ghcb_hv_call() before 5.19 releases now that HyperV doesn't need it anymore - Remove dead CONFIG_* items * tag 'x86_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available Revert "x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV" x86/configs: Update configs in x86_debug.config commit 5e4823e6dab8fcc897757c1be68d157a369e4bb5 Merge: cd2715b7929bc 6eebd5fb20838 Author: Linus Torvalds Date: Sun Jul 31 09:21:13 2022 -0700 Merge tag 'locking_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Avoid rwsem lockups in certain situations when handling the handoff bit * tag 'locking_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter commit cd2715b7929bcaf6e38d13ac512e0a9bba8df10d Merge: 6a010258447d3 5e2805d537961 Author: Linus Torvalds Date: Sun Jul 31 09:12:58 2022 -0700 Merge tag 'edac_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - Relax the condition under which the DIMM label in ghes_edac is set in order to accomodate an HPE BIOS which sets only the device but not the bank - Two forgotten fixes to synopsys_edac when handling error interrupts * tag 'edac_urgent_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/ghes: Set the DIMM label unconditionally EDAC/synopsys: Re-enable the error interrupts on v3 hw EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw commit 6a010258447d386186ca10cd374d888ac66ffe1a Merge: 620725263f422 ec85bd369fd2b Author: Linus Torvalds Date: Sat Jul 30 17:24:16 2022 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Last set of ARM fixes for 5.19: - fix for MAX_DMA_ADDRESS overflow - fix for find_*_bit performing an out of bounds memory access" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: findbit: fix overflowing offset ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow commit 6eebd5fb20838f5971ba17df9f55cc4f84a31053 Author: Waiman Long Date: Wed Jun 22 16:04:19 2022 -0400 locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter With commit d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent"), the writer that sets the handoff bit can be interrupted out without clearing the bit if the wait queue isn't empty. This disables reader and writer optimistic lock spinning and stealing. Now if a non-first writer in the queue is somehow woken up or a new waiter enters the slowpath, it can't acquire the lock. This is not the case before commit d257cc8cb8d5 as the writer that set the handoff bit will clear it when exiting out via the out_nolock path. This is less efficient as the busy rwsem stays in an unlock state for a longer time. In some cases, this new behavior may cause lockups as shown in [1] and [2]. This patch allows a non-first writer to ignore the handoff bit if it is not originally set or initiated by the first waiter. This patch is shown to be effective in fixing the lockup problem reported in [1]. [1] https://lore.kernel.org/lkml/20220617134325.GC30825@techsingularity.net/ [2] https://lore.kernel.org/lkml/3f02975c-1a9d-be20-32cf-f1d8e3dfafcc@oracle.com/ Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Acked-by: John Donnelly Tested-by: Mel Gorman Link: https://lore.kernel.org/r/20220622200419.778799-1-longman@redhat.com commit 620725263f4222b3c94d4ee19846835feec0ad69 Merge: 8a91f86f3e9e9 8a295dbbaf729 Author: Linus Torvalds Date: Fri Jul 29 21:02:35 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Two hotfixes, both cc:stable" * tag 'mm-hotfixes-stable-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/hmm: fault non-owner device private entries page_alloc: fix invalid watermark check on a negative value commit 8a91f86f3e9e9608210166c70aaad4919018c0e7 Merge: e65c6a46df94c eda3953b6a805 Author: Linus Torvalds Date: Fri Jul 29 16:07:35 2022 -0700 Merge tag 'block-5.19-2022-07-29' of git://git.kernel.dk/linux-block Pull block fix from Jens Axboe: "Just a single fix for NVMe, yet another quirk addition" * tag 'block-5.19-2022-07-29' of git://git.kernel.dk/linux-block: nvme-pci: Crucial P2 has bogus namespace ids commit e65c6a46df94c8d76ea1129eb2d4564670c6f214 Merge: 1c8ac1c4af178 ce156c8a1811c Author: Linus Torvalds Date: Fri Jul 29 13:25:31 2022 -0700 Merge tag 'drm-fixes-2022-07-30' of git://anongit.freedesktop.org/drm/drm Pull more drm fixes from Dave Airlie: "Maxime had the dog^Wmailing list server eat his homework^Wmisc pull request. Two more small fixes, one in nouveau svm code and the other in simpledrm. nouveau: - page migration fix simpledrm: - fix mode_valid return value" * tag 'drm-fixes-2022-07-30' of git://anongit.freedesktop.org/drm/drm: nouveau/svm: Fix to migrate all requested pages drm/simpledrm: Fix return type of simpledrm_simple_display_pipe_mode_valid() commit ce156c8a1811c96a243590abd0e9b5a3b72c1f3a Merge: f16a2f593d009 66cee9097e2b7 Author: Dave Airlie Date: Sat Jul 30 06:09:48 2022 +1000 Merge tag 'drm-misc-fixes-2022-07-29' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes One fix to fix simpledrm mode_valid return value, and one for page migration in nouveau Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220729094514.sfzhc3gqjgwgal62@penduick commit 1c8ac1c4af178ebcdf6fd4a0ba11716e2c814593 Merge: bb83c99d3d0aa f5c2976e0cb0f Author: Linus Torvalds Date: Fri Jul 29 13:07:03 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four fixes, three in drivers. The two biggest fixes are ufs and the remaining driver and core fix are small and obvious (and the core fix is low risk)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix a race condition related to device management scsi: core: Fix warning in scsi_alloc_sgtables() scsi: ufs: host: Hold reference returned by of_parse_phandle() scsi: mpt3sas: Stop fw fault watchdog work item during system shutdown commit ea304a8b89fd0d6cf94ee30cb139dc23d9f1a62f Author: Eiichi Tsukata Date: Thu Jul 28 04:39:07 2022 +0000 docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed Updates descriptions for "mitigations=off" and "mitigations=auto,nosmt" with the respective retbleed= settings. Signed-off-by: Eiichi Tsukata Signed-off-by: Borislav Petkov Cc: corbet@lwn.net Link: https://lore.kernel.org/r/20220728043907.165688-1-eiichi.tsukata@nutanix.com commit 8a295dbbaf7292c582a40ce469c326f472d51f66 Author: Ralph Campbell Date: Mon Jul 25 11:36:14 2022 -0700 mm/hmm: fault non-owner device private entries If hmm_range_fault() is called with the HMM_PFN_REQ_FAULT flag and a device private PTE is found, the hmm_range::dev_private_owner page is used to determine if the device private page should not be faulted in. However, if the device private page is not owned by the caller, hmm_range_fault() returns an error instead of calling migrate_to_ram() to fault in the page. For example, if a page is migrated to GPU private memory and a RDMA fault capable NIC tries to read the migrated page, without this patch it will get an error. With this patch, the page will be migrated back to system memory and the NIC will be able to read the data. Link: https://lkml.kernel.org/r/20220727000837.4128709-2-rcampbell@nvidia.com Link: https://lkml.kernel.org/r/20220725183615.4118795-2-rcampbell@nvidia.com Fixes: 08ddddda667b ("mm/hmm: check the device private page owner in hmm_range_fault()") Signed-off-by: Ralph Campbell Reported-by: Felix Kuehling Reviewed-by: Alistair Popple Cc: Philip Yang Cc: Jason Gunthorpe Cc: Signed-off-by: Andrew Morton commit 9282012fc0aa248b77a69f5eb802b67c5a16bb13 Author: Jaewon Kim Date: Mon Jul 25 18:52:12 2022 +0900 page_alloc: fix invalid watermark check on a negative value There was a report that a task is waiting at the throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was increasing. This is a bug where zone_watermark_fast returns true even when the free is very low. The commit f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark fast") changed the watermark fast to consider highatomic reserve. But it did not handle a negative value case which can be happened when reserved_highatomic pageblock is bigger than the actual free. If watermark is considered as ok for the negative value, allocating contexts for order-0 will consume all free pages without direct reclaim, and finally free page may become depleted except highatomic free. Then allocating contexts may fall into throttle_direct_reclaim. This symptom may easily happen in a system where wmark min is low and other reclaimers like kswapd does not make free pages quickly. Handle the negative case by using MIN. Link: https://lkml.kernel.org/r/20220725095212.25388-1-jaewon31.kim@samsung.com Fixes: f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark fast") Signed-off-by: Jaewon Kim Reported-by: GyeongHwan Hong Acked-by: Mel Gorman Cc: Minchan Kim Cc: Baoquan He Cc: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Yong-Taek Lee Cc: Signed-off-by: Andrew Morton commit bb83c99d3d0aa2f51ba0b2abd7115002620118e6 Merge: 4b20426d04416 9a241805673ec Author: Linus Torvalds Date: Fri Jul 29 11:26:28 2022 -0700 Merge tag 'perf-tools-fixes-for-v5.19-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix addresses for bss symbols, describing variables used in resolving data access in tools such as 'perf c2c' and 'perf mem'. - Skip symbols if SHF_ALLOC flag is not set, a technique used for listing deprecated symbols, its addresses are zeros, so not useful. - Remove undefined behavior from bpf_perf_object__next() when dealing with an empty bpf_objects_list list. - Make a ARM CoreSight disasm script work with both python2 and python3. - Sync x86's cpufeatures header with with the kernel sources. * tag 'perf-tools-fixes-for-v5.19-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf bpf: Remove undefined behavior from bpf_perf_object__next() perf symbol: Skip symbols if SHF_ALLOC flag is not set perf symbol: Correct address for bss symbols perf scripts python: Let script to be python2 compliant tools headers cpufeatures: Sync with the kernel sources commit 4b20426d044163df0ff9d868e9767ca9e65dd36c Merge: 506e6dfb0f113 46a4d679ef882 Author: Linus Torvalds Date: Fri Jul 29 11:20:40 2022 -0700 Merge tag 'wq-for-5.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "Just one commit to suppress a spurious warning added during the 5.19 cycle" * tag 'wq-for-5.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Avoid a false warning in unbind_workers() commit 506e6dfb0f1131f104df66ccae1197bdf8f1b6b0 Merge: e4d8b09d671f0 d295ad34f236c Author: Linus Torvalds Date: Fri Jul 29 10:57:26 2022 -0700 Merge tag 'pm-5.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Make some false positive RCU splats resulting from a recent intel_idle driver change go away (Waiman Long)" * tag 'pm-5.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: intel_idle: Fix false positive RCU splats due to incorrect hardirqs state commit 46a4d679ef88285ea17c3e1e4fed330be2044f21 Author: Lai Jiangshan Date: Fri Jul 29 17:44:38 2022 +0800 workqueue: Avoid a false warning in unbind_workers() Doing set_cpus_allowed_ptr() with wq_unbound_cpumask can be possible fails and trigger the false warning. Use cpu_possible_mask instead when wq_unbound_cpumask has no active CPUs. It is very easy to trigger the warning: Set wq_unbound_cpumask to a small set of CPUs. Offline all the CPUs of wq_unbound_cpumask. Offline an extra CPU and trigger the warning. Fixes: 10a5a651e3af ("workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs") Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit e4d8b09d671f0ee92d36c48b65d2f34affcdd531 Merge: a95eb1d086dcc 88bd24d73d5bf Author: Linus Torvalds Date: Fri Jul 29 10:46:03 2022 -0700 Merge tag 'riscv-for-linus-5.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Palmer Dabbelt: "A build fix for 'make vdso_install' that avoids an issue trying to install the compat VDSO" * tag 'riscv-for-linus-5.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: compat: vdso: Fix vdso_install target commit a95eb1d086dcc579d52ca4c34742516f6434d1f2 Merge: 9d928d9b78bee 45b53c9051770 Author: Linus Torvalds Date: Fri Jul 29 10:10:30 2022 -0700 Merge tag 'loongarch-fixes-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - Fix cache size calculation, stack protection attributes, ptrace's fpr_set and "ROM Size" in boardinfo - Some cleanups and improvements of assembly - Some cleanups of unused code and useless code * tag 'loongarch-fixes-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Fix wrong "ROM Size" of boardinfo LoongArch: Fix missing fcsr in ptrace's fpr_set LoongArch: Fix shared cache size calculation LoongArch: Disable executable stack by default LoongArch: Remove unused variables LoongArch: Remove clock setting during cpu hotplug stage LoongArch: Remove useless header compiler.h LoongArch: Remove several syntactic sugar macros for branches LoongArch: Re-tab the assembly files LoongArch: Simplify "BGT foo, zero" with BGTZ LoongArch: Simplify "BLT foo, zero" with BLTZ LoongArch: Simplify "BEQ/BNE foo, zero" with BEQZ/BNEZ LoongArch: Use the "move" pseudo-instruction where applicable LoongArch: Use the "jr" pseudo-instruction where applicable LoongArch: Use ABI names of registers where appropriate commit 9d928d9b78beec5d4b8afde9c144919b979685f2 Merge: 6e2c0490769ef c653c591789b3 Author: Linus Torvalds Date: Fri Jul 29 09:57:07 2022 -0700 Merge tag 'powerpc-5.19-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Re-enable the new amdgpu display engine for powerpc, as long as the compiler is correctly configured. - Disable stack variable initialisation in prom_init to fix GCC 12 allmodconfig. Thanks to Dan Horák and Sudip Mukherjee. * tag 'powerpc-5.19-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: drm/amdgpu: Re-enable DCN for 64-bit powerpc powerpc/64s: Disable stack variable initialisation for prom_init commit 45b53c9051770c0d9145083a328548745ee2e75b Author: Tiezhu Yang Date: Thu Jul 21 17:53:01 2022 +0800 LoongArch: Fix wrong "ROM Size" of boardinfo We can see the "ROM Size" is different in the following outputs: [root@linux loongson]# cat /sys/firmware/loongson/boardinfo BIOS Information Vendor : Loongson Version : vUDK2018-LoongArch-V2.0.pre-beta8 ROM Size : 63 KB Release Date : 06/15/2022 Board Information Manufacturer : Loongson Board Name : Loongson-LS3A5000-7A1000-1w-A2101 Family : LOONGSON64 [root@linux loongson]# dmidecode | head -11 ... Handle 0x0000, DMI type 0, 26 bytes BIOS Information Vendor: Loongson Version: vUDK2018-LoongArch-V2.0.pre-beta8 Release Date: 06/15/2022 ROM Size: 4 MB According to "BIOS Information (Type 0) structure" in the SMBIOS Reference Specification [1], it shows 64K * (n+1) is the size of the physical device containing the BIOS if the size is less than 16M. Additionally, we can see the related code in dmidecode [2]: u64 s = { .l = (code1 + 1) << 6 }; So the output of dmidecode is correct, the output of boardinfo is wrong, fix it. By the way, at present no need to consider the size is 16M or greater on LoongArch, because it is usually 4M or 8M which is enough to use. [1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.6.0.pdf [2] https://git.savannah.nongnu.org/cgit/dmidecode.git/tree/dmidecode.c#n347 Fixes: 628c3bb40e9a ("LoongArch: Add boot and setup routines") Reviewed-by: WANG Xuerui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit b0f3bdc00240fc9d7bf0f2a076943122d168c95e Author: Qi Hu Date: Thu Jul 14 14:25:50 2022 +0800 LoongArch: Fix missing fcsr in ptrace's fpr_set In file ptrace.c, function fpr_set does not copy fcsr data from ubuf to kbuf. That's the reason why fcsr cannot be modified by ptrace. This patch fixs this problem and allows users using ptrace to modify the fcsr. Co-developed-by: Xu Li Signed-off-by: Qi Hu Signed-off-by: Huacai Chen commit 1aea29d7c3569e5b6c40e73c51e9f4b2142c96ef Author: Huacai Chen Date: Wed Jul 13 18:00:41 2022 +0800 LoongArch: Fix shared cache size calculation Current calculation of shared cache size is from the node (die) scope, but we hope 'lscpu' to show the shared cache size of the whole package for multi-die chips (e.g., Loongson-3C5000L, which contains 4 dies in one package). So fix it by multiplying nodes_per_package. Signed-off-by: Huacai Chen commit 317980e6b4d03884429f2cdaf51efd28f01b71b0 Author: Huacai Chen Date: Tue Jul 26 20:43:11 2022 +0800 LoongArch: Disable executable stack by default Disable executable stack for LoongArch by default, as all modern architectures do. Reported-by: Andreas Schwab Suggested-by: WANG Xuerui Link: https://sourceware.org/pipermail/binutils/2022-July/121992.html Tested-by: WANG Xuerui Tested-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 3a3a4f7a65e3ff7ad395afc8c41ac317c8667546 Author: Bibo Mao Date: Wed Jul 20 15:21:52 2022 +0800 LoongArch: Remove unused variables There are some variables never used or referenced, this patch removes these varaibles and make the code cleaner. Reviewed-by: WANG Xuerui Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 71610ab1d017e131a9888ef8acd035284fb0e1dd Author: Bibo Mao Date: Wed Jul 20 15:21:51 2022 +0800 LoongArch: Remove clock setting during cpu hotplug stage On physical machine we can save power by disabling clock of hot removed cpu. However as different platforms require different methods to configure clocks, the code is platform-specific, and probably belongs to firmware/pmu or cpu regulator, rather than generic arch/loongarch code. Also, there is no such register on QEMU virt machine since the clock/frequency regulation is not emulated. This patch removes the hard-coded clock register accesses in generic LoongArch cpu hotplug flow. Reviewed-by: WANG Xuerui Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f62b7626cb79dfbfe292145b7ebeee4dc63c9499 Author: Jun Yi Date: Thu Jul 21 19:10:49 2022 +0800 LoongArch: Remove useless header compiler.h The content of LoongArch's compiler.h is trivial, with some unused anywhere, so inline the definitions and remove the header. Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit ab6e57a69df515cc9231b578de5b820f9ba3d0be Author: WANG Xuerui Date: Tue Jul 26 23:57:15 2022 +0800 LoongArch: Remove several syntactic sugar macros for branches These syntactic sugars have been supported by upstream binutils from the beginning, so no need to patch them locally. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit f5c3c22f21b6a002e371afdcc9180a2fa47dc267 Author: WANG Xuerui Date: Tue Jul 26 23:57:22 2022 +0800 LoongArch: Re-tab the assembly files Reflow the *.S files for better stylistic consistency, namely hard tabs after mnemonic position, and vertical alignment of the first operand with hard tabs. Tab width is obviously 8. Some pre-existing intra-block vertical alignments are preserved. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 1fdb9a92495a6b6996530d27781892796e22f08b Author: WANG Xuerui Date: Tue Jul 26 23:57:21 2022 +0800 LoongArch: Simplify "BGT foo, zero" with BGTZ Support for the syntactic sugar is present in upstream binutils port from the beginning. Use it for shorter lines and better consistency. Generated code should be identical. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit d1bc75d7595b237f78b594509ea7cc159f98cae9 Author: WANG Xuerui Date: Tue Jul 26 23:57:20 2022 +0800 LoongArch: Simplify "BLT foo, zero" with BLTZ Support for the syntactic sugar is present in upstream binutils port from the beginning. Use it for shorter lines and better consistency. Generated code should be identical. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit d47b2dc87c58154052daf8ac0f9229db5c7890cc Author: WANG Xuerui Date: Tue Jul 26 23:57:19 2022 +0800 LoongArch: Simplify "BEQ/BNE foo, zero" with BEQZ/BNEZ While B{EQ,NE}Z and B{EQ,NE} are different instructions, and the vastly expanded range for branch destination does not really matter in the few cases touched, use the B{EQ,NE}Z where possible for shorter lines and better consistency (e.g. some places used "BEQ foo, zero", while some used "BEQ zero, foo"). Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 57ce5d3eefacfaadfe2ed0a3a85713d1ae6287b9 Author: WANG Xuerui Date: Tue Jul 26 23:57:18 2022 +0800 LoongArch: Use the "move" pseudo-instruction where applicable Some of the assembly code in the LoongArch port likely originated from a time when the assembler did not support pseudo-instructions like "move" or "jr", so the desugared form was used and readability suffers (to a minor degree) as a result. As the upstream toolchain supports these pseudo-instructions from the beginning, migrate the existing few usages to them for better readability. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 07b480695d24d1c9f27bb60fd4b980ae87e8bc1e Author: WANG Xuerui Date: Tue Jul 26 23:57:17 2022 +0800 LoongArch: Use the "jr" pseudo-instruction where applicable Some of the assembly code in the LoongArch port likely originated from a time when the assembler did not support pseudo-instructions like "move" or "jr", so the desugared form was used and readability suffers (to a minor degree) as a result. As the upstream toolchain supports these pseudo-instructions from the beginning, migrate the existing few usages to them for better readability. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit d8e7f201a4cf148c3801cdc9603963061d28d64f Author: WANG Xuerui Date: Tue Jul 26 23:57:16 2022 +0800 LoongArch: Use ABI names of registers where appropriate Some of the assembly in the LoongArch port seem to come from a prehistoric time, when the assembler didn't even have support for the ABI names we all come to know and love, thus used raw register numbers which hampered readability. The usages are found with a regex match inside arch/loongarch, then manually adjusted for those non-definitions. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit ec85bd369fd2bfaed6f45dd678706429d4f75b48 Author: Russell King (Oracle) Date: Tue Jul 26 23:51:48 2022 +0100 ARM: findbit: fix overflowing offset When offset is larger than the size of the bit array, we should not attempt to access the array as we can perform an access beyond the end of the array. Fix this by changing the pre-condition. Using "cmp r2, r1; bhs ..." covers us for the size == 0 case, since this will always take the branch when r1 is zero, irrespective of the value of r2. This means we can fix this bug without adding any additional code! Tested-by: Guenter Roeck Signed-off-by: Russell King (Oracle) commit 571c30b1a88465a1c85a6f7762609939b9085a15 Author: Thadeu Lima de Souza Cascardo Date: Thu Jul 28 09:26:02 2022 -0300 x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available Some cloud hypervisors do not provide IBPB on very recent CPU processors, including AMD processors affected by Retbleed. Using IBPB before firmware calls on such systems would cause a GPF at boot like the one below. Do not enable such calls when IBPB support is not present. EFI Variables Facility v0.08 2004-May-17 general protection fault, maybe for address 0x1: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 24 Comm: kworker/u2:1 Not tainted 5.19.0-rc8+ #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: efi_rts_wq efi_call_rts RIP: 0010:efi_call_rts Code: e8 37 33 58 ff 41 bf 48 00 00 00 49 89 c0 44 89 f9 48 83 c8 01 4c 89 c2 48 c1 ea 20 66 90 b9 49 00 00 00 b8 01 00 00 00 31 d2 <0f> 30 e8 7b 9f 5d ff e8 f6 f8 ff ff 4c 89 f1 4c 89 ea 4c 89 e6 48 RSP: 0018:ffffb373800d7e38 EFLAGS: 00010246 RAX: 0000000000000001 RBX: 0000000000000006 RCX: 0000000000000049 RDX: 0000000000000000 RSI: ffff94fbc19d8fe0 RDI: ffff94fbc1b2b300 RBP: ffffb373800d7e70 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000000b R11: 000000000000000b R12: ffffb3738001fd78 R13: ffff94fbc2fcfc00 R14: ffffb3738001fd80 R15: 0000000000000048 FS: 0000000000000000(0000) GS:ffff94fc3da00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff94fc30201000 CR3: 000000006f610000 CR4: 00000000000406f0 Call Trace: ? __wake_up process_one_work worker_thread ? rescuer_thread kthread ? kthread_complete_and_exit ret_from_fork Modules linked in: Fixes: 28a99e95f55c ("x86/amd: Use IBPB for firmware calls") Reported-by: Dimitri John Ledkov Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Borislav Petkov Cc: Link: https://lore.kernel.org/r/20220728122602.2500509-1-cascardo@canonical.com commit 6e2c0490769ef8a95b61304389116ccc85c53e12 Merge: 33ea1340bafe1 f16a2f593d009 Author: Linus Torvalds Date: Thu Jul 28 20:34:59 2022 -0700 Merge tag 'drm-fixes-2022-07-29' of git://anongit.freedesktop.org/drm/drm Pull drm fix from Dave Airlie: "Quiet extra week, just a single fix for i915 workaround with execlist backend. i915: - Further reset robustness improvements for execlists [Wa_22011802037]" * tag 'drm-fixes-2022-07-29' of git://anongit.freedesktop.org/drm/drm: drm/i915/reset: Add additional steps for Wa_22011802037 for execlist backend commit f16a2f593d0095e82e6b7f9d776f869c8ab45952 Merge: e0dccc3b76fb3 a7a47a5dfa9a9 Author: Dave Airlie Date: Fri Jul 29 11:39:13 2022 +1000 Merge tag 'drm-intel-fixes-2022-07-28-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Further reset robustness improvements for execlists [Wa_22011802037] (Umesh Nerlige Ramappa) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/YuJIWaEbKcs/q0NY@tursulin-desk commit 66cee9097e2b74ff3c8cc040ce5717c521a0c3fa Author: Alistair Popple Date: Wed Jul 20 16:27:45 2022 +1000 nouveau/svm: Fix to migrate all requested pages Users may request that pages from an OpenCL SVM allocation be migrated to the GPU with clEnqueueSVMMigrateMem(). In Nouveau this will call into nouveau_dmem_migrate_vma() to do the migration. If the total range to be migrated exceeds SG_MAX_SINGLE_ALLOC the pages will be migrated in chunks of size SG_MAX_SINGLE_ALLOC. However a typo in updating the starting address means that only the first chunk will get migrated. Fix the calculation so that the entire range will get migrated if possible. Signed-off-by: Alistair Popple Fixes: e3d8b0890469 ("drm/nouveau/svm: map pages after migration") Reviewed-by: Ralph Campbell Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20220720062745.960701-1-apopple@nvidia.com Cc: # v5.8+ commit 33ea1340bafe1f394e5bf96fceef73e9771d066b Merge: e64ab2dbd8829 4d3d3a1b244fd Author: Linus Torvalds Date: Thu Jul 28 11:54:59 2022 -0700 Merge tag 'net-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth and netfilter, no known blockers for the release. Current release - regressions: - wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop(), fix taking the lock before its initialized - Bluetooth: mgmt: fix double free on error path Current release - new code bugs: - eth: ice: fix tunnel checksum offload with fragmented traffic Previous releases - regressions: - tcp: md5: fix IPv4-mapped support after refactoring, don't take the pure v6 path - Revert "tcp: change pingpong threshold to 3", improving detection of interactive sessions - mld: fix netdev refcount leak in mld_{query | report}_work() due to a race - Bluetooth: - always set event mask on suspend, avoid early wake ups - L2CAP: fix use-after-free caused by l2cap_chan_put - bridge: do not send empty IFLA_AF_SPEC attribute Previous releases - always broken: - ping6: fix memleak in ipv6_renew_options() - sctp: prevent null-deref caused by over-eager error paths - virtio-net: fix the race between refill work and close, resulting in NAPI scheduled after close and a BUG() - macsec: - fix three netlink parsing bugs - avoid breaking the device state on invalid change requests - fix a memleak in another error path Misc: - dt-bindings: net: ethernet-controller: rework 'fixed-link' schema - two more batches of sysctl data race adornment" * tag 'net-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (67 commits) stmmac: dwmac-mediatek: fix resource leak in probe ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr net: ping6: Fix memleak in ipv6_renew_options(). net/funeth: Fix fun_xdp_tx() and XDP packet reclaim sctp: leave the err path free in sctp_stream_init to sctp_stream_free sfc: disable softirqs for ptp TX ptp: ocp: Select CRC16 in the Kconfig. tcp: md5: fix IPv4-mapped support virtio-net: fix the race between refill work and close mptcp: Do not return EINPROGRESS when subflow creation succeeds Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Bluetooth: Always set event mask on suspend Bluetooth: mgmt: Fix double free on error path wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop() ice: do not setup vlan for loopback VSI ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) ice: Fix VSIs unable to share unicast MAC ice: Fix tunnel checksum offload with fragmented traffic ice: Fix max VLANs available for VF netfilter: nft_queue: only allow supported familes and hooks ... commit 4d3d3a1b244fd54629a6b7047f39a7bbc8d11910 Author: Dan Carpenter Date: Thu Jul 28 14:52:09 2022 +0300 stmmac: dwmac-mediatek: fix resource leak in probe If mediatek_dwmac_clks_config() fails, then call stmmac_remove_config_dt() before returning. Otherwise it is a resource leak. Fixes: fa4b3ca60e80 ("stmmac: dwmac-mediatek: fix clock issue") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YuJ4aZyMUlG6yGGa@kili Signed-off-by: Jakub Kicinski commit 85f0173df35e5462d89947135a6a5599c6c3ef6f Author: Ziyang Xuan Date: Thu Jul 28 09:33:07 2022 +0800 ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr Change net device's MTU to smaller than IPV6_MIN_MTU or unregister device while matching route. That may trigger null-ptr-deref bug for ip6_ptr probability as following. ========================================================= BUG: KASAN: null-ptr-deref in find_match.part.0+0x70/0x134 Read of size 4 at addr 0000000000000308 by task ping6/263 CPU: 2 PID: 263 Comm: ping6 Not tainted 5.19.0-rc7+ #14 Call trace: dump_backtrace+0x1a8/0x230 show_stack+0x20/0x70 dump_stack_lvl+0x68/0x84 print_report+0xc4/0x120 kasan_report+0x84/0x120 __asan_load4+0x94/0xd0 find_match.part.0+0x70/0x134 __find_rr_leaf+0x408/0x470 fib6_table_lookup+0x264/0x540 ip6_pol_route+0xf4/0x260 ip6_pol_route_output+0x58/0x70 fib6_rule_lookup+0x1a8/0x330 ip6_route_output_flags_noref+0xd8/0x1a0 ip6_route_output_flags+0x58/0x160 ip6_dst_lookup_tail+0x5b4/0x85c ip6_dst_lookup_flow+0x98/0x120 rawv6_sendmsg+0x49c/0xc70 inet_sendmsg+0x68/0x94 Reproducer as following: Firstly, prepare conditions: $ip netns add ns1 $ip netns add ns2 $ip link add veth1 type veth peer name veth2 $ip link set veth1 netns ns1 $ip link set veth2 netns ns2 $ip netns exec ns1 ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1 $ip netns exec ns2 ip -6 addr add 2001:0db8:0:f101::2/64 dev veth2 $ip netns exec ns1 ifconfig veth1 up $ip netns exec ns2 ifconfig veth2 up $ip netns exec ns1 ip -6 route add 2000::/64 dev veth1 metric 1 $ip netns exec ns2 ip -6 route add 2001::/64 dev veth2 metric 1 Secondly, execute the following two commands in two ssh windows respectively: $ip netns exec ns1 sh $while true; do ip -6 addr add 2001:0db8:0:f101::1/64 dev veth1; ip -6 route add 2000::/64 dev veth1 metric 1; ping6 2000::2; done $ip netns exec ns1 sh $while true; do ip link set veth1 mtu 1000; ip link set veth1 mtu 1500; sleep 5; done It is because ip6_ptr has been assigned to NULL in addrconf_ifdown() firstly, then ip6_ignore_linkdown() accesses ip6_ptr directly without NULL check. cpu0 cpu1 fib6_table_lookup __find_rr_leaf addrconf_notify [ NETDEV_CHANGEMTU ] addrconf_ifdown RCU_INIT_POINTER(dev->ip6_ptr, NULL) find_match ip6_ignore_linkdown So we can add NULL check for ip6_ptr before using in ip6_ignore_linkdown() to fix the null-ptr-deref bug. Fixes: dcd1f572954f ("net/ipv6: Remove fib6_idev") Signed-off-by: Ziyang Xuan Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220728013307.656257-1-william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski commit e27326009a3d247b831eda38878c777f6f4eb3d1 Author: Kuniyuki Iwashima Date: Wed Jul 27 18:22:20 2022 -0700 net: ping6: Fix memleak in ipv6_renew_options(). When we close ping6 sockets, some resources are left unfreed because pingv6_prot is missing sk->sk_prot->destroy(). As reported by syzbot [0], just three syscalls leak 96 bytes and easily cause OOM. struct ipv6_sr_hdr *hdr; char data[24] = {0}; int fd; hdr = (struct ipv6_sr_hdr *)data; hdr->hdrlen = 2; hdr->type = IPV6_SRCRT_TYPE_4; fd = socket(AF_INET6, SOCK_DGRAM, NEXTHDR_ICMP); setsockopt(fd, IPPROTO_IPV6, IPV6_RTHDR, data, 24); close(fd); To fix memory leaks, let's add a destroy function. Note the socket() syscall checks if the GID is within the range of net.ipv4.ping_group_range. The default value is [1, 0] so that no GID meets the condition (1 <= GID <= 0). Thus, the local DoS does not succeed until we change the default value. However, at least Ubuntu/Fedora/RHEL loosen it. $ cat /usr/lib/sysctl.d/50-default.conf ... -net.ipv4.ping_group_range = 0 2147483647 Also, there could be another path reported with these options, and some of them require CAP_NET_RAW. setsockopt IPV6_ADDRFORM (inet6_sk(sk)->pktoptions) IPV6_RECVPATHMTU (inet6_sk(sk)->rxpmtu) IPV6_HOPOPTS (inet6_sk(sk)->opt) IPV6_RTHDRDSTOPTS (inet6_sk(sk)->opt) IPV6_RTHDR (inet6_sk(sk)->opt) IPV6_DSTOPTS (inet6_sk(sk)->opt) IPV6_2292PKTOPTIONS (inet6_sk(sk)->opt) getsockopt IPV6_FLOWLABEL_MGR (inet6_sk(sk)->ipv6_fl_list) For the record, I left a different splat with syzbot's one. unreferenced object 0xffff888006270c60 (size 96): comm "repro2", pid 231, jiffies 4294696626 (age 13.118s) hex dump (first 32 bytes): 01 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f6bc7ea9>] sock_kmalloc (net/core/sock.c:2564 net/core/sock.c:2554) [<000000006d699550>] do_ipv6_setsockopt.constprop.0 (net/ipv6/ipv6_sockglue.c:715) [<00000000c3c3b1f5>] ipv6_setsockopt (net/ipv6/ipv6_sockglue.c:1024) [<000000007096a025>] __sys_setsockopt (net/socket.c:2254) [<000000003a8ff47b>] __x64_sys_setsockopt (net/socket.c:2265 net/socket.c:2262 net/socket.c:2262) [<000000007c409dcb>] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [<00000000e939c4a9>] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [0]: https://syzkaller.appspot.com/bug?extid=a8430774139ec3ab7176 Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.") Reported-by: syzbot+a8430774139ec3ab7176@syzkaller.appspotmail.com Reported-by: Ayushman Dutta Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220728012220.46918-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit e64ab2dbd882933b65cd82ff6235d705ad65dbb6 Author: Linus Torvalds Date: Thu Jul 28 10:31:12 2022 +0100 watch_queue: Fix missing locking in add_watch_to_object() If a watch is being added to a queue, it needs to guard against interference from addition of a new watch, manual removal of a watch and removal of a watch due to some other queue being destroyed. KEYCTL_WATCH_KEY guards against this for the same {key,queue} pair by holding the key->sem writelocked and by holding refs on both the key and the queue - but that doesn't prevent interaction from other {key,queue} pairs. While add_watch_to_object() does take the spinlock on the event queue, it doesn't take the lock on the source's watch list. The assumption was that the caller would prevent that (say by taking key->sem) - but that doesn't prevent interference from the destruction of another queue. Fix this by locking the watcher list in add_watch_to_object(). Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: syzbot+03d7b43290037d1f87ca@syzkaller.appspotmail.com Signed-off-by: David Howells cc: keyrings@vger.kernel.org Signed-off-by: Linus Torvalds commit e0339f036ef4beb9b20f0b6532a1e0ece7f594c6 Author: David Howells Date: Thu Jul 28 10:31:06 2022 +0100 watch_queue: Fix missing rcu annotation Since __post_watch_notification() walks wlist->watchers with only the RCU read lock held, we need to use RCU methods to add to the list (we already use RCU methods to remove from the list). Fix add_watch_to_object() to use hlist_add_head_rcu() instead of hlist_add_head() for that list. Fixes: c73be61cede5 ("pipe: Add general notification queue support") Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 51a83391d77bb0f7ff0aef06ca4c7f5aa9e80b4c Author: Dimitris Michailidis Date: Tue Jul 26 14:59:23 2022 -0700 net/funeth: Fix fun_xdp_tx() and XDP packet reclaim The current implementation of fun_xdp_tx(), used for XPD_TX, is incorrect in that it takes an address/length pair and later releases it with page_frag_free(). It is OK for XDP_TX but the same code is used by ndo_xdp_xmit. In that case it loses the XDP memory type and releases the packet incorrectly for some of the types. Assorted breakage follows. Change fun_xdp_tx() to take xdp_frame and rely on xdp_return_frame() in reclaim. Fixes: db37bc177dae ("net/funeth: add the data path") Signed-off-by: Dimitris Michailidis Link: https://lore.kernel.org/r/20220726215923.7887-1-dmichail@fungible.com Signed-off-by: Paolo Abeni commit bf84719df765f1a832a770f3cd0cdc8bee20c91f Merge: 181d8d2066c00 cc019545a2385 Author: Jakub Kicinski Date: Wed Jul 27 19:56:28 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-07-26 This series contains updates to ice driver only. Przemyslaw corrects accounting for VF VLANs to allow for correct number of VLANs for untrusted VF. He also correct issue with checksum offload on VXLAN tunnels. Ani allows for two VSIs to share the same MAC address. Maciej corrects checked bits for descriptor completion of loopback * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: do not setup vlan for loopback VSI ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) ice: Fix VSIs unable to share unicast MAC ice: Fix tunnel checksum offload with fragmented traffic ice: Fix max VLANs available for VF ==================== Link: https://lore.kernel.org/r/20220726204646.2171589-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 181d8d2066c000ba0a0e6940a7ad80f1a0e68e9d Author: Xin Long Date: Mon Jul 25 18:11:06 2022 -0400 sctp: leave the err path free in sctp_stream_init to sctp_stream_free A NULL pointer dereference was reported by Wei Chen: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__list_del_entry_valid+0x26/0x80 Call Trace: sctp_sched_dequeue_common+0x1c/0x90 sctp_sched_prio_dequeue+0x67/0x80 __sctp_outq_teardown+0x299/0x380 sctp_outq_free+0x15/0x20 sctp_association_free+0xc3/0x440 sctp_do_sm+0x1ca7/0x2210 sctp_assoc_bh_rcv+0x1f6/0x340 This happens when calling sctp_sendmsg without connecting to server first. In this case, a data chunk already queues up in send queue of client side when processing the INIT_ACK from server in sctp_process_init() where it calls sctp_stream_init() to alloc stream_in. If it fails to alloc stream_in all stream_out will be freed in sctp_stream_init's err path. Then in the asoc freeing it will crash when dequeuing this data chunk as stream_out is missing. As we can't free stream out before dequeuing all data from send queue, and this patch is to fix it by moving the err path stream_out/in freeing in sctp_stream_init() to sctp_stream_free() which is eventually called when freeing the asoc in sctp_association_free(). This fix also makes the code in sctp_process_init() more clear. Note that in sctp_association_init() when it fails in sctp_stream_init(), sctp_association_free() will not be called, and in that case it should go to 'stream_free' err path to free stream instead of 'fail_init'. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Wei Chen Signed-off-by: Xin Long Link: https://lore.kernel.org/r/831a3dc100c4908ff76e5bcc363be97f2778bc0b.1658787066.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 67c3b611d92fc238c43734878bc3e232ab570c79 Author: Alejandro Lucero Date: Tue Jul 26 08:45:04 2022 +0200 sfc: disable softirqs for ptp TX Sending a PTP packet can imply to use the normal TX driver datapath but invoked from the driver's ptp worker. The kernel generic TX code disables softirqs and preemption before calling specific driver TX code, but the ptp worker does not. Although current ptp driver functionality does not require it, there are several reasons for doing so: 1) The invoked code is always executed with softirqs disabled for non PTP packets. 2) Better if a ptp packet transmission is not interrupted by softirq handling which could lead to high latencies. 3) netdev_xmit_more used by the TX code requires preemption to be disabled. Indeed a solution for dealing with kernel preemption state based on static kernel configuration is not possible since the introduction of dynamic preemption level configuration at boot time using the static calls functionality. Fixes: f79c957a0b537 ("drivers: net: sfc: use netdev_xmit_more helper") Signed-off-by: Alejandro Lucero Link: https://lore.kernel.org/r/20220726064504.49613-1-alejandro.lucero-palau@amd.com Signed-off-by: Jakub Kicinski commit 0c104556267242d922a3def60be8092b280e4fee Author: Jonathan Lemon Date: Tue Jul 26 15:06:04 2022 -0700 ptp: ocp: Select CRC16 in the Kconfig. The crc16() function is used to check the firmware validity, but the library was not explicitly selected. Fixes: 3c3673bde50c ("ptp: ocp: Add firmware header checks") Reported-by: kernel test robot Signed-off-by: Jonathan Lemon Acked-by: Vadim Fedorenko Link: https://lore.kernel.org/r/20220726220604.1339972-1-jonathan.lemon@gmail.com Signed-off-by: Jakub Kicinski commit 8dc592c41f38735306d1f1dc0b183601379c6d94 Author: Jernej Skrabec Date: Tue Jul 19 20:37:25 2022 +0200 clk: sunxi-ng: Fix H6 RTC clock definition While RTC clock was added in H616 ccu_common list, it was not in H6 list. That caused invalid pointer dereference like this: Unable to handle kernel NULL pointer dereference at virtual address 000000000000020c Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000004d574000 [000000000000020c] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP CPU: 3 PID: 339 Comm: cat Tainted: G B 5.18.0-rc1+ #1352 Hardware name: Tanix TX6 (DT) pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ccu_gate_is_enabled+0x48/0x74 lr : ccu_gate_is_enabled+0x40/0x74 sp : ffff80000c0b76d0 x29: ffff80000c0b76d0 x28: 00000000016e3600 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000002 x24: ffff00000952fe08 x23: ffff800009611400 x22: ffff00000952fe79 x21: 0000000000000000 x20: 0000000000000001 x19: ffff80000aad6f08 x18: 0000000000000000 x17: 2d2d2d2d2d2d2d2d x16: 2d2d2d2d2d2d2d2d x15: 2d2d2d2d2d2d2d2d x14: 0000000000000000 x13: 00000000f2f2f2f2 x12: ffff700001816e89 x11: 1ffff00001816e88 x10: ffff700001816e88 x9 : dfff800000000000 x8 : ffff80000c0b7447 x7 : 0000000000000001 x6 : ffff700001816e88 x5 : ffff80000c0b7440 x4 : 0000000000000001 x3 : ffff800008935c50 x2 : dfff800000000000 x1 : 0000000000000000 x0 : 000000000000020c Call trace: ccu_gate_is_enabled+0x48/0x74 clk_core_is_enabled+0x7c/0x1c0 clk_summary_show_subtree+0x1dc/0x334 clk_summary_show_subtree+0x250/0x334 clk_summary_show_subtree+0x250/0x334 clk_summary_show_subtree+0x250/0x334 clk_summary_show_subtree+0x250/0x334 clk_summary_show+0x90/0xdc seq_read_iter+0x248/0x6d4 seq_read+0x17c/0x1fc full_proxy_read+0x90/0xf0 vfs_read+0xdc/0x28c ksys_read+0xc8/0x174 __arm64_sys_read+0x44/0x5c invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x38/0xa0 el0_svc+0x68/0x160 el0t_64_sync_handler+0x10c/0x140 el0t_64_sync+0x18c/0x190 Code: d1006260 97e5c981 785e8260 8b0002a0 (b9400000) ---[ end trace 0000000000000000 ]--- Fix that by adding rtc clock to H6 ccu_common list too. Fixes: 38d321b61bda ("clk: sunxi-ng: h6-r: Add RTC gate clock") Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220719183725.2605141-1-jernej.skrabec@gmail.com Reviewed-by: Samuel Holland Signed-off-by: Stephen Boyd commit e62d2e110356093c034998e093675df83057e511 Author: Eric Dumazet Date: Tue Jul 26 11:57:43 2022 +0000 tcp: md5: fix IPv4-mapped support After the blamed commit, IPv4 SYN packets handled by a dual stack IPv6 socket are dropped, even if perfectly valid. $ nstat | grep MD5 TcpExtTCPMD5Failure 5 0.0 For a dual stack listener, an incoming IPv4 SYN packet would call tcp_inbound_md5_hash() with @family == AF_INET, while tp->af_specific is pointing to tcp_sock_ipv6_specific. Only later when an IPv4-mapped child is created, tp->af_specific is changed to tcp_sock_ipv6_mapped_specific. Fixes: 7bbb765b7349 ("net/tcp: Merge TCP-MD5 inbound callbacks") Reported-by: Brian Vazquez Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Dmitry Safonov Tested-by: Leonard Crestez Link: https://lore.kernel.org/r/20220726115743.2759832-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fb0fd3469ead5b937293c213daa1f589b4b7ce46 Author: Florian Fainelli Date: Tue Jul 19 17:33:21 2022 +0100 ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") added a check to determine whether arm_dma_zone_size is exceeding the amount of kernel virtual address space available between the upper 4GB virtual address limit and PAGE_OFFSET in order to provide a suitable definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual address space. The quantity used for comparison was off by a missing trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit quantity. This was caught thanks to CONFIG_DEBUG_VIRTUAL on the bcm2711 platform where we define a dma_zone_size of 1GB and we have a PAGE_OFFSET value of 0xc000_0000 (CONFIG_VMSPLIT_3G) leading to MAX_DMA_ADDRESS being 0x1_0000_0000 which overflows the unsigned long type used throughout __pa() and then __virt_addr_valid(). Because the virtual address passed to __virt_addr_valid() would now be 0, the function would loudly warn and flood the kernel log, thus making the platform unable to boot properly. Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis") Signed-off-by: Florian Fainelli Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 6e7765cb477a9753670d4351d14de93f1e9dbbd4 Merge: 9d8a8616ee47f e2a619ca0b38f Author: Linus Torvalds Date: Wed Jul 27 09:50:18 2022 -0700 Merge tag 'asm-generic-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "Two more bug fixes for asm-generic, one addressing an incorrect Kconfig symbol reference and another one fixing a build failure for the perf tool on mips and possibly others" * tag 'asm-generic-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: remove a broken and needless ifdef conditional tools: Fixed MIPS builds due to struct flock re-definition commit 9d8a8616ee47f478a9f78ab97f55c3fbf71bb5f0 Merge: 39c3c396f8131 c5cdb9286913a Author: Linus Torvalds Date: Wed Jul 27 09:43:07 2022 -0700 Merge tag 'soc-fixes-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "One last set of changes for the soc tree: - fix clock frequency on lan966x - fix incorrect GPIO numbers on some pxa machines - update Baolin's email address" * tag 'soc-fixes-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: pxa2xx: Fix GPIO descriptor tables mailmap: update Baolin Wang's email ARM: dts: lan966x: fix sys_clk frequency commit 5bb6c1d1126ebcbcd6314f80d82f50b021a9e351 Author: Borislav Petkov Date: Wed Jul 27 13:24:21 2022 +0200 Revert "x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV" This reverts commit 007faec014cb5d26983c1f86fd08c6539b41392e. Now that hyperv does its own protocol negotiation: 49d6a3c062a1 ("x86/Hyper-V: Add SEV negotiate protocol support in Isolation VM") revert this exposure of the sev_es_ghcb_hv_call() helper. Cc: Wei Liu Signed-off-by: Borislav Petkov Reviewed-by：Tianyu Lan Link: https://lore.kernel.org/r/20220614014553.1915929-1-ltykernel@gmail.com commit 871808fd6981bcc6bb48f71032f983ca77748e96 Author: Lukas Bulwahn Date: Fri Jul 22 14:18:15 2022 +0200 x86/configs: Update configs in x86_debug.config Commit 4675ff05de2d ("kmemcheck: rip it out") removed kmemcheck and its corresponding build config KMEMCHECK. Commit 0f620cefd775 ("objtool: Rename "VMLINUX_VALIDATION" -> "NOINSTR_VALIDATION"") renamed the debug config option. Adjust x86_debug.config to those changes in debug configs. Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220722121815.27535-1-lukas.bulwahn@gmail.com commit eda3953b6a805d6df87a4c51058493ec88bfc622 Merge: 82e094f7bd988 d6c52fa3e955b Author: Jens Axboe Date: Wed Jul 27 10:03:40 2022 -0600 Merge tag 'nvme-5.19-2022-07-27' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fix from Christoph: "nvme fix for Linux 5.19 - yet another duplicate ID quirk (Tobias Gruetzmacher)" * tag 'nvme-5.19-2022-07-27' of git://git.infradead.org/nvme: nvme-pci: Crucial P2 has bogus namespace ids commit 9a241805673ec0a826b7ddf84b00f4e03adb0a5e Author: Ian Rogers Date: Tue Jul 26 15:09:21 2022 -0700 perf bpf: Remove undefined behavior from bpf_perf_object__next() bpf_perf_object__next() folded the last element in the list test with the empty list test. However, this meant that offsets were computed against null and that a struct list_head was compared against a 'struct bpf_perf_object'. Working around this with clang's undefined behavior sanitizer required -fno-sanitize=null and -fno-sanitize=object-size. Remove the undefined behavior by using the regular Linux list APIs and handling the starting case separately from the end testing case. Looking at uses like bpf_perf_object__for_each(), as the constant NULL or non-NULL argument can be constant propagated, the code is no less efficient. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Christy Lee Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Miaoqian Lin Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Rix Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20220726220921.2567761-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 882528d2e77687c3ef26abb9c490f77a9c1f6e1a Author: Leo Yan Date: Sun Jul 24 14:00:13 2022 +0800 perf symbol: Skip symbols if SHF_ALLOC flag is not set Some symbols are observed with the 'st_value' field zeroed. E.g. libc.so.6 in Ubuntu contains a symbol '__evoke_link_warning_getwd' which resides in the '.gnu.warning.getwd' section. Unlike normal sections, such kind of sections are used for linker warning when a file calls deprecated functions, but they are not part of memory images, the symbols in these sections should be dropped. This patch checks the section attribute SHF_ALLOC bit, if the bit is not set, it skips symbols to avoid spurious ones. Suggested-by: Fangrui Song Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Chang Rui Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220724060013.171050-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 2d86612aacb7805f72873691a2644d7279ed0630 Author: Leo Yan Date: Sun Jul 24 14:00:12 2022 +0800 perf symbol: Correct address for bss symbols When using 'perf mem' and 'perf c2c', an issue is observed that tool reports the wrong offset for global data symbols. This is a common issue on both x86 and Arm64 platforms. Let's see an example, for a test program, below is the disassembly for its .bss section which is dumped with objdump: ... Disassembly of section .bss: 0000000000004040 : ... 0000000000004080 : ... 00000000000040c0 : ... 0000000000004100 : ... First we used 'perf mem record' to run the test program and then used 'perf --debug verbose=4 mem report' to observe what's the symbol info for 'buf1' and 'buf2' structures. # ./perf mem record -e ldlat-loads,ldlat-stores -- false_sharing.exe 8 # ./perf --debug verbose=4 mem report ... dso__load_sym_internal: adjusting symbol: st_value: 0x40c0 sh_addr: 0x4040 sh_offset: 0x3028 symbol__new: buf2 0x30a8-0x30e8 ... dso__load_sym_internal: adjusting symbol: st_value: 0x4080 sh_addr: 0x4040 sh_offset: 0x3028 symbol__new: buf1 0x3068-0x30a8 ... The perf tool relies on libelf to parse symbols, in executable and shared object files, 'st_value' holds a virtual address; 'sh_addr' is the address at which section's first byte should reside in memory, and 'sh_offset' is the byte offset from the beginning of the file to the first byte in the section. The perf tool uses below formula to convert a symbol's memory address to a file address: file_address = st_value - sh_addr + sh_offset ^ ` Memory address We can see the final adjusted address ranges for buf1 and buf2 are [0x30a8-0x30e8) and [0x3068-0x30a8) respectively, apparently this is incorrect, in the code, the structure for 'buf1' and 'buf2' specifies compiler attribute with 64-byte alignment. The problem happens for 'sh_offset', libelf returns it as 0x3028 which is not 64-byte aligned, combining with disassembly, it's likely libelf doesn't respect the alignment for .bss section, therefore, it doesn't return the aligned value for 'sh_offset'. Suggested by Fangrui Song, ELF file contains program header which contains PT_LOAD segments, the fields p_vaddr and p_offset in PT_LOAD segments contain the execution info. A better choice for converting memory address to file address is using the formula: file_address = st_value - p_vaddr + p_offset This patch introduces elf_read_program_header() which returns the program header based on the passed 'st_value', then it uses the formula above to calculate the symbol file address; and the debugging log is updated respectively. After applying the change: # ./perf --debug verbose=4 mem report ... dso__load_sym_internal: adjusting symbol: st_value: 0x40c0 p_vaddr: 0x3d28 p_offset: 0x2d28 symbol__new: buf2 0x30c0-0x3100 ... dso__load_sym_internal: adjusting symbol: st_value: 0x4080 p_vaddr: 0x3d28 p_offset: 0x2d28 symbol__new: buf1 0x3080-0x30c0 ... Fixes: f17e04afaff84b5c ("perf report: Fix ELF symbol parsing") Reported-by: Chang Rui Suggested-by: Fangrui Song Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220724060013.171050-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit b226521923aee7051f4b24df9be5bf07d53f0a2b Author: Leo Yan Date: Mon Jul 25 18:42:20 2022 +0800 perf scripts python: Let script to be python2 compliant The mainline kernel can be used for relative old distros, e.g. RHEL 7. The distro doesn't upgrade from python2 to python3, this causes the building error that the python script is not python2 compliant. To fix the building failure, this patch changes from the python f-string format to traditional string format. Fixes: 12fdd6c009da0d02 ("perf scripts python: Support Arm CoreSight trace data disassembly") Reported-by: Akemi Yagi Signed-off-by: Leo Yan Cc: Alexander Shishkin Cc: ElRepo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220725104220.1106663-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 553de6e1157df63fc6cdfe4573e04c8edcbe68f2 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: 28a99e95f55c6185 ("x86/amd: Use IBPB for firmware calls") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra commit 5a159128faff151b7fe5f4eb0f310b1e0a2d56bf Author: Jason Wang Date: Mon Jul 25 15:21:59 2022 +0800 virtio-net: fix the race between refill work and close We try using cancel_delayed_work_sync() to prevent the work from enabling NAPI. This is insufficient since we don't disable the source of the refill work scheduling. This means an NAPI poll callback after cancel_delayed_work_sync() can schedule the refill work then can re-enable the NAPI that leads to use-after-free [1]. Since the work can enable NAPI, we can't simply disable NAPI before calling cancel_delayed_work_sync(). So fix this by introducing a dedicated boolean to control whether or not the work could be scheduled from NAPI. [1] ================================================================== BUG: KASAN: use-after-free in refill_work+0x43/0xd4 Read of size 2 at addr ffff88810562c92e by task kworker/2:1/42 CPU: 2 PID: 42 Comm: kworker/2:1 Not tainted 5.19.0-rc1+ #480 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events refill_work Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0xbb/0x6ac ? _printk+0xad/0xde ? refill_work+0x43/0xd4 kasan_report+0xa8/0x130 ? refill_work+0x43/0xd4 refill_work+0x43/0xd4 process_one_work+0x43d/0x780 worker_thread+0x2a0/0x6f0 ? process_one_work+0x780/0x780 kthread+0x167/0x1a0 ? kthread_exit+0x50/0x50 ret_from_fork+0x22/0x30 ... Fixes: b2baed69e605c ("virtio_net: set/cancel work on ndo_open/ndo_stop") Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Signed-off-by: David S. Miller commit 5e2805d5379619c4a2e3ae4994e73b36439f4bad Author: Toshi Kani Date: Thu Jul 21 12:05:03 2022 -0600 EDAC/ghes: Set the DIMM label unconditionally The commit cb51a371d08e ("EDAC/ghes: Setup DIMM label from DMI and use it in error reports") enforced that both the bank and device strings passed to dimm_setup_label() are not NULL. However, there are BIOSes, for example on a HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019 which don't populate both strings: Handle 0x0020, DMI type 17, 84 bytes Memory Device Array Handle: 0x0013 Error Information Handle: Not Provided Total Width: 72 bits Data Width: 64 bits Size: 32 GB Form Factor: DIMM Set: None Locator: PROC 1 DIMM 1 <===== device Bank Locator: Not Specified <===== bank This results in a buffer overflow because ghes_edac_register() calls strlen() on an uninitialized label, which had non-zero values left over from krealloc_array(): detected buffer overflow in __fortify_strlen ------------[ cut here ]------------ kernel BUG at lib/string_helpers.c:983! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc36.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019 RIP: 0010:fortify_panic ... Call Trace: ghes_edac_register.cold ghes_probe platform_probe really_probe __driver_probe_device driver_probe_device __driver_attach ? __device_attach_driver bus_for_each_dev bus_add_driver driver_register acpi_ghes_init acpi_init ? acpi_sleep_proc_init do_one_initcall The label contains garbage because the commit in Fixes reallocs the DIMMs array while scanning the system but doesn't clear the newly allocated memory. Change dimm_setup_label() to always initialize the label to fix the issue. Set it to the empty string in case BIOS does not provide both bank and device so that ghes_edac_register() can keep the default label given by edac_mc_alloc_dimms(). [ bp: Rewrite commit message. ] Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init") Co-developed-by: Robert Richter Signed-off-by: Robert Richter Signed-off-by: Toshi Kani Signed-off-by: Borislav Petkov Tested-by: Robert Elliott Cc: Link: https://lore.kernel.org/r/20220719220124.760359-1-toshi.kani@hpe.com commit b5177ed92bf6f9d90a2493ed51c1327e088be1df Author: Mat Martineau Date: Mon Jul 25 13:52:31 2022 -0700 mptcp: Do not return EINPROGRESS when subflow creation succeeds New subflows are created within the kernel using O_NONBLOCK, so EINPROGRESS is the expected return value from kernel_connect(). __mptcp_subflow_connect() has the correct logic to consider EINPROGRESS to be a successful case, but it has also used that error code as its return value. Before v5.19 this was benign: all the callers ignored the return value. Starting in v5.19 there is a MPTCP_PM_CMD_SUBFLOW_CREATE generic netlink command that does use the return value, so the EINPROGRESS gets propagated to userspace. Make __mptcp_subflow_connect() always return 0 on success instead. Fixes: ec3edaa7ca6c ("mptcp: Add handling of outgoing MP_JOIN requests") Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Acked-by: Paolo Abeni Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20220725205231.87529-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit e77ea97d2bd99b004e96c339ee22408c5475a52e Merge: e53f529397318 47f4f510ad586 Author: Jakub Kicinski Date: Tue Jul 26 19:53:09 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net Three late fixes for netfilter: 1) If nf_queue user requests packet truncation below size of l3 header, we corrupt the skb, then crash. Reject such requests. 2) add cond_resched() calls when doing cycle detection in the nf_tables graph. This avoids softlockup warning with certain rulesets. 3) Reject rulesets that use nftables 'queue' expression in family/chain combinations other than those that are supported. Currently the ruleset will load, but when userspace attempts to reinject you get WARN splat + packet drops. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_queue: only allow supported familes and hooks netfilter: nf_tables: add rescheduling points during loop detection walks netfilter: nf_queue: do not allow packet truncation below transport header offset ==================== Link: https://lore.kernel.org/r/20220726192056.13497-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit e53f5293973181e8f557a7fef9a47f131fc3d4f0 Merge: aa40d5a43526c d0be8347c623e Author: Jakub Kicinski Date: Tue Jul 26 19:48:24 2022 -0700 Merge tag 'for-net-2022-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix early wakeup after suspend - Fix double free on error - Fix use-after-free on l2cap_chan_put * tag 'for-net-2022-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Bluetooth: Always set event mask on suspend Bluetooth: mgmt: Fix double free on error path ==================== Link: https://lore.kernel.org/r/20220726221328.423714-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 39c3c396f8131f3db454c80e0fcfcdc54ed9ec01 Merge: 5de64d44968e4 1f7ea54727caa Author: Linus Torvalds Date: Tue Jul 26 19:38:46 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Thirteen hotfixes. Eight are cc:stable and the remainder are for post-5.18 issues or are too minor to warrant backporting" * tag 'mm-hotfixes-stable-2022-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: update Gao Xiang's email addresses userfaultfd: provide properly masked address for huge-pages Revert "ocfs2: mount shared volume without ha stack" hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte fs: sendfile handles O_NONBLOCK of out_fd ntfs: fix use-after-free in ntfs_ucsncmp() secretmem: fix unhandled fault in truncate mm/hugetlb: separate path for hwpoison entry in copy_hugetlb_page_range() mm: fix missing wake-up event for FSDAX pages mm: fix page leak with multiple threads mapping the same page mailmap: update Seth Forshee's email address tmpfs: fix the issue that the mount and remount results are inconsistent. mm: kfence: apply kmemleak_ignore_phys on early allocated pool commit f5c2976e0cb0f6236013bfb479868531b04f61d4 Author: Bart Van Assche Date: Wed Jul 20 10:02:23 2022 -0700 scsi: ufs: core: Fix a race condition related to device management If a device management command completion happens after wait_for_completion_timeout() times out and before ufshcd_clear_cmds() is called, then the completion code may crash on the complete() call in __ufshcd_transfer_req_compl(). Fix the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: complete+0x64/0x178 __ufshcd_transfer_req_compl+0x30c/0x9c0 ufshcd_poll+0xf0/0x208 ufshcd_sl_intr+0xb8/0xf0 ufshcd_intr+0x168/0x2f4 __handle_irq_event_percpu+0xa0/0x30c handle_irq_event+0x84/0x178 handle_fasteoi_irq+0x150/0x2e8 __handle_domain_irq+0x114/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 efi_header_end+0x110/0x680 __irq_exit_rcu+0x108/0x124 __handle_domain_irq+0x118/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 cpuidle_enter_state+0x3ac/0x8c4 do_idle+0x2fc/0x55c cpu_startup_entry+0x84/0x90 kernel_init+0x0/0x310 start_kernel+0x0/0x608 start_kernel+0x4ec/0x608 Link: https://lore.kernel.org/r/20220720170228.1598842-1-bvanassche@acm.org Fixes: 5a0b0cb9bee7 ("[SCSI] ufs: Add support for sending NOP OUT UPIU") Cc: Adrian Hunter Cc: Avri Altman Cc: Bean Huo Cc: Stanley Chu Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d9a434fa0c12ed5f7afe1e9dd30003ab5d059b85 Author: Jason Yan Date: Wed Jul 20 10:51:20 2022 +0800 scsi: core: Fix warning in scsi_alloc_sgtables() As explained in SG_IO howto[1]: "If iovec_count is non-zero then 'dxfer_len' should be equal to the sum of iov_len lengths. If not, the minimum of the two is the transfer length." When iovec_count is non-zero and dxfer_len is zero, the sg_io() just genarated a null bio, and finally caused a warning below. To fix it, skip generating a bio for this request if dxfer_len is zero. [1] https://tldp.org/HOWTO/SCSI-Generic-HOWTO/x198.html WARNING: CPU: 2 PID: 3643 at drivers/scsi/scsi_lib.c:1032 scsi_alloc_sgtables+0xc7d/0xf70 drivers/scsi/scsi_lib.c:1032 Modules linked in: CPU: 2 PID: 3643 Comm: syz-executor397 Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-204/01/2014 RIP: 0010:scsi_alloc_sgtables+0xc7d/0xf70 drivers/scsi/scsi_lib.c:1032 Code: e7 fc 31 ff 44 89 f6 e8 c1 4e e7 fc 45 85 f6 0f 84 1a f5 ff ff e8 93 4c e7 fc 83 c5 01 0f b7 ed e9 0f f5 ff ff e8 83 4c e7 fc <0f> 0b 41 bc 0a 00 00 00 e9 2b fb ff ff 41 bc 09 00 00 00 e9 20 fb RSP: 0018:ffffc90000d07558 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88801bfc96a0 RCX: 0000000000000000 RDX: ffff88801c876000 RSI: ffffffff849060bd RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff849055b9 R11: 0000000000000000 R12: ffff888012b8c000 R13: ffff88801bfc9580 R14: 0000000000000000 R15: ffff88801432c000 FS: 00007effdec8e700(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007effdec6d718 CR3: 00000000206d6000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: scsi_setup_scsi_cmnd drivers/scsi/scsi_lib.c:1219 [inline] scsi_prepare_cmd drivers/scsi/scsi_lib.c:1614 [inline] scsi_queue_rq+0x283e/0x3630 drivers/scsi/scsi_lib.c:1730 blk_mq_dispatch_rq_list+0x6ea/0x22e0 block/blk-mq.c:1851 __blk_mq_sched_dispatch_requests+0x20b/0x410 block/blk-mq-sched.c:299 blk_mq_sched_dispatch_requests+0xfb/0x180 block/blk-mq-sched.c:332 __blk_mq_run_hw_queue+0xf9/0x350 block/blk-mq.c:1968 __blk_mq_delay_run_hw_queue+0x5b6/0x6c0 block/blk-mq.c:2045 blk_mq_run_hw_queue+0x30f/0x480 block/blk-mq.c:2096 blk_mq_sched_insert_request+0x340/0x440 block/blk-mq-sched.c:451 blk_execute_rq+0xcc/0x340 block/blk-mq.c:1231 sg_io+0x67c/0x1210 drivers/scsi/scsi_ioctl.c:485 scsi_ioctl_sg_io drivers/scsi/scsi_ioctl.c:866 [inline] scsi_ioctl+0xa66/0x1560 drivers/scsi/scsi_ioctl.c:921 sd_ioctl+0x199/0x2a0 drivers/scsi/sd.c:1576 blkdev_ioctl+0x37a/0x800 block/ioctl.c:588 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7effdecdc5d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007effdec8e2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007effded664c0 RCX: 00007effdecdc5d9 RDX: 0000000020002300 RSI: 0000000000002285 RDI: 0000000000000004 RBP: 00007effded34034 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00007effded34054 R14: 2f30656c69662f2e R15: 00007effded664c8 Link: https://lore.kernel.org/r/20220720025120.3226770-1-yanaijie@huawei.com Fixes: 25636e282fe9 ("block: fix SG_IO vector request data length handling") Reported-by: syzbot+d44b35ecfb807e5af0b5@syzkaller.appspotmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Jason Yan Signed-off-by: Martin K. Petersen commit a3435afba87dc6cd83f5595e7607f3c40f93ef01 Author: Liang He Date: Tue Jul 19 15:15:29 2022 +0800 scsi: ufs: host: Hold reference returned by of_parse_phandle() In ufshcd_populate_vreg(), we should hold the reference returned by of_parse_phandle() and then use it to call of_node_put() for refcount balance. Link: https://lore.kernel.org/r/20220719071529.1081166-1-windhl@126.com Fixes: aa4976130934 ("ufs: Add regulator enable support") Reviewed-by: Bart Van Assche Signed-off-by: Liang He Signed-off-by: Martin K. Petersen commit 0fde22c5420ed258ee538a760291c2f3935f6a01 Author: David Jeffery Date: Fri Jul 22 10:24:48 2022 -0400 scsi: mpt3sas: Stop fw fault watchdog work item during system shutdown During system shutdown or reboot, mpt3sas will reset the firmware back to ready state. However, the driver leaves running a watchdog work item intended to keep the firmware in operational state. This causes a second, unneeded reset on shutdown and moves the firmware back to operational instead of in ready state as intended. And if the mpt3sas_fwfault_debug module parameter is set, this extra reset also panics the system. mpt3sas's scsih_shutdown needs to stop the watchdog before resetting the firmware back to ready state. Link: https://lore.kernel.org/r/20220722142448.6289-1-djeffery@redhat.com Fixes: fae21608c31c ("scsi: mpt3sas: Transition IOC to Ready state during shutdown") Tested-by: Laurence Oberman Acked-by: Sreekanth Reddy Signed-off-by: David Jeffery Signed-off-by: Martin K. Petersen commit 1f7ea54727caaa6701a15af0cbeddfdb015b2869 Author: Gao Xiang Date: Tue Jul 19 23:42:46 2022 +0800 mailmap: update Gao Xiang's email addresses I've been in Alibaba Cloud for more than one year, mainly to address cloud-native challenges (such as high-performance container images) for open source communities. Update my email addresses on behalf of my current employer (Alibaba Cloud) to support all my (team) work in this area. Also add an outdated @redhat.com address of me. Link: https://lkml.kernel.org/r/20220719154246.62970-1-xiang@kernel.org Signed-off-by: Gao Xiang Signed-off-by: Andrew Morton commit d172b1a3bd065dd89234eac547fc62cf80681631 Author: Nadav Amit Date: Mon Jul 11 09:59:06 2022 -0700 userfaultfd: provide properly masked address for huge-pages Commit 824ddc601adc ("userfaultfd: provide unmasked address on page-fault") was introduced to fix an old bug, in which the offset in the address of a page-fault was masked. Concerns were raised - although were never backed by actual code - that some userspace code might break because the bug has been around for quite a while. To address these concerns a new flag was introduced, and only when this flag is set by the user, userfaultfd provides the exact address of the page-fault. The commit however had a bug, and if the flag is unset, the offset was always masked based on a base-page granularity. Yet, for huge-pages, the behavior prior to the commit was that the address is masked to the huge-page granulrity. While there are no reports on real breakage, fix this issue. If the flag is unset, use the address with the masking that was done before. Link: https://lkml.kernel.org/r/20220711165906.2682-1-namit@vmware.com Fixes: 824ddc601adc ("userfaultfd: provide unmasked address on page-fault") Signed-off-by: Nadav Amit Reported-by: James Houghton Reviewed-by: Mike Rapoport Reviewed-by: Peter Xu Reviewed-by: James Houghton Cc: David Hildenbrand Cc: Jan Kara Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton commit d0be8347c623e0ac4202a1d4e0373882821f56b0 Author: Luiz Augusto von Dentz Date: Thu Jul 21 09:10:50 2022 -0700 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put This fixes the following trace which is caused by hci_rx_work starting up *after* the final channel reference has been put() during sock_close() but *before* the references to the channel have been destroyed, so instead the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. refcount_t: increment on 0; use-after-free. BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0 Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705 CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W 4.14.234-00003-g1fb6d0bd49a4-dirty #28 Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM sm8150 Flame DVT (DT) Workqueue: hci0 hci_rx_work Call trace: dump_backtrace+0x0/0x378 show_stack+0x20/0x2c dump_stack+0x124/0x148 print_address_description+0x80/0x2e8 __kasan_report+0x168/0x188 kasan_report+0x10/0x18 __asan_load4+0x84/0x8c refcount_dec_and_test+0x20/0xd0 l2cap_chan_put+0x48/0x12c l2cap_recv_frame+0x4770/0x6550 l2cap_recv_acldata+0x44c/0x7a4 hci_acldata_packet+0x100/0x188 hci_rx_work+0x178/0x23c process_one_work+0x35c/0x95c worker_thread+0x4cc/0x960 kthread+0x1a8/0x1c4 ret_from_fork+0x10/0x18 Cc: stable@kernel.org Reported-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz Tested-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz commit ef61b6ea154464fefd8a6712d7a3b43b445c3d4a Author: Abhishek Pandit-Subedi Date: Mon Jul 25 15:34:21 2022 -0700 Bluetooth: Always set event mask on suspend When suspending, always set the event mask once disconnects are successful. Otherwise, if wakeup is disallowed, the event mask is not set before suspend continues and can result in an early wakeup. Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Cc: stable@vger.kernel.org Signed-off-by: Abhishek Pandit-Subedi Signed-off-by: Luiz Augusto von Dentz commit 4b2f4e072fb2599b6a2e5e277f0d2b5705eaa630 Author: Dan Carpenter Date: Tue Jul 26 18:13:44 2022 +0300 Bluetooth: mgmt: Fix double free on error path Don't call mgmt_pending_remove() twice (double free). Fixes: 6b88eff43704 ("Bluetooth: hci_sync: Refactor remove Adv Monitor") Signed-off-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz commit aa40d5a43526cca9439a2b45fcfdcd016594dece Author: Tetsuo Handa Date: Sun Jul 17 21:21:52 2022 +0900 wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop() lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1], for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped") guards clear_bit() using fq.lock even before fq_init() from ieee80211_txq_setup_flows() initializes this spinlock. According to discussion [2], Toke was not happy with expanding usage of fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we can instead use synchronize_rcu() for flushing ieee80211_wake_txqs(). Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1] Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2] Reported-by: syzbot Signed-off-by: Tetsuo Handa Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped") Tested-by: syzbot Acked-by: Toke Høiland-Jørgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp [ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next] Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/ Signed-off-by: Jakub Kicinski commit cc019545a238518fa9da1e2a889f6e1bb1005a63 Author: Maciej Fijalkowski Date: Thu Jul 7 12:20:43 2022 +0200 ice: do not setup vlan for loopback VSI Currently loopback test is failiing due to the error returned from ice_vsi_vlan_setup(). Skip calling it when preparing loopback VSI. Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 283d736ff7c7e96ac5b32c6c0de40372f8eb171e Author: Maciej Fijalkowski Date: Thu Jul 7 12:20:42 2022 +0200 ice: check (DD | EOF) bits on Rx descriptor rather than (EOP | RS) Tx side sets EOP and RS bits on descriptors to indicate that a particular descriptor is the last one and needs to generate an irq when it was sent. These bits should not be checked on completion path regardless whether it's the Tx or the Rx. DD bit serves this purpose and it indicates that a particular descriptor is either for Rx or was successfully Txed. EOF is also set as loopback test does not xmit fragmented frames. Look at (DD | EOF) bits setting in ice_lbtest_receive_frames() instead of EOP and RS pair. Fixes: 0e674aeb0b77 ("ice: Add handler for ethtool selftest") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 5c8e3c7ff3e7bd7b938659be704f75cc746b697f Author: Anirudh Venkataramanan Date: Thu Jul 21 10:03:09 2022 +0200 ice: Fix VSIs unable to share unicast MAC The driver currently does not allow two VSIs in the same PF domain to have the same unicast MAC address. This is incorrect in the sense that a policy decision is being made in the driver when it must be left to the user. This approach was causing issues when rebooting the system with VFs spawned not being able to change their MAC addresses. Such errors were present in dmesg: [ 7921.068237] ice 0000:b6:00.2 ens2f2: Unicast MAC 6a:0d:e4:70:ca:d1 already exists on this PF. Preventing setting VF 7 unicast MAC address to 6a:0d:e4:70:ca:d1 Fix that by removing this restriction. Doing this also allows us to remove some additional code that's checking if a unicast MAC filter already exists. Fixes: 47ebc7b02485 ("ice: Check if unicast MAC exists before setting VF MAC") Signed-off-by: Anirudh Venkataramanan Signed-off-by: Sylwester Dziedziuch Signed-off-by: Mateusz Palczewski Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 01658aeeada6f93c2924af94d895ff28d559690c Author: Przemyslaw Patynowski Date: Mon Jul 18 13:34:27 2022 +0200 ice: Fix tunnel checksum offload with fragmented traffic Fix checksum offload on VXLAN tunnels. In case, when mpls protocol is not used, set l4 header to transport header of skb. This fixes case, when user tries to offload checksums of VXLAN tunneled traffic. Steps for reproduction (requires link partner with tunnels): ip l s enp130s0f0 up ip a f enp130s0f0 ip a a 10.10.110.2/24 dev enp130s0f0 ip l s enp130s0f0 mtu 1600 ip link add vxlan12_sut type vxlan id 12 group 238.168.100.100 dev enp130s0f0 dstport 4789 ip l s vxlan12_sut up ip a a 20.10.110.2/24 dev vxlan12_sut iperf3 -c 20.10.110.1 #should connect Offload params: td_offset, cd_tunnel_params were corrupted, due to l4 header pointing wrong address. NIC would then drop those packets internally, due to incorrect TX descriptor data, which increased GLV_TEPC register. Fixes: 69e66c04c672 ("ice: Add mpls+tso support") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 1e308c6fb7127371f48a0fb9770ea0b30a6b5698 Author: Przemyslaw Patynowski Date: Mon Jul 4 15:46:12 2022 +0200 ice: Fix max VLANs available for VF Legacy VLAN implementation allows for untrusted VF to have 8 VLAN filters, not counting VLAN 0 filters. Current VLAN_V2 implementation lowers available filters for VF, by counting in VLAN 0 filter for both TPIDs. Fix this by counting only non zero VLAN filters. Without this patch, untrusted VF would not be able to access 8 VLAN filters. Fixes: cc71de8fa133 ("ice: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 47f4f510ad586032b85c89a0773fbb011d412425 Author: Florian Westphal Date: Tue Jul 26 19:49:00 2022 +0200 netfilter: nft_queue: only allow supported familes and hooks Trying to use 'queue' statement in ingress (for example) triggers a splat on reinject: WARNING: CPU: 3 PID: 1345 at net/netfilter/nf_queue.c:291 ... because nf_reinject cannot find the ruleset head. The netdev family doesn't support async resume at the moment anyway, so disallow loading such rulesets with a more appropriate error message. v2: add 'validate' callback and also check hook points, v1 did allow ingress use in 'table inet', but that doesn't work either. (Pablo) Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso commit 81ea010667417ef3f218dfd99b69769fe66c2b67 Author: Florian Westphal Date: Tue Jul 26 12:44:35 2022 +0200 netfilter: nf_tables: add rescheduling points during loop detection walks Add explicit rescheduling points during ruleset walk. Switching to a faster algorithm is possible but this is a much smaller change, suitable for nf tree. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1460 Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 Author: Florian Westphal Date: Tue Jul 26 12:42:06 2022 +0200 netfilter: nf_queue: do not allow packet truncation below transport header offset Domingo Dirutigliano and Nicola Guerrera report kernel panic when sending nf_queue verdict with 1-byte nfta_payload attribute. The IP/IPv6 stack pulls the IP(v6) header from the packet after the input hook. If user truncates the packet below the header size, this skb_pull() will result in a malformed skb (skb->len < 0). Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink") Reported-by: Domingo Dirutigliano Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso commit 5de64d44968e4ae66ebdb0a2d08b443f189d3651 Merge: cdb281e638740 918e75f77af7d Author: Linus Torvalds Date: Tue Jul 26 10:03:53 2022 -0700 Merge tag 's390-5.19-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Alexander GordeevL - Prevent relatively slow PRNO TRNG random number operation from being called from interrupt context. That could for example cause some network loads to timeout. * tag 's390-5.19-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/archrandom: prevent CPACF trng invocations in interrupt context commit cdb281e63874086a650552d36c504ea717a0e0cb Author: Qi Zheng Date: Tue Jul 26 14:24:36 2022 +0800 mm: fix NULL pointer dereference in wp_page_reuse() The vmf->page can be NULL when the wp_page_reuse() is invoked by wp_pfn_shared(), it will cause the following panic: BUG: kernel NULL pointer dereference, address: 000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 18 PID: 923 Comm: Xorg Not tainted 5.19.0-rc8.bm.1-amd64 #263 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g14 RIP: 0010:_compound_head+0x0/0x40 [...] Call Trace: wp_page_reuse+0x1c/0xa0 do_wp_page+0x1a5/0x3f0 __handle_mm_fault+0x8cf/0xd20 handle_mm_fault+0xd5/0x2a0 do_user_addr_fault+0x1d0/0x680 exc_page_fault+0x78/0x170 asm_exc_page_fault+0x22/0x30 To fix it, this patch performs a NULL pointer check before dereferencing the vmf->page. Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive") Signed-off-by: Qi Zheng Reviewed-by: David Hildenbrand Signed-off-by: Linus Torvalds commit 0c09bc33aa8e9dc867300acaadc318c2f0d85a1e Author: Nathan Chancellor Date: Mon Jul 25 16:36:29 2022 -0700 drm/simpledrm: Fix return type of simpledrm_simple_display_pipe_mode_valid() When booting a kernel compiled with clang's CFI protection (CONFIG_CFI_CLANG), there is a CFI failure in drm_simple_kms_crtc_mode_valid() when trying to call simpledrm_simple_display_pipe_mode_valid() through ->mode_valid(): [ 0.322802] CFI failure (target: simpledrm_simple_display_pipe_mode_valid+0x0/0x8): ... [ 0.324928] Call trace: [ 0.324969] __ubsan_handle_cfi_check_fail+0x58/0x60 [ 0.325053] __cfi_check_fail+0x3c/0x44 [ 0.325120] __cfi_slowpath_diag+0x178/0x200 [ 0.325192] drm_simple_kms_crtc_mode_valid+0x58/0x80 [ 0.325279] __drm_helper_update_and_validate+0x31c/0x464 ... The ->mode_valid() member in 'struct drm_simple_display_pipe_funcs' expects a return type of 'enum drm_mode_status', not 'int'. Correct it to fix the CFI failure. Cc: stable@vger.kernel.org Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Link: https://github.com/ClangBuiltLinux/linux/issues/1647 Reported-by: Tomasz Paweł Gajc Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Zimmermann Reviewed-by: Sami Tolvanen Link: https://patchwork.freedesktop.org/patch/msgid/20220725233629.223223-1-nathan@kernel.org commit 9b134b1694ec8926926ba6b7b80884ea829245a0 Author: Benjamin Poirier Date: Mon Jul 25 09:12:36 2022 +0900 bridge: Do not send empty IFLA_AF_SPEC attribute After commit b6c02ef54913 ("bridge: Netlink interface fix."), br_fill_ifinfo() started to send an empty IFLA_AF_SPEC attribute when a bridge vlan dump is requested but an interface does not have any vlans configured. iproute2 ignores such an empty attribute since commit b262a9becbcb ("bridge: Fix output with empty vlan lists") but older iproute2 versions as well as other utilities have their output changed by the cited kernel commit, resulting in failed test cases. Regardless, emitting an empty attribute is pointless and inefficient. Avoid this change by canceling the attribute if no AF_SPEC data was added. Fixes: b6c02ef54913 ("bridge: Netlink interface fix.") Reviewed-by: Ido Schimmel Signed-off-by: Benjamin Poirier Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20220725001236.95062-1-bpoirier@nvidia.com Signed-off-by: Paolo Abeni commit 33881ab73d6f6b4f0a2a89aece86dd60e6e507c6 Merge: b89fc26f741d9 59e1be6f83b92 Author: Paolo Abeni Date: Tue Jul 26 13:05:46 2022 +0200 Merge branch 'octeontx2-minor-tc-fixes' Subbaraya Sundeep says: ==================== Octeontx2 minor tc fixes This patch set fixes two problems found in tc code wrt to ratelimiting and when installing UDP/TCP filters. Patch 1: CN10K has different register format compared to CN9xx hence fixes that. Patch 2: Check flow mask also before installing a src/dst port filter, otherwise installing for one port installs for other one too. ==================== Link: https://lore.kernel.org/r/1658650874-16459-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni commit 59e1be6f83b928a04189bbf3ab683a1fc6248db3 Author: Subbaraya Sundeep Date: Sun Jul 24 13:51:14 2022 +0530 octeontx2-pf: Fix UDP/TCP src and dst port tc filters Check the mask for non-zero value before installing tc filters for L4 source and destination ports. Otherwise installing a filter for source port installs destination port too and vice-versa. Fixes: 1d4d9e42c240 ("octeontx2-pf: Add tc flower hardware offload on ingress traffic") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Paolo Abeni commit b354eaeec8637d87003945439209251d76a2bb95 Author: Sunil Goutham Date: Sun Jul 24 13:51:13 2022 +0530 octeontx2-pf: cn10k: Fix egress ratelimit configuration NIX_AF_TLXX_PIR/CIR register format has changed from OcteonTx2 to CN10K. CN10K supports larger burst size. Fix burst exponent and burst mantissa configuration for CN10K. Also fixed 'maxrate' from u32 to u64 since 'police.rate_bytes_ps' passed by stack is also u64. Fixes: e638a83f167e ("octeontx2-pf: TC_MATCHALL egress ratelimiting offload") Signed-off-by: Sunil Goutham Signed-off-by: Subbaraya Sundeep Signed-off-by: Paolo Abeni commit b89fc26f741d9f9efb51cba3e9b241cf1380ec5a Author: Duoming Zhou Date: Sat Jul 23 09:58:09 2022 +0800 sctp: fix sleep in atomic context bug in timer handlers There are sleep in atomic context bugs in timer handlers of sctp such as sctp_generate_t3_rtx_event(), sctp_generate_probe_event(), sctp_generate_t1_init_event(), sctp_generate_timeout_event(), sctp_generate_t3_rtx_event() and so on. The root cause is sctp_sched_prio_init_sid() with GFP_KERNEL parameter that may sleep could be called by different timer handlers which is in interrupt context. One of the call paths that could trigger bug is shown below: (interrupt context) sctp_generate_probe_event sctp_do_sm sctp_side_effects sctp_cmd_interpreter sctp_outq_teardown sctp_outq_init sctp_sched_set_sched n->init_sid(..,GFP_KERNEL) sctp_sched_prio_init_sid //may sleep This patch changes gfp_t parameter of init_sid in sctp_sched_set_sched() from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic context bugs. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Signed-off-by: Duoming Zhou Acked-by: Marcelo Ricardo Leitner Link: https://lore.kernel.org/r/20220723015809.11553-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit c7560d1203b7a1ea0b99a5c575547e95d564b2a8 Author: Vladimir Oltean Date: Sat Jul 23 04:24:11 2022 +0300 net: dsa: fix reference counting for LAG FDBs Due to an invalid conflict resolution on my side while working on 2 different series (LAG FDBs and FDB isolation), dsa_switch_do_lag_fdb_add() does not store the database associated with a dsa_mac_addr structure. So after adding an FDB entry associated with a LAG, dsa_mac_addr_find() fails to find it while deleting it, because &a->db is zeroized memory for all stored FDB entries of lag->fdbs, and dsa_switch_do_lag_fdb_del() returns -ENOENT rather than deleting the entry. Fixes: c26933639b54 ("net: dsa: request drivers to perform FDB isolation") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220723012411.1125066-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5fcbb711024aac6d4db385623e6f2fdf019f7782 Author: Michal Maloszewski Date: Fri Jul 22 10:54:01 2022 -0700 i40e: Fix interface init with MSI interrupts (no MSI-X) Fix the inability to bring an interface up on a setup with only MSI interrupts enabled (no MSI-X). Solution is to add a default number of QPs = 1. This is enough, since without MSI-X support driver enables only a basic feature set. Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") Signed-off-by: Dawid Lukwinski Signed-off-by: Michal Maloszewski Tested-by: Dave Switzer Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220722175401.112572-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c653c591789b3acfa4bf6ae45d5af4f330e50a91 Author: Michael Ellerman Date: Mon Jul 25 14:37:29 2022 +1000 drm/amdgpu: Re-enable DCN for 64-bit powerpc Commit d11219ad53dc ("amdgpu: disable powerpc support for the newer display engine") disabled the DCN driver for all of powerpc due to unresolved build failures with some compilers. Further digging shows that the build failures only occur with compilers that default to 64-bit long double. Both the ppc64 and ppc64le ABIs define long double to be 128-bits, but there are compilers in the wild that default to 64-bits. The compilers provided by the major distros (Fedora, Ubuntu) default to 128-bits and are not affected by the build failure. There is a compiler flag to force 128-bit long double, which may be the correct long term fix, but as an interim fix only allow building the DCN driver if long double is 128-bits by default. The bisection in commit d11219ad53dc must have gone off the rails at some point, the build failure occurs all the way back to the original commit that enabled DCN support on powerpc, at least with some toolchains. Depends-on: d11219ad53dc ("amdgpu: disable powerpc support for the newer display engine") Fixes: 16a9dea110a6 ("amdgpu: Enable initial DCN support on POWER") Signed-off-by: Michael Ellerman Acked-by: Alex Deucher Reviewed-by: Dan Horák Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2100 Link: https://lore.kernel.org/r/20220725123918.1903255-1-mpe@ellerman.id.au commit d295ad34f236c3518634fb6403d4c0160456e470 Author: Waiman Long Date: Sat Jul 23 15:59:32 2022 -0400 intel_idle: Fix false positive RCU splats due to incorrect hardirqs state Commit 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE") uses raw_local_irq_enable/local_irq_disable() around call to __intel_idle() in intel_idle_irq(). With interrupt enabled, timer tick interrupt can happen and a subsequently call to __do_softirq() may change the lockdep hardirqs state of a debug kernel back to 'on'. This will result in a mismatch between the cpu hardirqs state (off) and the lockdep hardirqs state (on) causing a number of false positive "WARNING: suspicious RCU usage" splats. Fix that by using local_irq_disable() to disable interrupt in intel_idle_irq(). Fixes: 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE") Signed-off-by: Waiman Long Cc: 5.16+ # 5.16+ Signed-off-by: Rafael J. Wysocki commit a7a47a5dfa9a9692a41764ee9ab4054f12924a42 Author: Umesh Nerlige Ramappa Date: Tue Jun 21 12:21:05 2022 -0700 drm/i915/reset: Add additional steps for Wa_22011802037 for execlist backend For execlists backend, current implementation of Wa_22011802037 is to stop the CS before doing a reset of the engine. This WA was further extended to wait for any pending MI FORCE WAKEUPs before issuing a reset. Add the extended steps in the execlist path of reset. In addition, extend the WA to gen11. v2: (Tvrtko) - Clarify comments, commit message, fix typos - Use IS_GRAPHICS_VER for gen 11/12 checks v3: (Daneile) - Drop changes to intel_ring_submission since WA does not apply to it - Log an error if MSG IDLE is not defined for an engine Signed-off-by: Umesh Nerlige Ramappa Fixes: f6aa0d713c88 ("drm/i915: Add Wa_22011802037 force cs halt") Acked-by: Tvrtko Ursulin Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220621192105.2100585-1-umesh.nerlige.ramappa@intel.com (cherry picked from commit 0667429ce68e0b08f9f1fec8fd0b1f57228f605e) Signed-off-by: Tvrtko Ursulin commit 9af0620de1e118666881376f6497d1785758b04c Merge: 3e7d18b9dca38 96b9bd8c6d125 Author: David S. Miller Date: Mon Jul 25 12:42:10 2022 +0100 Merge branch 'net-sysctl-races-part-6' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Round 6, Final). This series fixes data-races around 11 knobs after tcp_pacing_ss_ratio ipv4_net_table, and this is the final round for ipv4_net_table. While at it, other data-races around these related knobs are fixed. - decnet_mem - decnet_rmem - tipc_rmem There are still 58 tables possibly missing some fixes under net/. $ grep -rnE "struct ctl_table.*?\[\] =" net/ | wc -l 60 ==================== Signed-off-by: David S. Miller commit 96b9bd8c6d125490f9adfb57d387ef81a55a103e Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:05 2022 -0700 ipv4: Fix data-races around sysctl_fib_notify_on_flag_change. While reading sysctl_fib_notify_on_flag_change, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 870e3a634b6a6cb1543b359007aca73fe6a03ac5 Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:04 2022 -0700 tcp: Fix data-races around sysctl_tcp_reflect_tos. While reading sysctl_tcp_reflect_tos, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: ac8f1710c12b ("tcp: reflect tos value received in SYN to the socket") Signed-off-by: Kuniyuki Iwashima Acked-by: Wei Wang Signed-off-by: David S. Miller commit 79f55473bfc8ac51bd6572929a679eeb4da22251 Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:03 2022 -0700 tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. While reading sysctl_tcp_comp_sack_nr, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 9c21d2fc41c0 ("tcp: add tcp_comp_sack_nr sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 22396941a7f343d704738360f9ef0e6576489d43 Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:02 2022 -0700 tcp: Fix a data-race around sysctl_tcp_comp_sack_slack_ns. While reading sysctl_tcp_comp_sack_slack_ns, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: a70437cc09a1 ("tcp: add hrtimer slack to sack compression") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4866b2b0f7672b6d760c4b8ece6fb56f965dcc8a Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:01 2022 -0700 tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. While reading sysctl_tcp_comp_sack_delay_ns, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 6d82aa242092 ("tcp: add tcp_comp_sack_delay_ns sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 02739545951ad4c1215160db7fbf9b7a918d3c0b Author: Kuniyuki Iwashima Date: Fri Jul 22 11:22:00 2022 -0700 net: Fix data-races around sysctl_[rw]mem(_offset)?. While reading these sysctl variables, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - .sysctl_rmem - .sysctl_rwmem - .sysctl_rmem_offset - .sysctl_wmem_offset - sysctl_tcp_rmem[1, 2] - sysctl_tcp_wmem[1, 2] - sysctl_decnet_rmem[1] - sysctl_decnet_wmem[1] - sysctl_tipc_rmem[1] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 59bf6c65a09fff74215517aecffbbdcd67df76e3 Author: Kuniyuki Iwashima Date: Fri Jul 22 11:21:59 2022 -0700 tcp: Fix data-races around sk_pacing_rate. While reading sysctl_tcp_pacing_(ss|ca)_ratio, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. Fixes: 43e122b014c9 ("tcp: refine pacing rate determination") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 Author: Taehee Yoo Date: Fri Jul 22 17:06:35 2022 +0000 net: mld: fix reference count leak in mld_{query | report}_work() mld_{query | report}_work() processes queued events. If there are too many events in the queue, it re-queue a work. And then, it returns without in6_dev_put(). But if queuing is failed, it should call in6_dev_put(), but it doesn't. So, a reference count leak would occur. THREAD0 THREAD1 mld_report_work() spin_lock_bh() if (!mod_delayed_work()) in6_dev_hold(); spin_unlock_bh() spin_lock_bh() schedule_delayed_work() spin_unlock_bh() Script to reproduce(by Hangbin Liu): ip netns add ns1 ip netns add ns2 ip netns exec ns1 sysctl -w net.ipv6.conf.all.force_mld_version=1 ip netns exec ns2 sysctl -w net.ipv6.conf.all.force_mld_version=1 ip -n ns1 link add veth0 type veth peer name veth0 netns ns2 ip -n ns1 link set veth0 up ip -n ns2 link set veth0 up for i in `seq 50`; do for j in `seq 100`; do ip -n ns1 addr add 2021:${i}::${j}/64 dev veth0 ip -n ns2 addr add 2022:${i}::${j}/64 dev veth0 done done modprobe -r veth ip -a netns del splat looks like: unregister_netdevice: waiting for veth0 to become free. Usage count = 2 leaked reference. ipv6_add_dev+0x324/0xec0 addrconf_notify+0x481/0xd10 raw_notifier_call_chain+0xe3/0x120 call_netdevice_notifiers+0x106/0x160 register_netdevice+0x114c/0x16b0 veth_newlink+0x48b/0xa50 [veth] rtnl_newlink+0x11a2/0x1a40 rtnetlink_rcv_msg+0x63f/0xc00 netlink_rcv_skb+0x1df/0x3e0 netlink_unicast+0x5de/0x850 netlink_sendmsg+0x6c9/0xa90 ____sys_sendmsg+0x76a/0x780 __sys_sendmsg+0x27c/0x340 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Tested-by: Hangbin Liu Fixes: f185de28d9ae ("mld: add new workqueues for process mld events") Signed-off-by: Taehee Yoo Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit c7b205fbbf3cffa374721bb7623f7aa8c46074f1 Author: Jianglei Nie Date: Fri Jul 22 17:29:02 2022 +0800 net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa() init_rx_sa() allocates relevant resource for rx_sa->stats and rx_sa-> key.tfm with alloc_percpu() and macsec_alloc_tfm(). When some error occurs after init_rx_sa() is called in macsec_add_rxsa(), the function released rx_sa with kfree() without releasing rx_sa->stats and rx_sa-> key.tfm, which will lead to a resource leak. We should call macsec_rxsa_put() instead of kfree() to decrease the ref count of rx_sa and release the relevant resource if the refcount is 0. The same bug exists in macsec_add_txsa() for tx_sa as well. This patch fixes the above two bugs. Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") Signed-off-by: Jianglei Nie Signed-off-by: David S. Miller commit 20a854616d384d3210d96fee248a3ea327bab810 Merge: 1aaa62c4838a1 c630d1fe62197 Author: David S. Miller Date: Mon Jul 25 11:49:25 2022 +0100 Merge branch 'macsec-config-issues' Sabrina Dubroca says: ==================== macsec: fix config issues The patch adding netlink support for XPN (commit 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)")) introduced several issues, including a kernel panic reported at [1]. Reproducing those bugs with upstream iproute is limited, since iproute doesn't currently support XPN. I'm also working on this. [1] https://bugzilla.kernel.org/show_bug.cgi?id=208315 ==================== Signed-off-by: David S. Miller commit c630d1fe6219769049c87d1a6a0e9a6de55328a1 Author: Sabrina Dubroca Date: Fri Jul 22 11:16:30 2022 +0200 macsec: always read MACSEC_SA_ATTR_PN as a u64 Currently, MACSEC_SA_ATTR_PN is handled inconsistently, sometimes as a u32, sometimes forced into a u64 without checking the actual length of the attribute. Instead, we can use nla_get_u64 everywhere, which will read up to 64 bits into a u64, capped by the actual length of the attribute coming from userspace. This fixes several issues: - the check in validate_add_rxsa doesn't work with 32-bit attributes - the checks in validate_add_txsa and validate_upd_sa incorrectly reject X << 32 (with X != 0) Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit b07a0e2044057f201d694ab474f5c42a02b6465b Author: Sabrina Dubroca Date: Fri Jul 22 11:16:29 2022 +0200 macsec: limit replay window size with XPN IEEE 802.1AEbw-2013 (section 10.7.8) specifies that the maximum value of the replay window is 2^30-1, to help with recovery of the upper bits of the PN. To avoid leaving the existing macsec device in an inconsistent state if this test fails during changelink, reuse the cleanup mechanism introduced for HW offload. This wasn't needed until now because macsec_changelink_common could not fail during changelink, as modifying the cipher suite was not allowed. Finally, this must happen after handling IFLA_MACSEC_CIPHER_SUITE so that secy->xpn is set. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 3240eac4ff20e51b87600dbd586ed814daf313db Author: Sabrina Dubroca Date: Fri Jul 22 11:16:28 2022 +0200 macsec: fix error message in macsec_add_rxsa and _txsa The expected length is MACSEC_SALT_LEN, not MACSEC_SA_ATTR_SALT. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit f46040eeaf2e523a4096199fd93a11e794818009 Author: Sabrina Dubroca Date: Fri Jul 22 11:16:27 2022 +0200 macsec: fix NULL deref in macsec_add_rxsa Commit 48ef50fa866a added a test on tb_sa[MACSEC_SA_ATTR_PN], but nothing guarantees that it's not NULL at this point. The same code was added to macsec_add_txsa, but there it's not a problem because validate_add_txsa checks that the MACSEC_SA_ATTR_PN attribute is present. Note: it's not possible to reproduce with iproute, because iproute doesn't allow creating an SA without specifying the PN. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)") Link: https://bugzilla.kernel.org/show_bug.cgi?id=208315 Reported-by: Frantisek Sumsal Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 1aaa62c4838a140d0592935c51985158963d5971 Author: Slark Xiao Date: Fri Jul 22 17:38:34 2022 +0800 s390/qeth: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Signed-off-by: David S. Miller commit 2540d3c99926c234718e058acdd956d7c614eddd Author: Slark Xiao Date: Fri Jul 22 16:22:27 2022 +0800 net: ipa: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Signed-off-by: David S. Miller commit af35f95aca69a86058d480a63f4e096f0220905c Author: Slark Xiao Date: Fri Jul 22 16:20:27 2022 +0800 nfp: bpf: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Acked-by: Simon Horman Signed-off-by: David S. Miller commit d6c52fa3e955b97f8eb3ac824d2a3e0af147b3ce Author: Tobias Gruetzmacher Date: Fri Jul 22 19:05:57 2022 +0200 nvme-pci: Crucial P2 has bogus namespace ids This adds a quirk for the Crucial P2. Signed-off-by: Tobias Gruetzmacher Signed-off-by: Christoph Hellwig commit 3c69a99b62fde9de86a612ef1daaa07d95f0a773 Merge: be640317a1d0b ff6992735ade7 Author: Michael Ellerman Date: Mon Jul 25 13:49:22 2022 +1000 Merge tag 'v5.19-rc7' into fixes Merge v5.19-rc7 into fixes to bring in: d11219ad53dc ("amdgpu: disable powerpc support for the newer display engine") commit aa709da0e032cee7c202047ecd75f437bb0126ed Author: Xin Long Date: Thu Jul 21 10:35:46 2022 -0400 Documentation: fix sctp_wmem in ip-sysctl.rst Since commit 1033990ac5b2 ("sctp: implement memory accounting on tx path"), SCTP has supported memory accounting on tx path where 'sctp_wmem' is used by sk_wmem_schedule(). So we should fix the description for this option in ip-sysctl.rst accordingly. v1->v2: - Improve the description as Marcelo suggested. Fixes: 1033990ac5b2 ("sctp: implement memory accounting on tx path") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit f6336724a4d4220c89a4ec38bca84b03b178b1a3 Author: Maxim Mikityanskiy Date: Thu Jul 21 12:11:27 2022 +0300 net/tls: Remove the context from the list in tls_device_down tls_device_down takes a reference on all contexts it's going to move to the degraded state (software fallback). If sk_destruct runs afterwards, it can reduce the reference counter back to 1 and return early without destroying the context. Then tls_device_down will release the reference it took and call tls_device_free_ctx. However, the context will still stay in tls_device_down_list forever. The list will contain an item, memory for which is released, making a memory corruption possible. Fix the above bug by properly removing the context from all lists before any call to tls_device_free_ctx. Fixes: 3740651bf7e2 ("tls: Fix context leak on tls_device_down") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller commit e0dccc3b76fb35bb257b4118367a883073d7390e Author: Linus Torvalds Date: Sun Jul 24 13:26:27 2022 -0700 Linux 5.19-rc8 commit e90886291c7cd89577bf11729b205cc0ed42fbec Author: Adam Borowski Date: Mon Jul 18 15:50:34 2022 +0200 certs: make system keyring depend on x509 parser This code requires x509_load_certificate_list() to be built-in. Fixes: 60050ffe3d77 ("certs: Move load_certificate_list() to be with the asymmetric keys code") Reported-by: kernel test robot Reported-by: Steven Rostedt Link: https://lore.kernel.org/all/202206221515.DqpUuvbQ-lkp@intel.com/ Link: https://lore.kernel.org/all/20220712104554.408dbf42@gandalf.local.home/ Signed-off-by: Adam Borowski Signed-off-by: Linus Torvalds commit af2c9ac24019ece9281e606662e5c78fa67f5930 Merge: c2602a7ce0fc6 b0380e13502ad Author: Linus Torvalds Date: Sun Jul 24 09:55:53 2022 -0700 Merge tag 'perf_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Reorganize the perf LBR init code so that a TSX quirk is applied early enough in order for the LBR MSR access to not #GP * tag 'perf_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW commit c2602a7ce0fc66318325df170a9ee275d7df5c2e Merge: 05017fed92de3 ddfc710395ccc Author: Linus Torvalds Date: Sun Jul 24 09:50:53 2022 -0700 Merge tag 'sched_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: "A single fix to correct a wrong BUG_ON() condition for deboosted tasks" * tag 'sched_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix BUG_ON condition for deboosted tasks commit 05017fed92de32c167bbd21a5ee9ad0e489e19d4 Merge: 714b82c18ba0d b648ab487f31b Author: Linus Torvalds Date: Sun Jul 24 09:40:17 2022 -0700 Merge tag 'x86_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: "A couple more retbleed fallout fixes. It looks like their urgency is decreasing so it seems like we've managed to catch whatever snafus the limited -rc testing has exposed. Maybe we're getting ready... :) - Make retbleed mitigations 64-bit only (32-bit will need a bit more work if even needed, at all). - Prevent return thunks patching of the LKDTM modules as it is not needed there - Avoid writing the SPEC_CTRL MSR on every kernel entry on eIBRS parts - Enhance error output of apply_returns() when it fails to patch a return thunk - A sparse fix to the sev-guest module - Protect EFI fw calls by issuing an IBPB on AMD" * tag 'x86_urgent_for_v5.19_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Make all RETbleed mitigations 64-bit only lkdtm: Disable return thunks in rodata.c x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts x86/alternative: Report missing return thunk details virt: sev-guest: Pass the appropriate argument type to iounmap() x86/amd: Use IBPB for firmware calls commit 714b82c18ba0d2e76e9c3fd7785ff5a060f5980b Merge: 515f71412bb73 25c2a075eb6a3 Author: Linus Torvalds Date: Sun Jul 24 09:33:13 2022 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One more fix to set the correct IO mapping for a clk gate in the lan966x driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: lan966x: Fix the lan966x clock gate register address commit 515f71412bb73ebd7f41f90e1684fc80b8730789 Merge: 301c8949322fe cf5029d5dd7cb Author: Linus Torvalds Date: Sat Jul 23 10:22:26 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: - Check for invalid flags to KVM_CAP_X86_USER_SPACE_MSR - Fix use of sched_setaffinity in selftests - Sync kernel headers to tools - Fix KVM_STATS_UNIT_MAX * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Protect the unused bits in MSR exiting flags tools headers UAPI: Sync linux/kvm.h with the kernel sources KVM: selftests: Fix target thread to be migrated in rseq_test KVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats commit b648ab487f31bc4c38941bc770ea97fe394304bb Author: Ben Hutchings Date: Sat Jul 23 17:22:47 2022 +0200 x86/speculation: Make all RETbleed mitigations 64-bit only The mitigations for RETBleed are currently ineffective on x86_32 since entry_32.S does not use the required macros. However, for an x86_32 target, the kconfig symbols for them are still enabled by default and /sys/devices/system/cpu/vulnerabilities/retbleed will wrongly report that mitigations are in place. Make all of these symbols depend on X86_64, and only enable RETHUNK by default on X86_64. Fixes: f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs") Signed-off-by: Ben Hutchings Signed-off-by: Borislav Petkov Cc: Link: https://lore.kernel.org/r/YtwSR3NNsWp1ohfV@decadent.org.uk commit 301c8949322fe46766b334cc60ada5819b92000e Merge: 70664fc10c0d7 b620aa3a7be34 Author: Linus Torvalds Date: Fri Jul 22 16:40:03 2022 -0700 Merge tag 'spi-fix-v5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few more small driver specific fixes" * tag 'spi-fix-v5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-rspi: Fix PIO fallback on RZ platforms spi: spi-cadence: Fix SPI NO Slave Select macro definition spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers commit 4d8f24eeedc58d5f87b650ddda73c16e8ba56559 Author: Wei Wang Date: Thu Jul 21 20:44:04 2022 +0000 Revert "tcp: change pingpong threshold to 3" This reverts commit 4a41f453bedfd5e9cd040bad509d9da49feb3e2c. This to-be-reverted commit was meant to apply a stricter rule for the stack to enter pingpong mode. However, the condition used to check for interactive session "before(tp->lsndtime, icsk->icsk_ack.lrcvtime)" is jiffy based and might be too coarse, which delays the stack entering pingpong mode. We revert this patch so that we no longer use the above condition to determine interactive session, and also reduce pingpong threshold to 1. Fixes: 4a41f453bedf ("tcp: change pingpong threshold to 3") Reported-by: LemmyHuang Suggested-by: Neal Cardwell Signed-off-by: Wei Wang Acked-by: Neal Cardwell Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220721204404.388396-1-weiwan@google.com Signed-off-by: Jakub Kicinski commit 70664fc10c0d722ec79d746d8ac1db8546c94114 Merge: ae21fbac18b98 c1f6eff304e4d Author: Linus Torvalds Date: Fri Jul 22 13:02:05 2022 -0700 Merge tag 'riscv-for-linus-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - Two kexec-related build fixes - A DTS update to make the GPIO nodes match the upcoming dtschema - A fix that passes -mno-relax directly to the assembler when building modules, to work around compilers that fail to do so * tag 'riscv-for-linus-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: add as-options for modules with assembly compontents riscv: dts: align gpio-key node names with dtschema RISC-V: kexec: Fix build error without CONFIG_KEXEC RISCV: kexec: Fix build error without CONFIG_MODULES commit ae21fbac18b980ecfd895ff32833a2543c157ee2 Merge: a5235996e1b04 09073396ea62d Author: Linus Torvalds Date: Fri Jul 22 12:56:49 2022 -0700 Merge tag 'acpi-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix yet another piece of ACPI CPPC changes fallout on AMD platforms (Mario Limonciello)" * tag 'acpi-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: CPPC: Don't require flexible address space if X86_FEATURE_CPPC is supported commit a5235996e1b04405fbd6deea37b051715214fd2a Merge: d945404f74f34 934447a603b22 Author: Linus Torvalds Date: Fri Jul 22 12:47:09 2022 -0700 Merge tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Fix for a bad kfree() introduced in this cycle, and a quick fix for disabling buffer recycling for IORING_OP_READV. The latter will get reworked for 5.20, but it gets the job done for 5.19" * tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block: io_uring: do not recycle buffer in READV io_uring: fix free of unallocated buffer list commit d945404f74f34b76cb02d73025b92ce8b4729d3f Merge: 4a1dcf77f47ec 82e094f7bd988 Author: Linus Torvalds Date: Fri Jul 22 12:41:14 2022 -0700 Merge tag 'block-5.19-2022-07-21' of git://git.kernel.dk/linux-block Pull block fix from Jens Axboe: "Just a single fix for missing error propagation for an allocation failure in raid5" * tag 'block-5.19-2022-07-21' of git://git.kernel.dk/linux-block: md/raid5: missing error code in setup_conf() commit 4a1dcf77f47ec45e4c66787b2cd47f8b768c74da Merge: 6f8e4e10434e2 4ca8ca873d454 Author: Linus Torvalds Date: Fri Jul 22 12:36:59 2022 -0700 Merge tag 'i2c-for-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two driver bugfixes and a typo fix" * tag 'i2c-for-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: cadence: Change large transfer count reset logic to be unconditional i2c: imx: fix typo in comment i2c: mlxcpld: Fix register setting for 400KHz frequency commit 6f8e4e10434e2345c1e929aa93919808f99ba66e Merge: 614719111265a 32c094a09d582 Author: Linus Torvalds Date: Fri Jul 22 12:28:47 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix several regmap usage issues in gpio-pca953x - fix out-of-tree build for GPIO selftests - fix integer overflow in gpio-xilinx * tag 'gpio-fixes-for-v5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: gpio-xilinx: Fix integer overflow selftests: gpio: fix include path to kernel headers for out of tree builds gpio: pca953x: use the correct register address when regcache sync during init gpio: pca953x: use the correct range when do regmap sync gpio: pca953x: only use single read/write for No AI mode commit 614719111265a7a76d0ae54758f23d8614966b82 Merge: 8f636c6a16f2a 4546760619cfa Author: Linus Torvalds Date: Fri Jul 22 12:24:04 2022 -0700 Merge tag 'pinctrl-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Only driver fixes: - NULL check for the ralink and sunplus drivers - Add Jacky Bai as maintainer for the Freescale pin controllers - Fix pin config ops for the Ocelot LAN966x and SparX5 - Disallow AMD pin control to be a module: the GPIO lines need to be active in early boot, so no can do - Fix the Armada 37xx to use raw spinlocks in the interrupt handler path to avoid wait context" * tag 'pinctrl-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context pinctrl: armada-37xx: make irq_lock a raw spinlock to avoid invalid wait context pinctrl: Don't allow PINCTRL_AMD to be a module pinctrl: ocelot: Fix pincfg pinctrl: ocelot: Fix pincfg for lan966x MAINTAINERS: Update freescale pin controllers maintainer pinctrl: sunplus: Add check for kcalloc pinctrl: ralink: Check for null return of devm_kcalloc commit 88bd24d73d5bfa1b7b97a9221ff320fc44ef401a Author: Emil Renner Berthing Date: Sat Jun 25 16:42:07 2022 +0100 riscv: compat: vdso: Fix vdso_install target When CONFIG_COMPAT=y the vdso_install target fails: $ make ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- vdso_install INSTALL vdso.so make[1]: *** No rule to make target 'vdso_install'. Stop. make: *** [arch/riscv/Makefile:112: vdso_install] Error 2 The problem is that arch/riscv/kernel/compat_vdso/Makefile doesn't have a vdso_install target, but instead calls it compat_vdso_install. Signed-off-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20220625154207.80972-1-emil.renner.berthing@canonical.com Fixes: 0715372a06ce ("riscv: compat: vdso: Add COMPAT_VDSO base code implementation") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 8f636c6a16f2a6809f7de27c99e0780dd569fb23 Merge: 85029503fc95e cf33ce6f0c220 Author: Linus Torvalds Date: Fri Jul 22 12:19:02 2022 -0700 Merge tag 'sound-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Only undoes the Rockchip BCLK changes to address a regression" * tag 'sound-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: rockchip-i2s: Undo BCLK pinctrl changes ASoC: rockchip: i2s: Fix NULL pointer dereference when pinctrl is not found commit 85029503fc95ea16e0c0856251f5cba750847c85 Merge: 8e65afba6baaa 51189eb9ddc88 Author: Linus Torvalds Date: Fri Jul 22 12:14:13 2022 -0700 Merge tag 'mmc-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: - sdhci-omap: Fix a lockdep warning while probing * tag 'mmc-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-omap: Fix a lockdep warning for PM runtime init commit 8e65afba6baaa1317efc4038cbced1268c6e2f6b Merge: 4ba1329cbb945 7f5ec14a4e07a Author: Linus Torvalds Date: Fri Jul 22 12:03:19 2022 -0700 Merge tag 'drm-fixes-2022-07-22' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Fixes for this week. The main one is the i915 firmware fix for the phoronix reported issue. I've written some firmware guidelines as a result, should land in -next soon. Otherwise a few amdgpu fixes, a scheduler fix, ttm fix and two other minor ones. scheduler: - scheduling while atomic fix ttm: - locking fix edp: - variable typo fix i915: - add back support for v69 firmware on ADL-P amdgpu: - Drop redundant buffer cleanup that can lead to a segfault - Add a bo_list mutex to avoid possible list corruption in CS - dmub notification fix imx: - fix error path" * tag 'drm-fixes-2022-07-22' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2 drm/imx/dcss: Add missing of_node_put() in fail path drm/i915/guc: support v69 in parallel to v70 drm/i915/guc: Support programming the EU priority in the GuC descriptor drm/panel-edp: Fix variable typo when saving hpd absent delay from DT drm/amdgpu: Remove one duplicated ef removal drm/ttm: fix locking in vmap/vunmap TTM GEM helpers drm/scheduler: Don't kill jobs in interrupt context drm/amd/display: Fix new dmub notification enabling in DM commit 4ba1329cbb9456c937bff1ed8ad4ca91ab75eab6 Merge: 7fb5e50831906 4f2bfd9494a07 Author: Linus Torvalds Date: Fri Jul 22 10:01:20 2022 -0700 Merge tag 'rcu-urgent.2022.07.21a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU fix from Paul McKenney: "This contains a pair of commits that fix 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU"), which was itself a fix to an SRCU expedited grace-period problem that could prevent kernel live patching (KLP) from completing. That SRCU fix for KLP introduced large (as in minutes) boot-time delays to embedded Linux kernels running on qemu/KVM. These delays were due to the emulation of certain MMIO operations controlling memory layout, which were emulated with one expedited grace period per access. Common configurations required thousands of boot-time MMIO accesses, and thus thousands of boot-time expedited SRCU grace periods. In these configurations, the occasional sleeps that allowed KLP to proceed caused excessive boot delays. These commits preserve enough sleeps to permit KLP to proceed, but few enough that the virtual embedded kernels still boot reasonably quickly. This represents a regression introduced in the v5.19 merge window, and the bug is causing significant inconvenience" * tag 'rcu-urgent.2022.07.21a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: srcu: Make expedited RCU grace periods block even less frequently srcu: Block less aggressively for expedited grace periods commit 7fb5e508319068de1d69e6d7230416c390cb3cbb Author: Linus Torvalds Date: Fri Jul 22 09:28:34 2022 -0700 mmu_gather: fix the CONFIG_MMU_GATHER_NO_RANGE case Sudip reports that alpha doesn't build properly, with errors like include/asm-generic/tlb.h:401:1: error: redefinition of 'tlb_update_vma_flags' 401 | tlb_update_vma_flags(struct mmu_gather *tlb, struct vm_area_struct *vma) | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/tlb.h:372:1: note: previous definition of 'tlb_update_vma_flags' with type 'void(struct mmu_gather *, struct vm_area_struct *)' 372 | tlb_update_vma_flags(struct mmu_gather *tlb, struct vm_area_struct *vma) { } the cause being that We have this odd situation where some architectures were never converted to the newer TLB flushing interfaces that have a range for the flush. Instead people left them alone, and we have them select the MMU_GATHER_NO_RANGE config option to make the tlb header files account for this. Peter Zijlstra cleaned some of these nasty header file games up in commits 1e9fdf21a433 ("mmu_gather: Remove per arch tlb_{start,end}_vma()") 18ba064e42df ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") but tlb_update_vma_flags() was left alone, and then commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas") ended up removing only _one_ of the two stale duplicate dummy inline functions. This removes the other stale one. Somebody braver than me should try to remove MMU_GATHER_NO_RANGE entirely, but it requires fixing up the oddball architectures that use it: alpha, m68k, microblaze, nios2 and openrisc. The fixups should be fairly straightforward ("fix the build errors it exposes by adding the appropriate range arguments"), but the reason this wasn't done in the first place is that so few people end up working on those architectures. But it could be done one architecture at a time, hint, hint. Reported-by: Sudip Mukherjee (Codethink) Fixes: b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas") Link: https://lore.kernel.org/all/YtpXh0QHWwaEWVAY@debian/ Cc: Peter Zijlstra Cc: Will Deacon Cc: "Aneesh Kumar K.V" Cc: Andrew Morton Cc: Nick Piggin Cc: Arnd Bergmann Signed-off-by: Linus Torvalds commit c5cdb9286913aa5a5ebb81bcca0c17df3b0e2c79 Author: Linus Walleij Date: Fri Jul 22 13:46:11 2022 +0200 ARM: pxa2xx: Fix GPIO descriptor tables Laurence reports: "Kernel >5.18 on Zaurus has a bug where the power management code can't talk to devices, emitting the following errors: sharpsl-pm sharpsl-pm: Error: AC check failed: voltage -22. sharpsl-pm sharpsl-pm: Charging Error! sharpsl-pm sharpsl-pm: Warning: Cannot read main battery! Looking at the recent changes, I found that commit 31455bbda208 ("spi: pxa2xx_spi: Convert to use GPIO descriptors") replaced the deprecated SPI chip select platform device code with a gpiod lookup table. However, this didn't seem to work until I changed the `dev_id` member from the device name to the bus id. I'm not entirely sure why this is necessary, but I suspect it is related to the fact that in sysfs SPI devices are attached under /sys/devices/.../dev_name/spi_master/spiB/spiB.C, rather than directly to the device." After reviewing the change I conclude that the same fix is needed for all affected boards. Fixes: 31455bbda208 ("spi: pxa2xx_spi: Convert to use GPIO descriptors") Reported-by: Laurence de Bruxelles Signed-off-by: Linus Walleij Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220722114611.1517414-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit e2a619ca0b38f2114347b7078b8a67d72d457a3d Author: Lukas Bulwahn Date: Fri Jul 22 13:07:11 2022 +0200 asm-generic: remove a broken and needless ifdef conditional Commit 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()") introduces the config symbol GENERIC_LIB_DEVMEM_IS_ALLOWED, but then falsely refers to CONFIG_GENERIC_DEVMEM_IS_ALLOWED (note the missing LIB in the reference) in ./include/asm-generic/io.h. Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: GENERIC_DEVMEM_IS_ALLOWED Referencing files: include/asm-generic/io.h The actual fix, though, is simply to not to make this function declaration dependent on any kernel config. For architectures that intend to use the generic version, the arch's 'select GENERIC_LIB_DEVMEM_IS_ALLOWED' will lead to picking the function definition, and for other architectures, this function is simply defined elsewhere. The wrong '#ifndef' on a non-existing config symbol also always had the same effect (although more by mistake than by intent). So, there is no functional change. Remove this broken and needless ifdef conditional. Fixes: 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()") Signed-off-by: Lukas Bulwahn Signed-off-by: Arnd Bergmann commit 4bcffe941758ee17becb43af3b25487f848f6512 Author: Sherry Sun Date: Wed Apr 27 09:51:37 2022 +0800 EDAC/synopsys: Re-enable the error interrupts on v3 hw zynqmp_get_error_info() writes 0 to the ECC_CLR_OFST register after an interrupt for a {un-,}correctable error is raised, which disables the error interrupts. Then the interrupt handler will be called only once. Therefore, re-enable the error interrupt line at the end of intr_handler() for v3.x Synopsys EDAC DDR. Fixes: f7824ded4149 ("EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR") Signed-off-by: Sherry Sun Signed-off-by: Borislav Petkov Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Cc: Link: https://lore.kernel.org/r/20220427015137.8406-3-sherry.sun@nxp.com commit be76ceaf03bc04e74be5e28f608316b73c2b04ad Author: Sherry Sun Date: Wed Apr 27 09:51:36 2022 +0800 EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw v3.x Synopsys EDAC DDR doesn't have the QOS Interrupt register. Use the ECC Clear Register to disable the error interrupts instead. Fixes: f7824ded4149 ("EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR") Signed-off-by: Sherry Sun Signed-off-by: Borislav Petkov Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Cc: Link: https://lore.kernel.org/r/20220427015137.8406-2-sherry.sun@nxp.com commit 8ee18e2a9e7b0e97730549f58dd618433c15811b Author: Christophe JAILLET Date: Wed Jul 20 21:49:46 2022 +0200 caif: Fix bitmap data type in "struct caifsock" Bitmap are "unsigned long", so use it instead of a "u32" to make things more explicit. While at it, remove some useless cast (and leading spaces) when using the bitmap API. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 030f21ba2ab14c221ff31cf22a16c78963328f6f Author: Rob Herring Date: Tue Jul 19 15:51:08 2022 -0600 dt-bindings: net: fsl,fec: Add missing types to phy-reset-* properties The phy-reset-* properties are missing type definitions and are not common properties. Even though they are deprecated, a type is needed. Signed-off-by: Rob Herring Signed-off-by: David S. Miller commit 17161c341de0b02788b0428cb253a35b9a3c89b3 Author: Rob Herring Date: Tue Jul 19 15:50:59 2022 -0600 dt-bindings: net: ethernet-controller: Rework 'fixed-link' schema While the if/then schemas mostly work, there's a few issues. The 'allOf' schema will also be true if 'fixed-link' is not an array or object as a false 'if' schema (without an 'else') will be true. In the array case doesn't set the type (uint32-array) in the 'then' clause. In the node case, 'additionalProperties' is missing. Rework the schema to use oneOf with each possible type. Signed-off-by: Rob Herring Signed-off-by: David S. Miller commit b20a7ca8cfa4dce01f848056fe6313b444b7dcf5 Merge: ebbbe23fdf607 2afdbe7b8de84 Author: David S. Miller Date: Fri Jul 22 12:06:18 2022 +0100 Merge branch 'sysctl-races-part-5' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Round 5). This series fixes data-races around 15 knobs after tcp_dsack in ipv4_net_table. tcp_tso_win_divisor was skipped because it already uses READ_ONCE(). So, the final round for ipv4_net_table will start with tcp_pacing_ss_ratio. ==================== Signed-off-by: David S. Miller commit 2afdbe7b8de84c28e219073a6661080e1b3ded48 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:26 2022 -0700 tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. While reading sysctl_tcp_invalid_ratelimit, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 032ee4236954 ("tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 85225e6f0a76e6745bc841c9f25169c509b573d8 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:25 2022 -0700 tcp: Fix a data-race around sysctl_tcp_autocorking. While reading sysctl_tcp_autocorking, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: f54b311142a9 ("tcp: auto corking") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1330ffacd05fc9ac4159d19286ce119e22450ed2 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:24 2022 -0700 tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. While reading sysctl_tcp_min_rtt_wlen, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: f672258391b4 ("tcp: track min RTT using windowed min-filter") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2455e61b85e9c99af38cd889a7101f1d48b33cb4 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:23 2022 -0700 tcp: Fix a data-race around sysctl_tcp_tso_rtt_log. While reading sysctl_tcp_tso_rtt_log, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit e0bb4ab9dfddd872622239f49fb2bd403b70853b Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:22 2022 -0700 tcp: Fix a data-race around sysctl_tcp_min_tso_segs. While reading sysctl_tcp_min_tso_segs, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 95bd09eb2750 ("tcp: TSO packets automatic sizing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit db3815a2fa691da145cfbe834584f31ad75df9ff Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:21 2022 -0700 tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. While reading sysctl_tcp_challenge_ack_limit, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 9fb90193fbd66b4c5409ef729fd081861f8b6351 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:20 2022 -0700 tcp: Fix a data-race around sysctl_tcp_limit_output_bytes. While reading sysctl_tcp_limit_output_bytes, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 46d3ceabd8d9 ("tcp: TCP Small Queues") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 0f1e4d06591d0a7907c71f7b6d1c79f8a4de8098 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:19 2022 -0700 tcp: Fix data-races around sysctl_tcp_workaround_signed_windows. While reading sysctl_tcp_workaround_signed_windows, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 15d99e02baba ("[TCP]: sysctl to allow TCP window > 32767 sans wscale") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 780476488844e070580bfc9e3bc7832ec1cea883 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:18 2022 -0700 tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf. While reading sysctl_tcp_moderate_rcvbuf, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit ab1ba21b523ab496b1a4a8e396333b24b0a18f9a Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:17 2022 -0700 tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save. While reading sysctl_tcp_no_ssthresh_metrics_save, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 65e6d90168f3 ("net-tcp: Disable TCP ssthresh metrics cache by default") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8499a2454d9e8a55ce616ede9f9580f36fd5b0f3 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:16 2022 -0700 tcp: Fix a data-race around sysctl_tcp_nometrics_save. While reading sysctl_tcp_nometrics_save, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 706c6202a3589f290e1ef9be0584a8f4a3cc0507 Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:15 2022 -0700 tcp: Fix a data-race around sysctl_tcp_frto. While reading sysctl_tcp_frto, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 36eeee75ef0157e42fb6593dcc65daab289b559e Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:14 2022 -0700 tcp: Fix a data-race around sysctl_tcp_adv_win_scale. While reading sysctl_tcp_adv_win_scale, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 02ca527ac5581cf56749db9fd03d854e842253dd Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:13 2022 -0700 tcp: Fix a data-race around sysctl_tcp_app_win. While reading sysctl_tcp_app_win, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 58ebb1c8b35a8ef38cd6927431e0fa7b173a632d Author: Kuniyuki Iwashima Date: Wed Jul 20 09:50:12 2022 -0700 tcp: Fix data-races around sysctl_tcp_dsack. While reading sysctl_tcp_dsack, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 32c094a09d5829ad9b02cdf667569aefa8de0ea6 Author: Srinivas Neeli Date: Thu Jul 21 13:09:09 2022 +0530 gpio: gpio-xilinx: Fix integer overflow Current implementation is not able to configure more than 32 pins due to incorrect data type. So type casting with unsigned long to avoid it. Fixes: 02b3f84d9080 ("xilinx: Switch to use bitmap APIs") Signed-off-by: Srinivas Neeli Signed-off-by: Bartosz Golaszewski commit 7f5ec14a4e07a2a78fbde069709d5c8806882be2 Merge: 1c46f3c075911 02c87df2480ac Author: Dave Airlie Date: Fri Jul 22 12:16:15 2022 +1000 Merge tag 'drm-misc-fixes-2022-07-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A scheduling-while-atomic fix for drm/scheduler, a locking fix for TTM, a typo fix for panel-edp and a resource removal fix for imx/dcss Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220721085550.hrwbukj34y56rzva@houat commit ebbbe23fdf6070e31509638df3321688358cc211 Author: Liang He Date: Wed Jul 20 21:10:03 2022 +0800 net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() In bcm5421_init(), we should call of_node_put() for the reference returned by of_get_parent() which has increased the refcount. Fixes: 3c326fe9cb7a ("[PATCH] ppc64: Add new PHY to sungem") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220720131003.1287426-1-windhl@126.com Signed-off-by: Jakub Kicinski commit 27161db0904ee48e59140aa8d0835939a666c1f1 Author: Vladimir Oltean Date: Wed Jul 20 14:20:57 2022 +0300 net: pcs: xpcs: propagate xpcs_read error to xpcs_get_state_c37_sgmii While phylink_pcs_ops :: pcs_get_state does return void, xpcs_get_state() does check for a non-zero return code from xpcs_get_state_c37_sgmii() and prints that as a message to the kernel log. However, a non-zero return code from xpcs_read() is translated into "return false" (i.e. zero as int) and the I/O error is therefore not printed. Fix that. Fixes: b97b5331b8ab ("net: pcs: add C37 SGMII AN support for intel mGbE controller") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220720112057.3504398-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 Author: Ben Dooks Date: Sun May 29 16:22:00 2022 +0100 riscv: add as-options for modules with assembly compontents When trying to load modules built for RISC-V which include assembly files the kernel loader errors with "unexpected relocation type 'R_RISCV_ALIGN'" due to R_RISCV_ALIGN relocations being generated by the assembler. The R_RISCV_ALIGN relocations can be removed at the expense of code space by adding -mno-relax to gcc and as. In commit 7a8e7da42250138 ("RISC-V: Fixes to module loading") -mno-relax is added to the build variable KBUILD_CFLAGS_MODULE. See [1] for more info. The issue is that when kbuild builds a .S file, it invokes gcc with the -mno-relax flag, but this is not being passed through to the assembler. Adding -Wa,-mno-relax to KBUILD_AFLAGS_MODULE ensures that the assembler is invoked correctly. This may have now been fixed in gcc[2] and this addition should not stop newer gcc and as from working. [1] https://github.com/riscv/riscv-elf-psabi-doc/issues/183 [2] https://github.com/gcc-mirror/gcc/commit/3b0a7d624e64eeb81e4d5e8c62c46d86ef521857 Signed-off-by: Ben Dooks Reviewed-by: Bin Meng Link: https://lore.kernel.org/r/20220529152200.609809-1-ben.dooks@codethink.co.uk Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 68e77ffbfd06ae3ef8f2abf1c3b971383c866983 Merge: 7ca433dc6dedb 0fddf9ad06fd9 Author: Linus Torvalds Date: Thu Jul 21 11:28:26 2022 -0700 Merge tag 'mtd/fixes-for-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fix from Richard Weinberger: "A aingle NAND controller fix: - gpmi: Fix busy timeout setting (wrong calculation, yes again)" * tag 'mtd/fixes-for-5.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times commit 7ca433dc6dedb2ec98dfc943f6db0c9b8996ed11 Merge: b67fbebd4cf98 44484fa8eedf1 Author: Linus Torvalds Date: Thu Jul 21 11:08:35 2022 -0700 Merge tag 'net-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can. Still no major regressions, most of the changes are still due to data races fixes, plus the usual bunch of drivers fixes. Previous releases - regressions: - tcp/udp: make early_demux back namespacified. - dsa: fix issues with vlan_filtering_is_global Previous releases - always broken: - ip: fix data-races around ipv4_net_table (round 2, 3 & 4) - amt: fix validation and synchronization bugs - can: fix detection of mcp251863 - eth: iavf: fix handling of dummy receive descriptors - eth: lan966x: fix issues with MAC table - eth: stmmac: dwmac-mediatek: fix clock issue Misc: - dsa: update documentation" * tag 'net-5.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (107 commits) mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication net/sched: cls_api: Fix flow action initialization tcp: Fix data-races around sysctl_tcp_max_reordering. tcp: Fix a data-race around sysctl_tcp_abort_on_overflow. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl knobs related to SYN option. udp: Fix a data-race around sysctl_udp_l3mdev_accept. ip: Fix data-races around sysctl_ip_prot_sock. ipv4: Fix data-races around sysctl_fib_multipath_hash_fields. ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. can: rcar_canfd: Add missing of_node_put() in rcar_canfd_probe() can: mcp251xfd: fix detection of mcp251863 Documentation: fix udp_wmem_min in ip-sysctl.rst ... commit 918e75f77af7d2e049bb70469ec0a2c12782d96a Author: Harald Freudenberger Date: Wed Jul 13 15:17:21 2022 +0200 s390/archrandom: prevent CPACF trng invocations in interrupt context This patch slightly reworks the s390 arch_get_random_seed_{int,long} implementation: Make sure the CPACF trng instruction is never called in any interrupt context. This is done by adding an additional condition in_task(). Justification: There are some constrains to satisfy for the invocation of the arch_get_random_seed_{int,long}() functions: - They should provide good random data during kernel initialization. - They should not be called in interrupt context as the TRNG instruction is relatively heavy weight and may for example make some network loads cause to timeout and buck. However, it was not clear what kind of interrupt context is exactly encountered during kernel init or network traffic eventually calling arch_get_random_seed_long(). After some days of investigations it is clear that the s390 start_kernel function is not running in any interrupt context and so the trng is called: Jul 11 18:33:39 t35lp54 kernel: [<00000001064e90ca>] arch_get_random_seed_long.part.0+0x32/0x70 Jul 11 18:33:39 t35lp54 kernel: [<000000010715f246>] random_init+0xf6/0x238 Jul 11 18:33:39 t35lp54 kernel: [<000000010712545c>] start_kernel+0x4a4/0x628 Jul 11 18:33:39 t35lp54 kernel: [<000000010590402a>] startup_continue+0x2a/0x40 The condition in_task() is true and the CPACF trng provides random data during kernel startup. The network traffic however, is more difficult. A typical call stack looks like this: Jul 06 17:37:07 t35lp54 kernel: [<000000008b5600fc>] extract_entropy.constprop.0+0x23c/0x240 Jul 06 17:37:07 t35lp54 kernel: [<000000008b560136>] crng_reseed+0x36/0xd8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5604b8>] crng_make_state+0x78/0x340 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5607e0>] _get_random_bytes+0x60/0xf8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b56108a>] get_random_u32+0xda/0x248 Jul 06 17:37:07 t35lp54 kernel: [<000000008aefe7a8>] kfence_guarded_alloc+0x48/0x4b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aeff35e>] __kfence_alloc+0x18e/0x1b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aef7f10>] __kmalloc_node_track_caller+0x368/0x4d8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611eac>] kmalloc_reserve+0x44/0xa0 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611f98>] __alloc_skb+0x90/0x178 Jul 06 17:37:07 t35lp54 kernel: [<000000008b6120dc>] __napi_alloc_skb+0x5c/0x118 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f06b4>] qeth_extract_skb+0x13c/0x680 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f6526>] qeth_poll+0x256/0x3f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63d76e>] __napi_poll.constprop.0+0x46/0x2f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63dbec>] net_rx_action+0x1cc/0x408 Jul 06 17:37:07 t35lp54 kernel: [<000000008b937302>] __do_softirq+0x132/0x6b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf46ce>] __irq_exit_rcu+0x13e/0x170 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf531a>] irq_exit_rcu+0x22/0x50 Jul 06 17:37:07 t35lp54 kernel: [<000000008b922506>] do_io_irq+0xe6/0x198 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935826>] io_int_handler+0xd6/0x110 Jul 06 17:37:07 t35lp54 kernel: [<000000008b9358a6>] psw_idle_exit+0x0/0xa Jul 06 17:37:07 t35lp54 kernel: ([<000000008ab9c59a>] arch_cpu_idle+0x52/0xe0) Jul 06 17:37:07 t35lp54 kernel: [<000000008b933cfe>] default_idle_call+0x6e/0xd0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac59f4e>] do_idle+0xf6/0x1b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac5a28e>] cpu_startup_entry+0x36/0x40 Jul 06 17:37:07 t35lp54 kernel: [<000000008abb0d90>] smp_start_secondary+0x148/0x158 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935b9e>] restart_int_handler+0x6e/0x90 which confirms that the call is in softirq context. So in_task() covers exactly the cases where we want to have CPACF trng called: not in nmi, not in hard irq, not in soft irq but in normal task context and during kernel init. Signed-off-by: Harald Freudenberger Acked-by: Jason A. Donenfeld Reviewed-by: Juergen Christ Link: https://lore.kernel.org/r/20220713131721.257907-1-freude@linux.ibm.com Fixes: e4f74400308c ("s390/archrandom: simplify back to earlier design and initialize earlier") [agordeev@linux.ibm.com changed desc, added Fixes and Link, removed -stable] Signed-off-by: Alexander Gordeev commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 Author: Peter Zijlstra Date: Fri Jul 8 09:18:06 2022 +0200 mmu_gather: Force tlb-flush VM_PFNMAP vmas Jann reported a race between munmap() and unmap_mapping_range(), where unmap_mapping_range() will no-op once unmap_vmas() has unlinked the VMA; however munmap() will not yet have invalidated the TLBs. Therefore unmap_mapping_range() will complete while there are still (stale) TLB entries for the specified range. Mitigate this by force flushing TLBs for VM_PFNMAP ranges. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Signed-off-by: Linus Torvalds commit 18ba064e42df3661e196ab58a23931fc732a420b Author: Peter Zijlstra Date: Fri Jul 8 09:18:05 2022 +0200 mmu_gather: Let there be one tlb_{start,end}_vma() implementation Now that architectures are no longer allowed to override tlb_{start,end}_vma() re-arrange code so that there is only one implementation for each of these functions. This much simplifies trying to figure out what they actually do. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Signed-off-by: Linus Torvalds commit 1d7708e75c49d08392884a08feeebaa3f9d80703 Author: Peter Zijlstra Date: Fri Jul 8 09:18:04 2022 +0200 csky/tlb: Remove tlb_flush() define The previous patch removed the tlb_flush_end() implementation which used tlb_flush_range(). This means: - csky did double invalidates, a range invalidate per vma and a full invalidate at the end - csky actually has range invalidates and as such the generic tlb_flush implementation is more efficient for it. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Tested-by: Guo Ren Signed-off-by: Linus Torvalds commit 1e9fdf21a4339b102539f476a9842e7526c01939 Author: Peter Zijlstra Date: Fri Jul 8 09:18:03 2022 +0200 mmu_gather: Remove per arch tlb_{start,end}_vma() Scattered across the archs are 3 basic forms of tlb_{start,end}_vma(). Provide two new MMU_GATHER_knobs to enumerate them and remove the per arch tlb_{start,end}_vma() implementations. - MMU_GATHER_NO_FLUSH_CACHE indicates the arch has flush_cache_range() but does *NOT* want to call it for each VMA. - MMU_GATHER_MERGE_VMAS indicates the arch wants to merge the invalidate across multiple VMAs if possible. With these it is possible to capture the three forms: 1) empty stubs; select MMU_GATHER_NO_FLUSH_CACHE and MMU_GATHER_MERGE_VMAS 2) start: flush_cache_range(), end: empty; select MMU_GATHER_MERGE_VMAS 3) start: flush_cache_range(), end: flush_tlb_range(); default Obviously, if the architecture does not have flush_cache_range() then it also doesn't need to select MMU_GATHER_NO_FLUSH_CACHE. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: David Miller Signed-off-by: Linus Torvalds commit 23a67619bc7e12e1b3776802f16084530b357a5d Author: Khalid Masum Date: Thu Jul 21 15:30:42 2022 +0600 scripts/gdb: Fix gdb 'lx-symbols' command Currently the command 'lx-symbols' in gdb exits with the error`Function "do_init_module" not defined in "kernel/module.c"`. This occurs because the file kernel/module.c was moved to kernel/module/main.c. Fix this breakage by changing the path to "kernel/module/main.c" in LoadModuleBreakpoint. Signed-off-by: Khalid Masum Acked-by: Luis Chamberlain Fixes: cfc1d277891e ("module: Move all into module/") Reviewed-by: Douglas Anderson Signed-off-by: Linus Torvalds commit 44e29e64cf1ac0cffb152e0532227ea6d002aa28 Author: Linus Torvalds Date: Thu Jul 21 10:30:14 2022 -0700 watch-queue: remove spurious double semicolon Sedat Dilek noticed that I had an extraneous semicolon at the end of a line in the previous patch. It's harmless, but unintentional, and while compilers just treat it as an extra empty statement, for all I know some other tooling might warn about it. So clean it up before other people notice too ;) Fixes: 353f7988dd84 ("watchqueue: make sure to serialize 'wqueue->defunct' properly") Reported-by: Sedat Dilek Signed-off-by: Linus Torvalds Reported-by: Sedat Dilek commit b620aa3a7be346f04ae7789b165937615c6ee8d3 Author: Biju Das Date: Thu Jul 21 15:34:49 2022 +0100 spi: spi-rspi: Fix PIO fallback on RZ platforms RSPI IP on RZ/{A, G2L} SoC's has the same signal for both interrupt and DMA transfer request. Setting DMARS register for DMA transfer makes the signal to work as a DMA transfer request signal and subsequent interrupt requests to the interrupt controller are masked. PIO fallback does not work as interrupt signal is disabled. This patch fixes this issue by re-enabling the interrupts by calling dmaengine_synchronize(). Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220721143449.879257-1-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 934447a603b22d98f45a679115d8402e1efdd0f7 Author: Dylan Yudaken Date: Thu Jul 21 06:13:25 2022 -0700 io_uring: do not recycle buffer in READV READV cannot recycle buffers as it would lose some of the data required to reimport that buffer. Reported-by: Ammar Faizi Fixes: b66e65f41426 ("io_uring: never call io_buffer_select() for a buffer re-select") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220721131325.624788-1-dylany@fb.com Signed-off-by: Jens Axboe commit ec8516f3b7c40ba7050e6b3a32467e9de451ecdf Author: Dylan Yudaken Date: Thu Jul 21 04:01:15 2022 -0700 io_uring: fix free of unallocated buffer list in the error path of io_register_pbuf_ring, only free bl if it was allocated. Reported-by: Dipanjan Das Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Dylan Yudaken Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/all/CANX2M5bXKw1NaHdHNVqssUUaBCs8aBpmzRNVEYEvV0n44P7ioA@mail.gmail.com/ Link: https://lore.kernel.org/all/CANX2M5YiZBXU3L6iwnaLs-HHJXRvrxM8mhPDiMDF9Y9sAvOHUA@mail.gmail.com/ Signed-off-by: Jens Axboe commit 430d31bb2e6031f82fe2f2fe15500dde2ac5f8a6 Merge: 7849f5cf7639c ef0324b6415db Author: Arnd Bergmann Date: Thu Jul 21 14:58:45 2022 +0200 Merge tag 'at91-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 5.19 #3 It contains one fix for LAN966 based SoCs fixing the frequency of sys_clk. sys_clk is feeding different IPs so having proper frequency for it in DT is necessary for proper working of different drivers. * tag 'at91-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: lan966x: fix sys_clk frequency Link: https://lore.kernel.org/r/20220721075705.1739915-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit ddfc710395cccc61247348df9eb18ea50321cbed Author: Juri Lelli Date: Thu Jul 14 17:19:08 2022 +0200 sched/deadline: Fix BUG_ON condition for deboosted tasks Tasks the are being deboosted from SCHED_DEADLINE might enter enqueue_task_dl() one last time and hit an erroneous BUG_ON condition: since they are not boosted anymore, the if (is_dl_boosted()) branch is not taken, but the else if (!dl_prio) is and inside this one we BUG_ON(!is_dl_boosted), which is of course false (BUG_ON triggered) otherwise we had entered the if branch above. Long story short, the current condition doesn't make sense and always leads to triggering of a BUG. Fix this by only checking enqueue flags, properly: ENQUEUE_REPLENISH has to be present, but additional flags are not a problem. Fixes: 64be6f1f5f71 ("sched/deadline: Don't replenish from a !SCHED_DEADLINE entity") Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220714151908.533052-1-juri.lelli@redhat.com commit 1c46f3c0759116d70cb424fc227371a254c47b25 Merge: 4b2b2ee1f87db 90af0ca047f30 Author: Dave Airlie Date: Thu Jul 21 13:22:39 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-07-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-07-20: amdgpu: - Drop redundant buffer cleanup that can lead to a segfault - Add a bo_list mutex to avoid possible list corruption in CS Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220720210917.6202-1-alexander.deucher@amd.com commit 4b2b2ee1f87db6354895ed4fd76420ceeca0fda6 Merge: ff6992735ade7 443148858f26e Author: Dave Airlie Date: Thu Jul 21 13:21:58 2022 +1000 Merge tag 'drm-intel-fixes-2022-07-20-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix the regression caused by the lack of GuC v70. Let's accept the fallback to v69. Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YtgguaR5JYK083oZ@intel.com commit 90af0ca047f3049c4b46e902f432ad6ef1e2ded6 Author: Luben Tuikov Date: Wed Jul 20 15:04:18 2022 -0400 drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2 Protect the struct amdgpu_bo_list with a mutex. This is used during command submission in order to avoid buffer object corruption as recorded in the link below. v2 (chk): Keep the mutex looked for the whole CS to avoid using the list from multiple CS threads at the same time. Suggested-by: Christian König Cc: Alex Deucher Cc: Andrey Grodzovsky Cc: Vitaly Prosyak Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2048 Signed-off-by: Luben Tuikov Signed-off-by: Christian König Tested-by: Luben Tuikov Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 353f7988dd8413c47718f7ca79c030b6fb62cfe5 Author: Linus Torvalds Date: Tue Jul 19 11:09:01 2022 -0700 watchqueue: make sure to serialize 'wqueue->defunct' properly When the pipe is closed, we mark the associated watchqueue defunct by calling watch_queue_clear(). However, while that is protected by the watchqueue lock, new watchqueue entries aren't actually added under that lock at all: they use the pipe->rd_wait.lock instead, and looking up that pipe happens without any locking. The watchqueue code uses the RCU read-side section to make sure that the wqueue entry itself hasn't disappeared, but that does not protect the pipe_info in any way. So make sure to actually hold the wqueue lock when posting watch events, properly serializing against the pipe being torn down. Reported-by: Noam Rathaus Cc: Greg KH Cc: David Howells Signed-off-by: Linus Torvalds commit e1502ba41699736c578ba9d61ae6285d49f6921b Author: Sai Krishna Potthuri Date: Wed Jul 13 22:15:29 2022 +0530 spi: spi-cadence: Fix SPI NO Slave Select macro definition Fix SPI NO Slave Select macro definition, when all the SPI CS bits are high which means no slave is selected. Fixes: 21b511ddee09 ("spi: spi-cadence: Fix SPI CS gets toggling sporadically") Signed-off-by: Sai Krishna Potthuri Signed-off-by: Amit Kumar Mahapatra Link: https://lore.kernel.org/r/20220713164529.28444-1-amit.kumar-mahapatra@xilinx.com Signed-off-by: Mark Brown commit b0380e13502adf7dd8be4c47d622c3522aae6c63 Author: Kan Liang Date: Thu Jul 14 11:26:30 2022 -0700 perf/x86/intel/lbr: Fix unchecked MSR access error on HSW The fuzzer triggers the below trace. [ 7763.384369] unchecked MSR access error: WRMSR to 0x689 (tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4 (native_write_msr+0x4/0x20) [ 7763.397420] Call Trace: [ 7763.399881] [ 7763.401994] intel_pmu_lbr_restore+0x9a/0x1f0 [ 7763.406363] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is disabled, a TSX quirk is required to access LBR from registers. The lbr_from_signext_quirk_needed() is introduced to determine whether the TSX quirk should be applied. However, the lbr_from_signext_quirk_needed() is invoked before the intel_pmu_lbr_init(), which parses the LBR format information. Without the correct LBR format information, the TSX quirk never be applied. Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init(). Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is not required anymore. Both LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments accordingly. Fixes: 1ac7fd8159a8 ("perf/x86/intel/lbr: Support LBR format V7") Reported-by: Vince Weaver Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220714182630.342107-1-kan.liang@linux.intel.com commit efc72a665a61fd48c462f5248a9e3dc991398ddd Author: Josh Poimboeuf Date: Mon Jul 18 07:50:25 2022 -0700 lkdtm: Disable return thunks in rodata.c The following warning was seen: WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:557 apply_returns (arch/x86/kernel/alternative.c:557 (discriminator 1)) Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-00008-gee88d363d156 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 RIP: 0010:apply_returns (arch/x86/kernel/alternative.c:557 (discriminator 1)) Code: ff ff 74 cb 48 83 c5 04 49 39 ee 0f 87 81 fe ff ff e9 22 ff ff ff 0f 0b 48 83 c5 04 49 39 ee 0f 87 6d fe ff ff e9 0e ff ff ff <0f> 0b 48 83 c5 04 49 39 ee 0f 87 59 fe ff ff e9 fa fe ff ff 48 89 The warning happened when apply_returns() failed to convert "JMP __x86_return_thunk" to RET. It was instead a JMP to nowhere, due to the thunk relocation not getting resolved. That rodata.o code is objcopy'd to .rodata, and later memcpy'd, so relocations don't work (and are apparently silently ignored). LKDTM is only used for testing, so the naked RET should be fine. So just disable return thunks for that file. While at it, disable objtool and KCSAN for the file. Fixes: 0b53c374b9ef ("x86/retpoline: Use -mfunction-return") Reported-by: kernel test robot Debugged-by: Peter Zijlstra Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/lkml/Ys58BxHxoDZ7rfpr@xsang-OptiPlex-9020/ commit eb23b5ef9131e6d65011de349a4d25ef1b3d4314 Author: Pawan Gupta Date: Thu Jul 14 16:15:35 2022 -0700 x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts IBRS mitigation for spectre_v2 forces write to MSR_IA32_SPEC_CTRL at every kernel entry/exit. On Enhanced IBRS parts setting MSR_IA32_SPEC_CTRL[IBRS] only once at boot is sufficient. MSR writes at every kernel entry/exit incur unnecessary performance loss. When Enhanced IBRS feature is present, print a warning about this unnecessary performance loss. Signed-off-by: Pawan Gupta Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Thadeu Lima de Souza Cascardo Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/2a5eaf54583c2bfe0edc4fea64006656256cca17.1657814857.git.pawan.kumar.gupta@linux.intel.com commit 65cdf0d623bedf0e069bb64ed52e8bb20105e2ba Author: Kees Cook Date: Wed Jul 13 14:38:19 2022 -0700 x86/alternative: Report missing return thunk details Debugging missing return thunks is easier if we can see where they're happening. Suggested-by: Peter Zijlstra Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/lkml/Ys66hwtFcGbYmoiZ@hirez.programming.kicks-ass.net/ commit 543ce63b664e2c2f9533d089a4664b559c3e6b5b Author: Eric Snowberg Date: Wed Jul 20 12:40:27 2022 -0400 lockdown: Fix kexec lockdown bypass with ima policy The lockdown LSM is primarily used in conjunction with UEFI Secure Boot. This LSM may also be used on machines without UEFI. It can also be enabled when UEFI Secure Boot is disabled. One of lockdown's features is to prevent kexec from loading untrusted kernels. Lockdown can be enabled through a bootparam or after the kernel has booted through securityfs. If IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. To defeat lockdown, boot without Secure Boot and add ima_appraise=log to the kernel command line; then: $ echo "integrity" > /sys/kernel/security/lockdown $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \ /sys/kernel/security/ima/policy $ kexec -ls unsigned-kernel Add a call to verify ima appraisal is set to "enforce" whenever lockdown is enabled. This fixes CVE-2022-21505. Cc: stable@vger.kernel.org Fixes: 29d3c1c8dfe7 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down") Signed-off-by: Eric Snowberg Acked-by: Mimi Zohar Reviewed-by: John Haxby Signed-off-by: Linus Torvalds commit 4ceaa684459d414992acbefb4e4c31f2dfc50641 Author: Marc Kleine-Budde Date: Tue Jul 19 09:22:35 2022 +0200 spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers In case a IRQ based transfer times out the bcm2835_spi_handle_err() function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag") the TX and RX DMA transfers are unconditionally canceled, leading to NULL pointer derefs if ctlr->dma_tx or ctlr->dma_rx are not set. Fix the NULL pointer deref by checking that ctlr->dma_tx and ctlr->dma_rx are valid pointers before accessing them. Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag") Cc: Lukas Wunner Signed-off-by: Marc Kleine-Budde Link: https://lore.kernel.org/r/20220719072234.2782764-1-mkl@pengutronix.de Signed-off-by: Mark Brown commit f63731e18e8d8350e05b0176e39a76639f6483c7 Author: Kent Gibson Date: Tue Jul 19 19:06:01 2022 +0800 selftests: gpio: fix include path to kernel headers for out of tree builds When building selftests out of the kernel tree the gpio.h the include path is incorrect and the build falls back to the system includes which may be outdated. Add the KHDR_INCLUDES to the CFLAGS to include the gpio.h from the build tree. Fixes: 4f4d0af7b2d9 ("selftests: gpio: restore CFLAGS options") Reported-by: kernel test robot Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 9b31e60800d8fa69027baf9ec7f03a0c5b145079 Author: Florian Fainelli Date: Fri Jul 15 11:55:49 2022 -0700 tools: Fixed MIPS builds due to struct flock re-definition Building perf for MIPS failed after 9f79b8b72339 ("uapi: simplify __ARCH_FLOCK{,64}_PAD a little") with the following error: CC /home/fainelli/work/buildroot/output/bmips/build/linux-custom/tools/perf/trace/beauty/fcntl.o In file included from ../../../../host/mipsel-buildroot-linux-gnu/sysroot/usr/include/asm/fcntl.h:77, from ../include/uapi/linux/fcntl.h:5, from trace/beauty/fcntl.c:10: ../include/uapi/asm-generic/fcntl.h:188:8: error: redefinition of 'struct flock' struct flock { ^~~~~ In file included from ../include/uapi/linux/fcntl.h:5, from trace/beauty/fcntl.c:10: ../../../../host/mipsel-buildroot-linux-gnu/sysroot/usr/include/asm/fcntl.h:63:8: note: originally defined here struct flock { ^~~~~ This is due to the local copy under tools/include/uapi/asm-generic/fcntl.h including the toolchain's kernel headers which already define 'struct flock' and define HAVE_ARCH_STRUCT_FLOCK to future inclusions make a decision as to whether re-defining 'struct flock' is appropriate or not. Make sure what do not re-define 'struct flock' when HAVE_ARCH_STRUCT_FLOCK is already defined. Fixes: 9f79b8b72339 ("uapi: simplify __ARCH_FLOCK{,64}_PAD a little") Signed-off-by: Florian Fainelli Reviewed-by: Christoph Hellwig [arnd: sync with include/uapi/asm-generic/fcntl.h as well] Signed-off-by: Arnd Bergmann commit 44484fa8eedf1c6e8f23ba2675b266abdd170a6e Merge: e5ec6a2513383 7b66dfcc6e1e1 Author: David S. Miller Date: Wed Jul 20 11:13:54 2022 +0100 Merge tag 'linux-can-fixes-for-5.19-20220720' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is a pull request of 2 patches for net/master. The first patch is by me and fixes the detection of the mcp251863 in the mcp251xfd driver. The last patch is by Liang He and adds a missing of_node_put() in the rcar_canfd driver. ==================== Signed-off-by: David S. Miller commit e5ec6a2513383fe2ecc2ee3b5f51d97acbbcd4d8 Author: Ido Schimmel Date: Tue Jul 19 15:26:26 2022 +0300 mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication mlxsw needs to distinguish nexthops with a gateway from connected nexthops in order to write the former to the adjacency table of the device. The check used to rely on the fact that nexthops with a gateway have a 'link' scope whereas connected nexthops have a 'host' scope. This is no longer correct after commit 747c14307214 ("ip: fix dflt addr selection for connected nexthop"). Fix that by instead checking the address family of the gateway IP. This is a more direct way and also consistent with the IPv6 counterpart in mlxsw_sp_rt6_is_gateway(). Cc: stable@vger.kernel.org Fixes: 747c14307214 ("ip: fix dflt addr selection for connected nexthop") Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops") Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Reviewed-by: Nicolas Dichtel Reviewed-by: David Ahern Signed-off-by: David S. Miller commit c0f47c2822aadeb8b2829f3e4c3792f184c7be33 Author: Oz Shlomo Date: Tue Jul 19 15:24:09 2022 +0300 net/sched: cls_api: Fix flow action initialization The cited commit refactored the flow action initialization sequence to use an interface method when translating tc action instances to flow offload objects. The refactored version skips the initialization of the generic flow action attributes for tc actions, such as pedit, that allocate more than one offload entry. This can cause potential issues for drivers mapping flow action ids. Populate the generic flow action fields for all the flow action entries. Fixes: c54e1d920f04 ("flow_offload: add ops to tc_action_ops for flow action setup") Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan ---- v1 -> v2: - coalese the generic flow action fields initialization to a single loop Reviewed-by: Baowen Zheng Signed-off-by: David S. Miller commit 3b15b3e93e405828c0b38df15439d9a851468d98 Merge: ef5621758a02f a11e5b3e7a59f Author: David S. Miller Date: Wed Jul 20 10:14:50 2022 +0100 Merge branch 'net-sysctl-races-round-4' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Round 4). This series fixes data-races around 17 knobs after fib_multipath_use_neigh in ipv4_net_table. tcp_fack was skipped because it's obsolete and there's no readers. So, round 5 will start with tcp_dsack, 2 rounds left for 27 knobs. ==================== Signed-off-by: David S. Miller commit a11e5b3e7a59fde1a90b0eaeaa82320495cf8cae Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:53 2022 -0700 tcp: Fix data-races around sysctl_tcp_max_reordering. While reading sysctl_tcp_max_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: dca145ffaa8d ("tcp: allow for bigger reordering level") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2d17d9c7382327d00aeaea35af44e9b26d53206e Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:52 2022 -0700 tcp: Fix a data-race around sysctl_tcp_abort_on_overflow. While reading sysctl_tcp_abort_on_overflow, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 0b484c91911e758e53656d570de58c2ed81ec6f2 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:51 2022 -0700 tcp: Fix a data-race around sysctl_tcp_rfc1337. While reading sysctl_tcp_rfc1337, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4e08ed41cb1194009fc1a916a59ce3ed4afd77cd Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:50 2022 -0700 tcp: Fix a data-race around sysctl_tcp_stdurg. While reading sysctl_tcp_stdurg, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1a63cb91f0c2fcdeced6d6edee8d1d886583d139 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:49 2022 -0700 tcp: Fix a data-race around sysctl_tcp_retrans_collapse. While reading sysctl_tcp_retrans_collapse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4845b5713ab18a1bb6e31d1fbb4d600240b8b691 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:48 2022 -0700 tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. While reading sysctl_tcp_slow_start_after_idle, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 35089bb203f4 ("[TCP]: Add tcp_slow_start_after_idle sysctl.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 7c6f2a86ca590d5187a073d987e9599985fb1c7c Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:47 2022 -0700 tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. While reading sysctl_tcp_thin_linear_timeouts, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 36e31b0af587 ("net: TCP thin linear timeouts") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit e7d2ef837e14a971a05f60ea08c47f3fed1a36e4 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:46 2022 -0700 tcp: Fix data-races around sysctl_tcp_recovery. While reading sysctl_tcp_recovery, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 4f41b1c58a32 ("tcp: use RACK to detect losses") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 52e65865deb6a36718a463030500f16530eaab74 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:45 2022 -0700 tcp: Fix a data-race around sysctl_tcp_early_retrans. While reading sysctl_tcp_early_retrans, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: eed530b6c676 ("tcp: early retransmit") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 3666f666e99600518ab20982af04a078bbdad277 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:44 2022 -0700 tcp: Fix data-races around sysctl knobs related to SYN option. While reading these knobs, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - tcp_sack - tcp_window_scaling - tcp_timestamps Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 3d72bb4188c708bb16758c60822fc4dda7a95174 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:43 2022 -0700 udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 63a6fff353d0 ("net: Avoid receiving packets with an l3mdev on unbound UDP sockets") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 9b55c20f83369dd54541d9ddbe3a018a8377f451 Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:42 2022 -0700 ip: Fix data-races around sysctl_ip_prot_sock. sysctl_ip_prot_sock is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8895a9c2ac76fb9d3922fed4fe092c8ec5e5cccc Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:41 2022 -0700 ipv4: Fix data-races around sysctl_fib_multipath_hash_fields. While reading sysctl_fib_multipath_hash_fields, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: ce5c9c20d364 ("ipv4: Add a sysctl to control multipath hash fields") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit 7998c12a08c97cc26660532c9f90a34bd7d8da5a Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:40 2022 -0700 ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. While reading sysctl_fib_multipath_hash_policy, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: bf4e0a3db97e ("net: ipv4: add support for ECMP hash policy choice") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 87507bcb4f5de16bb419e9509d874f4db6c0ad0f Author: Kuniyuki Iwashima Date: Mon Jul 18 10:26:39 2022 -0700 ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. While reading sysctl_fib_multipath_use_neigh, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: a6db4494d218 ("net: ipv4: Consider failed nexthops in multipath routes") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit ef5621758a02fe8178de9d0df414ffb79463ff86 Merge: 48ea8ea32dbf3 e79b9473e9b59 Author: David S. Miller Date: Wed Jul 20 10:11:58 2022 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2022-07-20 1) Fix a policy refcount imbalance in xfrm_bundle_lookup. From Hangyu Hua. 2) Fix some clang -Wformat warnings. Justin Stitt ==================== Signed-off-by: David S. Miller commit 7b66dfcc6e1e1f018492619c3d0fc432b6b54272 Author: Liang He Date: Tue Jul 12 17:56:23 2022 +0800 can: rcar_canfd: Add missing of_node_put() in rcar_canfd_probe() We should use of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC") Link: https://lore.kernel.org/all/20220712095623.364287-1-windhl@126.com Signed-off-by: Liang He Signed-off-by: Marc Kleine-Budde commit db87c005b9cce0b815b2268963502c178a1e27c8 Author: Marc Kleine-Budde Date: Tue Jul 5 21:30:38 2022 +0200 can: mcp251xfd: fix detection of mcp251863 In commit c6f2a617a0a8 ("can: mcp251xfd: add support for mcp251863") support for the mcp251863 was added. However it was not taken into account that the auto detection of the chip model cannot distinguish between mcp2518fd and mcp251863 and would lead to a warning message if the firmware specifies a mcp251863. Fix auto detection: If a mcp2518fd compatible chip is found, keep the mcp251863 if specified by firmware, use mcp2518fd instead. Link: https://lore.kernel.org/all/20220706064835.1848864-1-mkl@pengutronix.de Fixes: c6f2a617a0a8 ("can: mcp251xfd: add support for mcp251863") Signed-off-by: Marc Kleine-Budde commit 02c87df2480ac855d88ee308ce3fa857d9bd55a8 Author: Liang He Date: Thu Jul 14 16:13:37 2022 +0800 drm/imx/dcss: Add missing of_node_put() in fail path In dcss_dev_create() and dcss_dev_destroy(), we should call of_node_put() in fail path or before the dcss's destroy as of_graph_get_port_by_id() has increased the refcount. Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ") Signed-off-by: Liang He Reviewed-by: Laurentiu Palcu Signed-off-by: Laurentiu Palcu Link: https://patchwork.freedesktop.org/patch/msgid/20220714081337.374761-1-windhl@126.com commit 7849f5cf7639cd1125a3546a31675af4ab54278f Author: Baolin Wang Date: Wed Jul 20 15:03:58 2022 +0800 mailmap: update Baolin Wang's email I recently switched to my Alibaba email address. So add aliases for my previous email addresses. Signed-off-by: Baolin Wang Signed-off-by: Arnd Bergmann commit be640317a1d0b9cf42fedb2debc2887a7cfa38de Author: Michael Ellerman Date: Mon Jul 18 23:44:18 2022 +1000 powerpc/64s: Disable stack variable initialisation for prom_init With GCC 12 allmodconfig prom_init fails to build: Error: External symbol 'memset' referenced from prom_init.c make[2]: *** [arch/powerpc/kernel/Makefile:204: arch/powerpc/kernel/prom_init_check] Error 1 The allmodconfig build enables KASAN, so all calls to memset in prom_init should be converted to __memset by the #ifdefs in asm/string.h, because prom_init must use the non-KASAN instrumented versions. The build failure happens because there's a call to memset that hasn't been caught by the pre-processor and converted to __memset. Typically that's because it's a memset generated by the compiler itself, and that is the case here. With GCC 12, allmodconfig enables CONFIG_INIT_STACK_ALL_PATTERN, which causes the compiler to emit memset calls to initialise on-stack variables with a pattern. Because prom_init is non-user-facing boot-time only code, as a workaround just disable stack variable initialisation to unbreak the build. Reported-by: Sudip Mukherjee Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220718134418.354114-1-mpe@ellerman.id.au commit 443148858f26ee0fea6ad1b292d49d884dce92d1 Author: Daniele Ceraolo Spurio Date: Mon Jul 18 16:07:32 2022 -0700 drm/i915/guc: support v69 in parallel to v70 This patch re-introduces support for GuC v69 in parallel to v70. As this is a quick fix, v69 has been re-introduced as the single "fallback" guc version in case v70 is not available on disk and only for platforms that are out of force_probe and require the GuC by default. All v69 specific code has been labeled as such for easy identification, and the same was done for all v70 functions for which there is a separate v69 version, to avoid accidentally calling the wrong version via the unlabeled name. When the fallback mode kicks in, a drm_notice message is printed in dmesg to inform the user of the required update. The existing logging of the fetch function has also been updated so that we no longer complain immediately if we can't find a fw and we only throw an error if the fetch of both the base and fallback blobs fails. The plan is to follow this up with a more complex rework to allow for multiple different GuC versions to be supported at the same time. v2: reduce the fallback to platform that require it, switch to firmware_request_nowarn(), improve logs. Fixes: 2584b3549f4c ("drm/i915/guc: Update to GuC version 70.1.1") Link: https://lists.freedesktop.org/archives/intel-gfx/2022-July/301640.html Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Matthew Brost Cc: Matt Roper Cc: Dave Airlie Cc: Michal Wajdeczko Acked-by: Rodrigo Vivi Reviewed-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220718230732.1409641-1-daniele.ceraolospurio@intel.com (cherry picked from commit 774ce1510e6ccb9c0752d4aa7a9ff3624b3db3f3) Signed-off-by: Rodrigo Vivi commit e7999fa14f19254ee6a8b52e2711de1f6bef2a1c Author: Matthew Brost Date: Wed May 4 16:46:36 2022 -0700 drm/i915/guc: Support programming the EU priority in the GuC descriptor In GuC submission mode the EU priority must be updated by the GuC rather than the driver as the GuC owns the programming of the context descriptor. Given that the GuC code uses the GuC priorities, we can't use a generic function using i915 priorities for both execlists and GuC submission. The existing function has therefore been pushed to the execlists back-end while a new one has been added for GuC. v2: correctly use the GuC prio. Cc: John Harrison Cc: Matt Roper Signed-off-by: Matthew Brost Signed-off-by: Aravind Iddamsetty Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220504234636.2119794-1-daniele.ceraolospurio@intel.com (cherry picked from commit a5c89f7c43c12c592a882a0ec2a15e9df0011e80) Signed-off-by: Rodrigo Vivi commit 48ea8ea32dbf3231882e9bc0b297fe1400785219 Merge: c6b10de537b90 d8fa2fd791a72 Author: Jakub Kicinski Date: Tue Jul 19 17:43:02 2022 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-07-18 This series contains updates to iavf driver only. Przemyslaw fixes handling of multiple VLAN requests to account for individual errors instead of rejecting them all. He removes incorrect implementations of ETHTOOL_COALESCE_MAX_FRAMES and ETHTOOL_COALESCE_MAX_FRAMES_IRQ. He also corrects an issue with NULL pointer caused by improper handling of dummy receive descriptors. Finally, he corrects debug prints reporting an unknown state. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: Fix missing state logs iavf: Fix handling of dummy receive descriptors iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq iavf: Fix VLAN_V2 addition/rejection ==================== Link: https://lore.kernel.org/r/20220718174807.4113582-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c6b10de537b904fb70522d8cc4600c2f11246c93 Author: Xin Long Date: Mon Jul 18 13:56:59 2022 -0400 Documentation: fix udp_wmem_min in ip-sysctl.rst UDP doesn't support tx memory accounting, and sysctl udp_wmem_min is not really used anywhere. So we should fix the description in ip-sysctl.rst accordingly. Fixes: 95766fff6b9a ("[UDP]: Add memory accounting.") Signed-off-by: Xin Long Link: https://lore.kernel.org/r/c880a963d9b1fb5f442ae3c9e4dfa70d45296a16.1658167019.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 53eb9b04560cc368b7874a7ef1ca7666741739e4 Author: Lorenzo Bianconi Date: Mon Jul 18 11:51:53 2022 +0200 net: ethernet: mtk_ppe: fix possible NULL pointer dereference in mtk_flow_get_wdma_info odev pointer can be NULL in mtk_flow_offload_replace routine according to the flower action rules. Fix possible NULL pointer dereference in mtk_flow_get_wdma_info. Fixes: a333215e10cb5 ("net: ethernet: mtk_eth_soc: implement flow offloading to WED devices") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/4e1685bc4976e21e364055f6bee86261f8f9ee93.1658137753.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit cdf0b86b250fd3c1c3e120c86583ea510c52e4ce Author: Hayes Wang Date: Mon Jul 18 16:21:20 2022 +0800 r8152: fix a WOL issue This fixes that the platform is waked by an unexpected packet. The size and range of FIFO is different when the device enters S3 state, so it is necessary to correct some settings when suspending. Regardless of jumbo frame, set RMS to 1522 and MTPS to MTPS_DEFAULT. Besides, enable MCU_BORW_EN to update the method of calculating the pointer of data. Then, the hardware could get the correct data. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Hayes Wang Link: https://lore.kernel.org/r/20220718082120.10957-391-nic_swsd@realtek.com Signed-off-by: Jakub Kicinski commit ef2084a8388b19c8812356106e0c8d29915f9d8b Author: Nícolas F. R. A. Prado Date: Tue Jul 19 16:38:56 2022 -0400 drm/panel-edp: Fix variable typo when saving hpd absent delay from DT The value read from the "hpd-absent-delay-ms" property in DT was being saved to the wrong variable, overriding the hpd_reliable delay. Fix the typo. Fixes: 5540cf8f3e8d ("drm/panel-edp: Implement generic "edp-panel"s probed by EDID") Signed-off-by: Nícolas F. R. A. Prado Reviewed-by: André Almeida Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20220719203857.1488831-4-nfraprado@collabora.com commit 908fc4c2abdb1835f303cf6827e66676568943e7 Author: Tom Lendacky Date: Tue Jul 19 12:12:52 2022 -0500 virt: sev-guest: Pass the appropriate argument type to iounmap() Fix a sparse warning in sev_guest_probe() where the wrong argument type is provided to iounmap(). Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver") Reported-by: kernel test robot Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/202207150617.jqwQ0Rpz-lkp@intel.com commit 82e094f7bd988c02df27f8c8d81af8f750660b2a Merge: 957a2b345cbcf 5f7ef4875f995 Author: Jens Axboe Date: Tue Jul 19 12:42:33 2022 -0600 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-5.19 Pull MD fix from Song. * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid5: missing error code in setup_conf() commit 4f2bfd9494a072d58203600de6bedd72680e612a Author: Neeraj Upadhyay Date: Fri Jul 1 08:45:45 2022 +0530 srcu: Make expedited RCU grace periods block even less frequently The purpose of commit 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU") was to prevent a long series of never-blocking expedited SRCU grace periods from blocking kernel-live-patching (KLP) progress. Although it was successful, it also resulted in excessive boot times on certain embedded workloads running under qemu with the "-bios QEMU_EFI.fd" command line. Here "excessive" means increasing the boot time up into the three-to-four minute range. This increase in boot time was due to the more than 6000 back-to-back invocations of synchronize_rcu_expedited() within the KVM host OS, which in turn resulted from qemu's emulation of a long series of MMIO accesses. Commit 640a7d37c3f4 ("srcu: Block less aggressively for expedited grace periods") did not significantly help this particular use case. Zhangfei Gao and Shameerali Kolothum Thodi did experiments varying the value of SRCU_MAX_NODELAY_PHASE with HZ=250 and with various values of non-sleeping per phase counts on a system with preemption enabled, and observed the following boot times: +──────────────────────────+────────────────+ | SRCU_MAX_NODELAY_PHASE | Boot time (s) | +──────────────────────────+────────────────+ | 100 | 30.053 | | 150 | 25.151 | | 200 | 20.704 | | 250 | 15.748 | | 500 | 11.401 | | 1000 | 11.443 | | 10000 | 11.258 | | 1000000 | 11.154 | +──────────────────────────+────────────────+ Analysis on the experiment results show additional improvements with CPU-bound delays approaching one jiffy in duration. This improvement was also seen when number of per-phase iterations were scaled to one jiffy. This commit therefore scales per-grace-period phase number of non-sleeping polls so that non-sleeping polls extend for about one jiffy. In addition, the delay-calculation call to srcu_get_delay() in srcu_gp_end() is replaced with a simple check for an expedited grace period. This change schedules callback invocation immediately after expedited grace periods complete, which results in greatly improved boot times. Testing done by Marc and Zhangfei confirms that this change recovers most of the performance degradation in boottime; for CONFIG_HZ_250 configuration, specifically, boot times improve from 3m50s to 41s on Marc's setup; and from 2m40s to ~9.7s on Zhangfei's setup. In addition to the changes to default per phase delays, this change adds 3 new kernel parameters - srcutree.srcu_max_nodelay, srcutree.srcu_max_nodelay_phase, and srcutree.srcu_retry_check_delay. This allows users to configure the srcu grace period scanning delays in order to more quickly react to additional use cases. Fixes: 640a7d37c3f4 ("srcu: Block less aggressively for expedited grace periods") Fixes: 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU") Reported-by: Zhangfei Gao Reported-by: yueluck Signed-off-by: Neeraj Upadhyay Tested-by: Marc Zyngier Tested-by: Zhangfei Gao Link: https://lore.kernel.org/all/20615615-0013-5adc-584f-2b1d5c03ebfc@linaro.org/ Signed-off-by: Paul E. McKenney commit 8f870e6eb8c0c3f9869bf3fcf9db39f86cfcea49 Author: Paul E. McKenney Date: Sun Jun 12 15:00:06 2022 -0700 srcu: Block less aggressively for expedited grace periods Commit 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU") fixed a problem where a long-running expedited SRCU grace period could block kernel live patching. It did so by giving up on expediting once a given SRCU expedited grace period grew too old. Unfortunately, this added excessive delays to boots of virtual embedded systems specifying "-bios QEMU_EFI.fd" to qemu. This commit therefore makes the transition away from expediting less aggressive, increasing the per-grace-period phase number of non-sleeping polls of readers from one to three and increasing the required grace-period age from one jiffy (actually from zero to one jiffies) to two jiffies (actually from one to two jiffies). Fixes: 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU") Signed-off-by: Paul E. McKenney Reported-by: Zhangfei Gao Reported-by: chenxiang (M)" Cc: Shameerali Kolothum Thodi Cc: Paolo Bonzini Reviewed-by: Neeraj Upadhyay Link: https://lore.kernel.org/all/20615615-0013-5adc-584f-2b1d5c03ebfc@linaro.org/ commit cf5029d5dd7cb0aaa53250fa9e389abd231606b3 Author: Aaron Lewis Date: Thu Jul 14 16:13:15 2022 +0000 KVM: x86: Protect the unused bits in MSR exiting flags The flags for KVM_CAP_X86_USER_SPACE_MSR and KVM_X86_SET_MSR_FILTER have no protection for their unused bits. Without protection, future development for these features will be difficult. Add the protection needed to make it possible to extend these features in the future. Signed-off-by: Aaron Lewis Message-Id: <20220714161314.1715227-1-aaronlewis@google.com> Signed-off-by: Paolo Bonzini commit 5f7ef4875f99538b741527963ffe09e869b49826 Author: Dan Carpenter Date: Tue Jul 19 12:48:01 2022 +0300 md/raid5: missing error code in setup_conf() Return -ENOMEM if the allocation fails. Don't return success. Fixes: 8fbcba6b999b ("md/raid5: Cleanup setup_conf() error returns") Signed-off-by: Dan Carpenter Reviewed-by: Logan Gunthorpe Signed-off-by: Song Liu commit dc951e22a1a2a6a11b29648c3c8b191bc8f3e5df Author: Paolo Bonzini Date: Tue Jul 19 09:16:53 2022 -0400 tools headers UAPI: Sync linux/kvm.h with the kernel sources Silence this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Reported-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Paolo Bonzini commit e923b0537d28e15c9d31ce8b38f810b325816903 Author: Gavin Shan Date: Tue Jul 19 10:08:30 2022 +0800 KVM: selftests: Fix target thread to be migrated in rseq_test In rseq_test, there are two threads, which are vCPU thread and migration worker separately. Unfortunately, the test has the wrong PID passed to sched_setaffinity() in the migration worker. It forces migration on the migration worker because zeroed PID represents the calling thread, which is the migration worker itself. It means the vCPU thread is never enforced to migration and it can migrate at any time, which eventually leads to failure as the following logs show. host# uname -r 5.19.0-rc6-gavin+ host# # cat /proc/cpuinfo | grep processor | tail -n 1 processor : 223 host# pwd /home/gavin/sandbox/linux.main/tools/testing/selftests/kvm host# for i in `seq 1 100`; do \ echo "--------> $i"; ./rseq_test; done --------> 1 --------> 2 --------> 3 --------> 4 --------> 5 --------> 6 ==== Test Assertion Failure ==== rseq_test.c:265: rseq_cpu == cpu pid=3925 tid=3925 errno=4 - Interrupted system call 1 0x0000000000401963: main at rseq_test.c:265 (discriminator 2) 2 0x0000ffffb044affb: ?? ??:0 3 0x0000ffffb044b0c7: ?? ??:0 4 0x0000000000401a6f: _start at ??:? rseq CPU = 4, sched CPU = 27 Fix the issue by passing correct parameter, TID of the vCPU thread, to sched_setaffinity() in the migration worker. Fixes: 61e52f1630f5 ("KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs") Suggested-by: Sean Christopherson Signed-off-by: Gavin Shan Reviewed-by: Oliver Upton Message-Id: <20220719020830.3479482-1-gshan@redhat.com> Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 450a563924ae9437758bd468c5b7cee9468ce749 Author: Oliver Upton Date: Tue Jul 19 12:52:29 2022 +0000 KVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats commit 1b870fa5573e ("kvm: stats: tell userspace which values are boolean") added a new stat unit (boolean) but failed to raise KVM_STATS_UNIT_MAX. Fix by pointing UNIT_MAX at the new max value of UNIT_BOOLEAN. Fixes: 1b870fa5573e ("kvm: stats: tell userspace which values are boolean") Reported-by: Janis Schoetterl-Glausch Signed-off-by: Oliver Upton Message-Id: <20220719125229.2934273-1-oupton@google.com> Signed-off-by: Paolo Bonzini commit b3fcfc4f0c50a716487fd7ebd0e6b64a2db29d76 Merge: 1774559f07993 989918482bbcc Author: Paolo Abeni Date: Tue Jul 19 12:37:04 2022 +0200 Merge branch 'amt-fix-validation-and-synchronization-bugs' Taehee Yoo says: ==================== amt: fix validation and synchronization bugs There are some synchronization issues in the amt module. Especially, an amt gateway doesn't well synchronize its own variables and status(amt->status). It tries to use a workqueue for handles in a single thread. A global lock is also good, but it would occur complex locking complex. In this patchset, only the gateway uses workqueue. The reason why only gateway interface uses workqueue is that gateway should manage its own states and variables a little bit statefully. But relay doesn't need to manage tunnels statefully, stateless is okay. So, relay side message handlers are okay to be called concurrently. But it doesn't mean that no lock is needed. Only amt multicast data message type will not be processed by the work queue because It contains actual multicast data. So, it should be processed immediately. When any amt gateway events are triggered(sending discovery message by delayed_work, sending request message by delayed_work and receiving messages), it stores event and skb into the event queue(amt->events[16]). Then, workqueue processes these events one by one. The first patch is to use the work queue. The second patch is to remove unnecessary lock due to a previous patch. The third patch is to use READ_ONCE() in the amt module. Even if the amt module uses a single thread, some variables (ready4, ready6, amt->status) can be accessed concurrently. The fourth patch is to add missing nonce generation logic when it sends a new request message. The fifth patch is to drop unexpected advertisement messages. advertisement message should be received only after the gateway sends a discovery message first. So, the gateway should drop advertisement messages if it has never sent a discovery message and it also should drop duplicate advertisement messages. Using nonce is good to distinguish whether a received message is an expected message or not. The sixth patch is to drop unexpected query messages. This is the same behavior as the fourth patch. Query messages should be received only after the gateway sends a request message first. The nonce variable is used to distinguish whether it is a reply to a previous request message or not. amt->ready4 and amt->ready6 are used to distinguish duplicate messages. The seventh patch is to drop unexpected multicast data. AMT gateway should not receive multicast data message type before establish between gateway and relay. In order to drop unexpected multicast data messages, it checks amt->status. The last patch is to fix a locking problem on the relay side. amt->nr_tunnels variable is protected by amt->lock. But amt_request_handler() doesn't protect this variable. v2: - Use local_bh_disable() instead of rcu_read_lock_bh() in amt_membership_query_handler. - Fix using uninitialized variables. - Fix unexpectedly start the event_wq after stopping. - Fix possible deadlock in amt_event_work(). - Add a limit variable in amt_event_work() to prevent infinite working. - Rename amt_queue_events() to amt_queue_event(). ==================== Link: https://lore.kernel.org/r/20220717160910.19156-1-ap420073@gmail.com Signed-off-by: Paolo Abeni commit 989918482bbccbbce3ba2bb9156eb4c193319983 Author: Taehee Yoo Date: Sun Jul 17 16:09:10 2022 +0000 amt: do not use amt->nr_tunnels outside of lock amt->nr_tunnels is protected by amt->lock. But, amt_request_handler() has been using this variable without the amt->lock. So, it expands context of amt->lock in the amt_request_handler() to protect amt->nr_tunnels variable. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit e882827d5b8942a27b4d28548aa27562a3a7e94c Author: Taehee Yoo Date: Sun Jul 17 16:09:09 2022 +0000 amt: drop unexpected multicast data AMT gateway interface should not receive unexpected multicast data. Multicast data message type should be received after sending an update message, which means all establishment between gateway and relay is finished. So, amt_multicast_data_handler() checks amt->status. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 239d886601e38d948a28f3b2a1c9ce5f01bf75f2 Author: Taehee Yoo Date: Sun Jul 17 16:09:08 2022 +0000 amt: drop unexpected query message AMT gateway interface should not receive unexpected query messages. In order to drop unexpected query messages, it checks nonce. And it also checks ready4 and ready6 variables to drop duplicated messages. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 40185f359fbabaa61da754cc29d12f3a41e0a987 Author: Taehee Yoo Date: Sun Jul 17 16:09:07 2022 +0000 amt: drop unexpected advertisement message AMT gateway interface should not receive unexpected advertisement messages. In order to drop these packets, it should check nonce and amt->status. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 627f16931bf3cb20d50274d9341380ac2c3035fd Author: Taehee Yoo Date: Sun Jul 17 16:09:06 2022 +0000 amt: add missing regeneration nonce logic in request logic When AMT gateway starts sending a new request message, it should regenerate the nonce variable. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 928f353cb8672f0d6078aad75eeec0ed33875b12 Author: Taehee Yoo Date: Sun Jul 17 16:09:05 2022 +0000 amt: use READ_ONCE() in amt module There are some data races in the amt module. amt->ready4, amt->ready6, and amt->status can be accessed concurrently without locks. So, it uses READ_ONCE() and WRITE_ONCE(). Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 9c343ea6185febe5f6b74f7f7b3757f3dd9c5af6 Author: Taehee Yoo Date: Sun Jul 17 16:09:04 2022 +0000 amt: remove unnecessary locks By the previous patch, amt gateway handlers are changed to worked by a single thread. So, most locks for gateway are not needed. So, it removes. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 30e22a6ebca039572ce9bc10f1934f4eabfb5b7f Author: Taehee Yoo Date: Sun Jul 17 16:09:03 2022 +0000 amt: use workqueue for gateway side message handling There are some synchronization issues(amt->status, amt->req_cnt, etc) if the interface is in gateway mode because gateway message handlers are processed concurrently. This applies a work queue for processing these messages instead of expanding the locking context. So, the purposes of this patch are to fix exist race conditions and to make gateway to be able to validate a gateway status more correctly. When the AMT gateway interface is created, it tries to establish to relay. The establishment step looks stateless, but it should be managed well. In order to handle messages in the gateway, it saves the current status(i.e. AMT_STATUS_XXX). This patch makes gateway code to be worked with a single thread. Now, all messages except the multicast are triggered(received or delay expired), and these messages will be stored in the event queue(amt->events). Then, the single worker processes stored messages asynchronously one by one. The multicast data message type will be still processed immediately. Now, amt->lock is only needed to access the event queue(amt->events) if an interface is the gateway mode. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Paolo Abeni commit 1774559f07993e1cac33c2406e99049d4bdea6c8 Author: Oleksij Rempel Date: Sun Jul 17 15:58:31 2022 +0200 net: dsa: vitesse-vsc73xx: silent spi_device_id warnings Add spi_device_id entries to silent SPI warnings. Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible") Signed-off-by: Oleksij Rempel Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220717135831.2492844-2-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 855fe49984a8a3899f07ae1d149d46cd8d4acb52 Author: Oleksij Rempel Date: Sun Jul 17 15:58:30 2022 +0200 net: dsa: sja1105: silent spi_device_id warnings Add spi_device_id entries to silent following warnings: SPI driver sja1105 has no spi_device_id for nxp,sja1105e SPI driver sja1105 has no spi_device_id for nxp,sja1105t SPI driver sja1105 has no spi_device_id for nxp,sja1105p SPI driver sja1105 has no spi_device_id for nxp,sja1105q SPI driver sja1105 has no spi_device_id for nxp,sja1105r SPI driver sja1105 has no spi_device_id for nxp,sja1105s SPI driver sja1105 has no spi_device_id for nxp,sja1110a SPI driver sja1105 has no spi_device_id for nxp,sja1110b SPI driver sja1105 has no spi_device_id for nxp,sja1110c SPI driver sja1105 has no spi_device_id for nxp,sja1110d Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible") Signed-off-by: Oleksij Rempel Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20220717135831.2492844-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec Author: Hristo Venev Date: Sat Jul 16 11:51:34 2022 +0300 be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") Signed-off-by: Hristo Venev Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name Signed-off-by: Paolo Abeni commit b8c768ccdd8338504fb78370747728d5002b1b5a Author: Haibo Chen Date: Mon Jul 18 16:31:43 2022 +0800 gpio: pca953x: use the correct register address when regcache sync during init For regcache_sync_region, we need to use pca953x_recalc_addr() to get the real register address. Fixes: ec82d1eba346 ("gpio: pca953x: Zap ad-hoc reg_output cache") Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") Signed-off-by: Haibo Chen Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 2abc17a93867dc816f0ed9d32021dda8078e7330 Author: Haibo Chen Date: Mon Jul 18 16:31:42 2022 +0800 gpio: pca953x: use the correct range when do regmap sync regmap will sync a range of registers, here use the correct range to make sure the sync do not touch other unexpected registers. Find on pca9557pw on imx8qxp/dxl evk board, this device support 8 pin, so only need one register(8 bits) to cover all the 8 pins's property setting. But when sync the output, we find it actually update two registers, output register and the following register. Fixes: b76574300504 ("gpio: pca953x: Restore registers after suspend/resume cycle") Fixes: ec82d1eba346 ("gpio: pca953x: Zap ad-hoc reg_output cache") Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") Signed-off-by: Haibo Chen Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit db8edaa09d7461ec08672a92a2eef63d5882bb79 Author: Haibo Chen Date: Mon Jul 18 16:31:41 2022 +0800 gpio: pca953x: only use single read/write for No AI mode For the device use NO AI mode(not support auto address increment), only use the single read/write when config the regmap. We meet issue on PCA9557PW on i.MX8QXP/DXL evk board, this device do not support AI mode, but when do the regmap sync, regmap will sync 3 byte data to register 1, logically this means write first data to register 1, write second data to register 2, write third data to register 3. But this device do not support AI mode, finally, these three data write only into register 1 one by one. the reault is the value of register 1 alway equal to the latest data, here is the third data, no operation happened on register 2 and register 3. This is not what we expect. Fixes: 49427232764d ("gpio: pca953x: Perform basic regmap conversion") Signed-off-by: Haibo Chen Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 25c2a075eb6a3031813b6051bd10dfc22c36a2a4 Author: Herve Codina Date: Mon Jul 4 12:28:43 2022 +0200 clk: lan966x: Fix the lan966x clock gate register address The register address used for the clock gate register is the base register address coming from first reg map (ie. the generic clock registers) instead of the second reg map defining the clock gate register. Use the correct clock gate register address. Fixes: 5ad5915dea00 ("clk: lan966x: Extend lan966x clock driver for clock gating support") Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20220704102845.168438-2-herve.codina@bootlin.com Reviewed-by: Claudiu Beznea Tested-by: Michael Walle Signed-off-by: Stephen Boyd commit da791bac104a3169b05b54270afe75daacba4641 Author: Wong Vee Khee Date: Fri Jul 15 20:24:02 2022 +0800 net: stmmac: remove redunctant disable xPCS EEE call Disable is done in stmmac_init_eee() on the event of MAC link down. Since setting enable/disable EEE via ethtool will eventually trigger a MAC down, removing this redunctant call in stmmac_ethtool.c to avoid calling xpcs_config_eee() twice. Fixes: d4aeaed80b0e ("net: stmmac: trigger PCS EEE to turn off on link down") Signed-off-by: Wong Vee Khee Link: https://lore.kernel.org/r/20220715122402.1017470-1-vee.khee.wong@linux.intel.com Signed-off-by: Jakub Kicinski commit 49a2f5c88e8f8a66d81e93ed034f00dee9fe9cf7 Merge: 1e53834ce541d 1699b4d502eda Author: Jakub Kicinski Date: Mon Jul 18 20:14:27 2022 -0700 Merge branch 'fix-2-dsa-issues-with-vlan_filtering_is_global' Vladimir Oltean says: ==================== Fix 2 DSA issues with vlan_filtering_is_global This patch set fixes 2 issues with vlan_filtering_is_global switches. Both are regressions introduced by refactoring commit d0004a020bb5 ("net: dsa: remove the "dsa_to_port in a loop" antipattern from the core"), which wasn't tested on a wide enough variety of switches. Tested on the sja1105 driver. ==================== Link: https://lore.kernel.org/r/20220715151659.780544-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 1699b4d502eda3c7ea4070debad3ee570b5091b1 Author: Vladimir Oltean Date: Fri Jul 15 18:16:59 2022 +0300 net: dsa: fix NULL pointer dereference in dsa_port_reset_vlan_filtering The "ds" iterator variable used in dsa_port_reset_vlan_filtering() -> dsa_switch_for_each_port() overwrites the "dp" received as argument, which is later used to call dsa_port_vlan_filtering() proper. As a result, switches which do enter that code path (the ones with vlan_filtering_is_global=true) will dereference an invalid dp in dsa_port_reset_vlan_filtering() after leaving a VLAN-aware bridge. Use a dedicated "other_dp" iterator variable to avoid this from happening. Fixes: d0004a020bb5 ("net: dsa: remove the "dsa_to_port in a loop" antipattern from the core") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 4db2a5ef4ccbe6d138828284cfab241b434b5d95 Author: Vladimir Oltean Date: Fri Jul 15 18:16:58 2022 +0300 net: dsa: fix dsa_port_vlan_filtering when global The blamed refactoring commit changed a "port" iterator with "other_dp", but still looked at the slave_dev of the dp outside the loop, instead of other_dp->slave from the loop. As a result, dsa_port_vlan_filtering() would not call dsa_slave_manage_vlan_filtering() except for the port in cause, and not for all switch ports as expected. Fixes: d0004a020bb5 ("net: dsa: remove the "dsa_to_port in a loop" antipattern from the core") Reported-by: Lucian Banu Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 1e53834ce541d4fe271cdcca7703e50be0a44f8a Author: Piotr Skajewski Date: Fri Jul 15 14:44:56 2022 -0700 ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero It is possible to disable VFs while the PF driver is processing requests from the VF driver. This can result in a panic. BUG: unable to handle kernel paging request at 000000000000106c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 8 PID: 0 Comm: swapper/8 Kdump: loaded Tainted: G I --------- - Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:ixgbe_msg_task+0x4c8/0x1690 [ixgbe] Code: 00 00 48 8d 04 40 48 c1 e0 05 89 7c 24 24 89 fd 48 89 44 24 10 83 ff 01 0f 84 b8 04 00 00 4c 8b 64 24 10 4d 03 a5 48 22 00 00 <41> 80 7c 24 4c 00 0f 84 8a 03 00 00 0f b7 c7 83 f8 08 0f 84 8f 0a RSP: 0018:ffffb337869f8df8 EFLAGS: 00010002 RAX: 0000000000001020 RBX: 0000000000000000 RCX: 000000000000002b RDX: 0000000000000002 RSI: 0000000000000008 RDI: 0000000000000006 RBP: 0000000000000006 R08: 0000000000000002 R09: 0000000000029780 R10: 00006957d8f42832 R11: 0000000000000000 R12: 0000000000001020 R13: ffff8a00e8978ac0 R14: 000000000000002b R15: ffff8a00e8979c80 FS: 0000000000000000(0000) GS:ffff8a07dfd00000(0000) knlGS:00000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000106c CR3: 0000000063e10004 CR4: 00000000007726e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? ttwu_do_wakeup+0x19/0x140 ? try_to_wake_up+0x1cd/0x550 ? ixgbevf_update_xcast_mode+0x71/0xc0 [ixgbevf] ixgbe_msix_other+0x17e/0x310 [ixgbe] __handle_irq_event_percpu+0x40/0x180 handle_irq_event_percpu+0x30/0x80 handle_irq_event+0x36/0x53 handle_edge_irq+0x82/0x190 handle_irq+0x1c/0x30 do_IRQ+0x49/0xd0 common_interrupt+0xf/0xf This can be eventually be reproduced with the following script: while : do echo 63 > /sys/class/net//device/sriov_numvfs sleep 1 echo 0 > /sys/class/net//device/sriov_numvfs sleep 1 done Add lock when disabling SR-IOV to prevent process VF mailbox communication. Fixes: d773d1310625 ("ixgbe: Fix memory leak when SR-IOV VFs are direct assigned") Signed-off-by: Piotr Skajewski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220715214456.2968711-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f838a63369818faadec4ad1736cfbd20ab5da00e Author: Dawid Lukwinski Date: Fri Jul 15 14:45:41 2022 -0700 i40e: Fix erroneous adapter reinitialization during recovery process Fix an issue when driver incorrectly detects state of recovery process and erroneously reinitializes interrupts, which results in a kernel error and call trace message. The issue was caused by a combination of two factors: 1. Assuming the EMP reset issued after completing firmware recovery means the whole recovery process is complete. 2. Erroneous reinitialization of interrupt vector after detecting the above mentioned EMP reset. Fixes (1) by changing how recovery state change is detected and (2) by adjusting the conditional expression to ensure using proper interrupt reinitialization method, depending on the situation. Fixes: 4ff0ee1af016 ("i40e: Introduce recovery mode support") Signed-off-by: Dawid Lukwinski Signed-off-by: Jan Sokolowski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220715214542.2968762-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3696c952da0733b843c8da3441345055b1cbacd9 Author: Tom Rix Date: Sat Jul 16 17:46:54 2022 -0400 net: ethernet: mtk_eth_soc: fix off by one check of ARRAY_SIZE In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here struct mtk_wed_ring *ring = &dev->tx_ring[idx]; The bounds of idx are checked here BUG_ON(idx > ARRAY_SIZE(dev->tx_ring)); If idx is the size of the array, it will pass this check and overflow. So change the check to >= . Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") Signed-off-by: Tom Rix Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com Signed-off-by: Jakub Kicinski commit b6224a36de8bb30bfec9ff2bc45ed8002e79a79a Merge: c32349f3257f3 675c807ae26b2 Author: Jakub Kicinski Date: Mon Jul 18 20:00:05 2022 -0700 Merge branch 'net-lan966x-fix-issues-with-mac-table' Horatiu Vultur says: ==================== net: lan966x: Fix issues with MAC table The patch series fixes 2 issues: - when an entry was forgotten the irq thread was holding a spin lock and then was talking also rtnl_lock. - the access to the HW MAC table is indirect, so the access to the HW MAC table was not synchronized, which means that there could be race conditions. ==================== Link: https://lore.kernel.org/r/20220714194040.231651-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 675c807ae26b267233b97cd5006979a6bb8d54d4 Author: Horatiu Vultur Date: Thu Jul 14 21:40:40 2022 +0200 net: lan966x: Fix usage of lan966x->mac_lock when used by FDB When the SW bridge was trying to add/remove entries to/from HW, the access to HW was not protected by any lock. In this way, it was possible to have race conditions. Fix this by using the lan966x->mac_lock to protect parallel access to HW for this cases. Fixes: 25ee9561ec622 ("net: lan966x: More MAC table functionality") Signed-off-by: Horatiu Vultur Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit c1924684369762b112428a333ad00eac6ca89d96 Author: Horatiu Vultur Date: Thu Jul 14 21:40:39 2022 +0200 net: lan966x: Fix usage of lan966x->mac_lock inside lan966x_mac_irq_handler The problem with this spin lock is that it was just protecting the list of the MAC entries in SW and not also the access to the MAC entries in HW. Because the access to HW is indirect, then it could happen to have race conditions. For example when SW introduced an entry in MAC table and the irq mac is trying to read something from the MAC. Update such that also the access to MAC entries in HW is protected by this lock. Fixes: 5ccd66e01cbef ("net: lan966x: add support for interrupts from analyzer") Signed-off-by: Horatiu Vultur Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 99343cfa4f7560abf933fff7ab3ea58a6905c917 Author: Horatiu Vultur Date: Thu Jul 14 21:40:38 2022 +0200 net: lan966x: Fix usage of lan966x->mac_lock when entry is removed To remove an entry to the MAC table, it is required first to setup the entry and then issue a command for the MAC to forget the entry. So if it happens for two threads to remove simultaneously an entry in MAC table then it would be a race condition. Fix this by using lan966x->mac_lock to protect the HW access. Fixes: e18aba8941b40 ("net: lan966x: add mactable support") Signed-off-by: Horatiu Vultur Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 43243bb3195b0dc27741679471e23baed1efe98e Author: Horatiu Vultur Date: Thu Jul 14 21:40:37 2022 +0200 net: lan966x: Fix usage of lan966x->mac_lock when entry is added To add an entry to the MAC table, it is required first to setup the entry and then issue a command for the MAC to learn the entry. So if it happens for two threads to add simultaneously an entry in MAC table then it would be a race condition. Fix this by using lan966x->mac_lock to protect the HW access. Fixes: fc0c3fe7486f2 ("net: lan966x: Add function lan966x_mac_ip_learn()") Signed-off-by: Horatiu Vultur Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 45533a534a45cb12c20c81615d17306176cb1c57 Author: Horatiu Vultur Date: Thu Jul 14 21:40:36 2022 +0200 net: lan966x: Fix taking rtnl_lock while holding spin_lock When the HW deletes an entry in MAC table then it generates an interrupt. The SW will go through it's own list of MAC entries and if it is not found then it would notify the listeners about this. The problem is that when the SW will go through it's own list it would take a spin lock(lan966x->mac_lock) and when it notifies that the entry is deleted. But to notify the listeners it taking the rtnl_lock which is illegal. This is fixed by instead of notifying right away that the entry is deleted, move the entry on a temp list and once, it checks all the entries then just notify that the entries from temp list are deleted. Fixes: 5ccd66e01cbe ("net: lan966x: add support for interrupts from analyzer") Signed-off-by: Horatiu Vultur Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit ca85855bdcae8f84f1512e88b4c75009ea17ea2f Merge: 80e19f34c2887 cc0315564d6ee Author: Linus Torvalds Date: Mon Jul 18 17:16:22 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Two bug fixes for irdma: - x722 does not support 1GB pages, trying to configure them will corrupt the dma mapping - Fix a sleep while holding a spinlock" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Fix sleep from invalid context BUG RDMA/irdma: Do not advertise 1GB page size for x722 commit 4546760619cfa9b718fe2059ceb07101cf9ff61e Author: Vladimir Oltean Date: Sun Jul 17 02:37:45 2022 +0300 pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context The irqchip->irq_set_type method is called by __irq_set_trigger() under the desc->lock raw spinlock. The armada-37xx implementation, armada_37xx_irq_set_type(), uses an MMIO regmap created by of_syscon_register(), which uses plain spinlocks (the kind that are sleepable on RT). Therefore, this is an invalid locking scheme for which we get a kernel splat stating just that ("[ BUG: Invalid wait context ]"), because the context in which the plain spinlock may sleep is atomic due to the raw spinlock. We need to go raw spinlocks all the way. Make this driver create its own MMIO regmap, with use_raw_spinlock=true, and stop relying on syscon to provide it. This patch depends on commit 67021f25d952 ("regmap: teach regmap to use raw spinlocks if requested in the config"). Cc: # 5.15+ Fixes: 2f227605394b ("pinctrl: armada-37xx: Add irqchip support") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220716233745.1704677-3-vladimir.oltean@nxp.com Signed-off-by: Linus Walleij commit 984245b66cf32c494b1e4f95f5ed6ba16b8771eb Author: Vladimir Oltean Date: Sun Jul 17 02:37:44 2022 +0300 pinctrl: armada-37xx: make irq_lock a raw spinlock to avoid invalid wait context The irqchip->irq_set_type method is called by __irq_set_trigger() under the desc->lock raw spinlock. The armada-37xx implementation, armada_37xx_irq_set_type(), takes a plain spinlock, the kind that becomes sleepable on RT. Therefore, this is an invalid locking scheme for which we get a kernel splat stating just that ("[ BUG: Invalid wait context ]"), because the context in which the plain spinlock may sleep is atomic due to the raw spinlock. We need to go raw spinlocks all the way. Replace the driver's irq_lock with a raw spinlock, to disable preemption even on RT. Cc: # 5.15+ Fixes: 2f227605394b ("pinctrl: armada-37xx: Add irqchip support") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220716233745.1704677-2-vladimir.oltean@nxp.com Signed-off-by: Linus Walleij commit c80af0c250c8f8a3c978aa5aafbe9c39b336b813 Author: Junxiao Bi Date: Fri Jun 3 15:28:01 2022 -0700 Revert "ocfs2: mount shared volume without ha stack" This reverts commit 912f655d78c5d4ad05eac287f23a435924df7144. This commit introduced a regression that can cause mount hung. The changes in __ocfs2_find_empty_slot causes that any node with none-zero node number can grab the slot that was already taken by node 0, so node 1 will access the same journal with node 0, when it try to grab journal cluster lock, it will hung because it was already acquired by node 0. It's very easy to reproduce this, in one cluster, mount node 0 first, then node 1, you will see the following call trace from node 1. [13148.735424] INFO: task mount.ocfs2:53045 blocked for more than 122 seconds. [13148.739691] Not tainted 5.15.0-2148.0.4.el8uek.mountracev2.x86_64 #2 [13148.742560] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [13148.745846] task:mount.ocfs2 state:D stack: 0 pid:53045 ppid: 53044 flags:0x00004000 [13148.749354] Call Trace: [13148.750718] [13148.752019] ? usleep_range+0x90/0x89 [13148.753882] __schedule+0x210/0x567 [13148.755684] schedule+0x44/0xa8 [13148.757270] schedule_timeout+0x106/0x13c [13148.759273] ? __prepare_to_swait+0x53/0x78 [13148.761218] __wait_for_common+0xae/0x163 [13148.763144] __ocfs2_cluster_lock.constprop.0+0x1d6/0x870 [ocfs2] [13148.765780] ? ocfs2_inode_lock_full_nested+0x18d/0x398 [ocfs2] [13148.768312] ocfs2_inode_lock_full_nested+0x18d/0x398 [ocfs2] [13148.770968] ocfs2_journal_init+0x91/0x340 [ocfs2] [13148.773202] ocfs2_check_volume+0x39/0x461 [ocfs2] [13148.775401] ? iput+0x69/0xba [13148.777047] ocfs2_mount_volume.isra.0.cold+0x40/0x1f5 [ocfs2] [13148.779646] ocfs2_fill_super+0x54b/0x853 [ocfs2] [13148.781756] mount_bdev+0x190/0x1b7 [13148.783443] ? ocfs2_remount+0x440/0x440 [ocfs2] [13148.785634] legacy_get_tree+0x27/0x48 [13148.787466] vfs_get_tree+0x25/0xd0 [13148.789270] do_new_mount+0x18c/0x2d9 [13148.791046] __x64_sys_mount+0x10e/0x142 [13148.792911] do_syscall_64+0x3b/0x89 [13148.794667] entry_SYSCALL_64_after_hwframe+0x170/0x0 [13148.797051] RIP: 0033:0x7f2309f6e26e [13148.798784] RSP: 002b:00007ffdcee7d408 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [13148.801974] RAX: ffffffffffffffda RBX: 00007ffdcee7d4a0 RCX: 00007f2309f6e26e [13148.804815] RDX: 0000559aa762a8ae RSI: 0000559aa939d340 RDI: 0000559aa93a22b0 [13148.807719] RBP: 00007ffdcee7d5b0 R08: 0000559aa93a2290 R09: 00007f230a0b4820 [13148.810659] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcee7d420 [13148.813609] R13: 0000000000000000 R14: 0000559aa939f000 R15: 0000000000000000 [13148.816564] To fix it, we can just fix __ocfs2_find_empty_slot. But original commit introduced the feature to mount ocfs2 locally even it is cluster based, that is a very dangerous, it can easily cause serious data corruption, there is no way to stop other nodes mounting the fs and corrupting it. Setup ha or other cluster-aware stack is just the cost that we have to take for avoiding corruption, otherwise we have to do it in kernel. Link: https://lkml.kernel.org/r/20220603222801.42488-1-junxiao.bi@oracle.com Fixes: 912f655d78c5("ocfs2: mount shared volume without ha stack") Signed-off-by: Junxiao Bi Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Cc: Signed-off-by: Andrew Morton commit da9a298f5fad0dc615079a340da42928bc5b138e Author: Miaohe Lin Date: Sat Jul 9 17:26:29 2022 +0800 hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte When alloc_huge_page fails, *pagep is set to NULL without put_page first. So the hugepage indicated by *pagep is leaked. Link: https://lkml.kernel.org/r/20220709092629.54291-1-linmiaohe@huawei.com Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY") Signed-off-by: Miaohe Lin Acked-by: Muchun Song Reviewed-by: Anshuman Khandual Reviewed-by: Baolin Wang Reviewed-by: Mike Kravetz Cc: Signed-off-by: Andrew Morton commit bdeb77bc2c405fa9f954c20269db175a0bd2793f Author: Andrei Vagin Date: Sat Jul 16 21:37:10 2022 -0700 fs: sendfile handles O_NONBLOCK of out_fd sendfile has to return EAGAIN if out_fd is nonblocking and the write into it would block. Here is a small reproducer for the problem: #define _GNU_SOURCE /* See feature_test_macros(7) */ #include #include #include #include #include #include #include #define FILE_SIZE (1UL << 30) int main(int argc, char **argv) { int p[2], fd; if (pipe2(p, O_NONBLOCK)) return 1; fd = open(argv[1], O_RDWR | O_TMPFILE, 0666); if (fd < 0) return 1; ftruncate(fd, FILE_SIZE); if (sendfile(p[1], fd, 0, FILE_SIZE) == -1) { fprintf(stderr, "FAIL\n"); } if (sendfile(p[1], fd, 0, FILE_SIZE) != -1 || errno != EAGAIN) { fprintf(stderr, "FAIL\n"); } return 0; } It worked before b964bf53e540, it is stuck after b964bf53e540, and it works again with this fix. This regression occurred because do_splice_direct() calls pipe_write that handles O_NONBLOCK. Here is a trace log from the reproducer: 1) | __x64_sys_sendfile64() { 1) | do_sendfile() { 1) | __fdget() 1) | rw_verify_area() 1) | __fdget() 1) | rw_verify_area() 1) | do_splice_direct() { 1) | rw_verify_area() 1) | splice_direct_to_actor() { 1) | do_splice_to() { 1) | rw_verify_area() 1) | generic_file_splice_read() 1) + 74.153 us | } 1) | direct_splice_actor() { 1) | iter_file_splice_write() { 1) | __kmalloc() 1) 0.148 us | pipe_lock(); 1) 0.153 us | splice_from_pipe_next.part.0(); 1) 0.162 us | page_cache_pipe_buf_confirm(); ... 16 times 1) 0.159 us | page_cache_pipe_buf_confirm(); 1) | vfs_iter_write() { 1) | do_iter_write() { 1) | rw_verify_area() 1) | do_iter_readv_writev() { 1) | pipe_write() { 1) | mutex_lock() 1) 0.153 us | mutex_unlock(); 1) 1.368 us | } 1) 1.686 us | } 1) 5.798 us | } 1) 6.084 us | } 1) 0.174 us | kfree(); 1) 0.152 us | pipe_unlock(); 1) + 14.461 us | } 1) + 14.783 us | } 1) 0.164 us | page_cache_pipe_buf_release(); ... 16 times 1) 0.161 us | page_cache_pipe_buf_release(); 1) | touch_atime() 1) + 95.854 us | } 1) + 99.784 us | } 1) ! 107.393 us | } 1) ! 107.699 us | } Link: https://lkml.kernel.org/r/20220415005015.525191-1-avagin@gmail.com Fixes: b964bf53e540 ("teach sendfile(2) to handle send-to-pipe directly") Signed-off-by: Andrei Vagin Cc: Al Viro Cc: Signed-off-by: Andrew Morton commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 Author: ChenXiaoSong Date: Thu Jul 7 18:53:29 2022 +0800 ntfs: fix use-after-free in ntfs_ucsncmp() Syzkaller reported use-after-free bug as follows: ================================================================== BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130 Read of size 2 at addr ffff8880751acee8 by task a.out/879 CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x1c0/0x2b0 print_address_description.constprop.0.cold+0xd4/0x484 print_report.cold+0x55/0x232 kasan_report+0xbf/0xf0 ntfs_ucsncmp+0x123/0x130 ntfs_are_names_equal.cold+0x2b/0x41 ntfs_attr_find+0x43b/0xb90 ntfs_attr_lookup+0x16d/0x1e0 ntfs_read_locked_attr_inode+0x4aa/0x2360 ntfs_attr_iget+0x1af/0x220 ntfs_read_locked_inode+0x246c/0x5120 ntfs_iget+0x132/0x180 load_system_files+0x1cc6/0x3480 ntfs_fill_super+0xa66/0x1cf0 mount_bdev+0x38d/0x460 legacy_get_tree+0x10d/0x220 vfs_get_tree+0x93/0x300 do_new_mount+0x2da/0x6d0 path_mount+0x496/0x19d0 __x64_sys_mount+0x284/0x300 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3f2118d9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00 RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac memcg:ffff888101f7e180 anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201 raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds. Fix this by adding sanity check on end address of attribute name string. [akpm@linux-foundation.org: coding-style cleanups] [chenxiaosong2@huawei.com: cleanup suggested by Hawkins Jiawei] Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@huawei.com Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huawei.com Signed-off-by: ChenXiaoSong Signed-off-by: Hawkins Jiawei Cc: Anton Altaparmakov Cc: ChenXiaoSong Cc: Yongqiang Liu Cc: Zhang Yi Cc: Zhang Xiaoxu Signed-off-by: Andrew Morton commit 84ac013046ccc438af04b7acecd4d3ab84fe4bde Author: Mike Rapoport Date: Thu Jul 7 19:56:50 2022 +0300 secretmem: fix unhandled fault in truncate syzkaller reports the following issue: BUG: unable to handle page fault for address: ffff888021f7e005 PGD 11401067 P4D 11401067 PUD 11402067 PMD 21f7d063 PTE 800fffffde081060 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3761 Comm: syz-executor281 Not tainted 5.19.0-rc4-syzkaller-00014-g941e3e791269 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:64 Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 RSP: 0018:ffffc9000329fa90 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000ffb RDX: 0000000000000ffb RSI: 0000000000000000 RDI: ffff888021f7e005 RBP: ffffea000087df80 R08: 0000000000000001 R09: ffff888021f7e005 R10: ffffed10043efdff R11: 0000000000000000 R12: 0000000000000005 R13: 0000000000000000 R14: 0000000000001000 R15: 0000000000000ffb FS: 00007fb29d8b2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888021f7e005 CR3: 0000000026e7b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: zero_user_segments include/linux/highmem.h:272 [inline] folio_zero_range include/linux/highmem.h:428 [inline] truncate_inode_partial_folio+0x76a/0xdf0 mm/truncate.c:237 truncate_inode_pages_range+0x83b/0x1530 mm/truncate.c:381 truncate_inode_pages mm/truncate.c:452 [inline] truncate_pagecache+0x63/0x90 mm/truncate.c:753 simple_setattr+0xed/0x110 fs/libfs.c:535 secretmem_setattr+0xae/0xf0 mm/secretmem.c:170 notify_change+0xb8c/0x12b0 fs/attr.c:424 do_truncate+0x13c/0x200 fs/open.c:65 do_sys_ftruncate+0x536/0x730 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fb29d900899 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb29d8b2318 EFLAGS: 00000246 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 00007fb29d988408 RCX: 00007fb29d900899 RDX: 00007fb29d900899 RSI: 0000000000000005 RDI: 0000000000000003 RBP: 00007fb29d988400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb29d98840c R13: 00007ffca01a23bf R14: 00007fb29d8b2400 R15: 0000000000022000 Modules linked in: CR2: ffff888021f7e005 ---[ end trace 0000000000000000 ]--- Eric Biggers suggested that this happens when secretmem_setattr()->simple_setattr() races with secretmem_fault() so that a page that is faulted in by secretmem_fault() (and thus removed from the direct map) is zeroed by inode truncation right afterwards. Use mapping->invalidate_lock to make secretmem_fault() and secretmem_setattr() mutually exclusive. [rppt@linux.ibm.com: v3] Link: https://lkml.kernel.org/r/20220714091337.412297-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20220707165650.248088-1-rppt@kernel.org Reported-by: syzbot+9bd2b7adbd34b30b87e4@syzkaller.appspotmail.com Signed-off-by: Mike Rapoport Suggested-by: Eric Biggers Reviewed-by: Axel Rasmussen Reviewed-by: Jan Kara Cc: Eric Biggers Cc: Hillf Danton Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton commit c2cb0dcce9dd8b748b6ca8bb8d4a389f2e232307 Author: Naoya Horiguchi Date: Mon Jul 4 10:33:05 2022 +0900 mm/hugetlb: separate path for hwpoison entry in copy_hugetlb_page_range() Originally copy_hugetlb_page_range() handles migration entries and hwpoisoned entries in similar manner. But recently the related code path has more code for migration entries, and when is_writable_migration_entry() was converted to !is_readable_migration_entry(), hwpoison entries on source processes got to be unexpectedly updated (which is legitimate for migration entries, but not for hwpoison entries). This results in unexpected serious issues like kernel panic when forking processes with hwpoison entries in pmd. Separate the if branch into one for hwpoison entries and one for migration entries. Link: https://lkml.kernel.org/r/20220704013312.2415700-3-naoya.horiguchi@linux.dev Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive") Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Cc: [5.18] Cc: David Hildenbrand Cc: Liu Shixin Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit f4f451a16dd1f478fdb966bcbb612c1e4ce6b962 Author: Muchun Song Date: Tue Jul 5 20:35:32 2022 +0800 mm: fix missing wake-up event for FSDAX pages FSDAX page refcounts are 1-based, rather than 0-based: if refcount is 1, then the page is freed. The FSDAX pages can be pinned through GUP, then they will be unpinned via unpin_user_page() using a folio variant to put the page, however, folio variants did not consider this special case, the result will be to miss a wakeup event (like the user of __fuse_dax_break_layouts()). This results in a task being permanently stuck in TASK_INTERRUPTIBLE state. Since FSDAX pages are only possibly obtained by GUP users, so fix GUP instead of folio_put() to lower overhead. Link: https://lkml.kernel.org/r/20220705123532.283-1-songmuchun@bytedance.com Fixes: d8ddc099c6b3 ("mm/gup: Add gup_put_folio()") Signed-off-by: Muchun Song Suggested-by: Matthew Wilcox Cc: Jason Gunthorpe Cc: John Hubbard Cc: William Kucharski Cc: Dan Williams Cc: Jan Kara Cc: Signed-off-by: Andrew Morton commit 3fe2895cfecd03ac74977f32102b966b6589f481 Author: Josef Bacik Date: Tue Jul 5 16:00:36 2022 -0400 mm: fix page leak with multiple threads mapping the same page We have an application with a lot of threads that use a shared mmap backed by tmpfs mounted with -o huge=within_size. This application started leaking loads of huge pages when we upgraded to a recent kernel. Using the page ref tracepoints and a BPF program written by Tejun Heo we were able to determine that these pages would have multiple refcounts from the page fault path, but when it came to unmap time we wouldn't drop the number of refs we had added from the faults. I wrote a reproducer that mmap'ed a file backed by tmpfs with -o huge=always, and then spawned 20 threads all looping faulting random offsets in this map, while using madvise(MADV_DONTNEED) randomly for huge page aligned ranges. This very quickly reproduced the problem. The problem here is that we check for the case that we have multiple threads faulting in a range that was previously unmapped. One thread maps the PMD, the other thread loses the race and then returns 0. However at this point we already have the page, and we are no longer putting this page into the processes address space, and so we leak the page. We actually did the correct thing prior to f9ce0be71d1f, however it looks like Kirill copied what we do in the anonymous page case. In the anonymous page case we don't yet have a page, so we don't have to drop a reference on anything. Previously we did the correct thing for file based faults by returning VM_FAULT_NOPAGE so we correctly drop the reference on the page we faulted in. Fix this by returning VM_FAULT_NOPAGE in the pmd_devmap_trans_unstable() case, this makes us drop the ref on the page properly, and now my reproducer no longer leaks the huge pages. [josef@toxicpanda.com: v2] Link: https://lkml.kernel.org/r/e90c8f0dbae836632b669c2afc434006a00d4a67.1657721478.git.josef@toxicpanda.com Link: https://lkml.kernel.org/r/2b798acfd95c9ab9395fe85e8d5a835e2e10a920.1657051137.git.josef@toxicpanda.com Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Signed-off-by: Josef Bacik Signed-off-by: Rik van Riel Signed-off-by: Chris Mason Acked-by: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit f073c8335929a9746c19d4551aeb2d4d0dbef0d1 Author: Seth Forshee Date: Tue Jun 28 15:07:34 2022 -0500 mailmap: update Seth Forshee's email address seth.forshee@canonical.com is no longer valid, use sforshee@kernel.org instead. Link: https://lkml.kernel.org/r/20220628200734.424495-1-sforshee@kernel.org Signed-off-by: Seth Forshee Signed-off-by: Andrew Morton commit 0c98c8e1e181478152d440a89d802ee4508c66a6 Author: ZhaoLong Wang Date: Wed Jun 29 20:43:24 2022 +0800 tmpfs: fix the issue that the mount and remount results are inconsistent. An undefined-behavior issue has not been completely fixed since commit d14f5efadd84 ("tmpfs: fix undefined-behaviour in shmem_reconfigure()"). In the commit, check in the shmem_reconfigure() is added in remount process to avoid the Ubsan problem. However, the check is not added to the mount process. It causes inconsistent results between mount and remount. The operations to reproduce the problem in user mode as follows: If nr_blocks is set to 0x8000000000000000, the mounting is successful. # mount tmpfs /dev/shm/ -t tmpfs -o nr_blocks=0x8000000000000000 However, when -o remount is used, the mount fails because of the check in the shmem_reconfigure() # mount tmpfs /dev/shm/ -t tmpfs -o remount,nr_blocks=0x8000000000000000 mount: /dev/shm: mount point not mounted or bad option. Therefore, add checks in the shmem_parse_one() function and remove the check in shmem_reconfigure() to avoid this problem. Link: https://lkml.kernel.org/r/20220629124324.1640807-1-wangzhaolong1@huawei.com Signed-off-by: ZhaoLong Wang Cc: Luo Meng Cc: Hugh Dickins Cc: Yu Kuai Cc: Zhihao Cheng Cc: Zhang Yi Signed-off-by: Andrew Morton commit 07313a2b29ed1079eaa7722624544b97b3ead84b Author: Yee Lee Date: Tue Jun 28 19:37:11 2022 +0800 mm: kfence: apply kmemleak_ignore_phys on early allocated pool This patch solves two issues. (1) The pool allocated by memblock needs to unregister from kmemleak scanning. Apply kmemleak_ignore_phys to replace the original kmemleak_free as its address now is stored in the phys tree. (2) The pool late allocated by page-alloc doesn't need to unregister. Move out the freeing operation from its call path. Link: https://lkml.kernel.org/r/20220628113714.7792-2-yee.lee@mediatek.com Fixes: 0c24e061196c21d5 ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA") Signed-off-by: Yee Lee Suggested-by: Catalin Marinas Reviewed-by: Catalin Marinas Suggested-by: Marco Elver Reviewed-by: Marco Elver Tested-by: Geert Uytterhoeven Signed-off-by: Andrew Morton commit 80e19f34c2887a8881084b7bb7480e9544d56b91 Merge: ff6992735ade7 85ff37e302efd Author: Linus Torvalds Date: Mon Jul 18 11:47:04 2022 -0700 Merge tag 'hte/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux Pull hardware timestamp fix from Thierry Reding: "A single fix for an out-of-sync kerneldoc comment" * tag 'hte/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: gpiolib: cdev: Fix kernel doc for struct line commit 09073396ea62d0a10b03f5661dcabfd8eca3f098 Author: Mario Limonciello Date: Fri Jul 15 12:33:25 2022 -0500 ACPI: CPPC: Don't require flexible address space if X86_FEATURE_CPPC is supported Commit 0651ab90e4ad ("ACPI: CPPC: Check _OSC for flexible address space") changed _CPC probing to require flexible address space to be negotiated for CPPC to work. However it was observed that this caused a regression for Arek's ROG Zephyrus G15 GA503QM which previously CPPC worked, but now it stopped working. To avoid causing a regression waive this failure when the CPU is known to support CPPC. Cc: Pierre Gondois Link: https://bugzilla.kernel.org/show_bug.cgi?id=216248 Fixes: 0651ab90e4ad ("ACPI: CPPC: Check _OSC for flexible address space") Reported-and-tested-by: Arek Ruśniak Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit d8fa2fd791a72087c1ce3336fbeefec4057c37c8 Author: Przemyslaw Patynowski Date: Wed Jun 15 13:57:20 2022 -0400 iavf: Fix missing state logs Fix debug prints, by adding missing state prints. Extend iavf_state_str by strings for __IAVF_INIT_EXTENDED_CAPS and __IAVF_INIT_CONFIG_ADAPTER. Without this patch, when enabling debug prints for iavf.h, user will see: iavf 0000:06:0e.0: state transition from:__IAVF_INIT_GET_RESOURCES to:__IAVF_UNKNOWN_STATE iavf 0000:06:0e.0: state transition from:__IAVF_UNKNOWN_STATE to:__IAVF_UNKNOWN_STATE Fixes: 605ca7c5c670 ("iavf: Fix kernel BUG in free_msi_irqs") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jun Zhang Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit a9f49e0060301a9bfebeca76739158d0cf91cdf6 Author: Przemyslaw Patynowski Date: Fri Jun 24 17:33:01 2022 -0700 iavf: Fix handling of dummy receive descriptors Fix memory leak caused by not handling dummy receive descriptor properly. iavf_get_rx_buffer now sets the rx_buffer return value for dummy receive descriptors. Without this patch, when the hardware writes a dummy descriptor, iavf would not free the page allocated for the previous receive buffer. This is an unlikely event but can still happen. [Jesse: massaged commit message] Fixes: efa14c398582 ("iavf: allow null RX descriptors") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jesse Brandeburg Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 4635fd3a9d77581498f34ab9a7e4bcc211bf0a4c Author: Przemyslaw Patynowski Date: Mon Jun 13 19:07:42 2022 -0400 iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq Remove from supported_coalesce_params ETHTOOL_COALESCE_MAX_FRAMES and ETHTOOL_COALESCE_MAX_FRAMES_IRQ. As tx-frames-irq allowed user to change budget for iavf_clean_tx_irq, remove work_limit and use define for budget. Without this patch there would be possibility to change rx/tx-frames and rx/tx-frames-irq, which for rx/tx-frames did nothing, while for rx/tx-frames-irq it changed rx/tx-frames and only changed budget for cleaning NAPI poll. Fixes: fbb7ddfef253 ("i40evf: core ethtool functionality") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jun Zhang Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 968996c070ef080ee7d6150faa98a4e562ce4625 Author: Przemyslaw Patynowski Date: Fri Jun 10 14:15:54 2022 +0200 iavf: Fix VLAN_V2 addition/rejection Fix VLAN addition, so that PF driver does not reject whole VLAN batch. Add VLAN reject handling, so rejected VLANs, won't litter VLAN filter list. Fix handling of active_(c/s)vlans, so it will be possible to re-add VLAN filters for user. Without this patch, after changing trust to off, with VLAN filters saturated, no VLAN is added, due to PF rejecting addition. Fixes: 92fc50859872 ("iavf: Restrict maximum VLAN filters for VIRTCHNL_VF_OFFLOAD_VLAN_V2") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jedrzej Jagielski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit e1aadbab445b06e072013a1365fd0cf2aa25e843 Author: xinhui pan Date: Fri Jul 8 09:22:44 2022 +0800 drm/amdgpu: Remove one duplicated ef removal That has been done in BO release notify. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2074 Signed-off-by: xinhui pan Acked-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 28a99e95f55c61855983d36a88c05c178d966bb7 Author: Peter Zijlstra Date: Mon Jul 18 13:41:37 2022 +0200 x86/amd: Use IBPB for firmware calls On AMD IBRS does not prevent Retbleed; as such use IBPB before a firmware call to flush the branch history state. And because in order to do an EFI call, the kernel maps a whole lot of the kernel page table into the EFI page table, do an IBPB just in case in order to prevent the scenario of poisoning the BTB and causing an EFI call using the unprotected RET there. [ bp: Massage. ] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220715194550.793957-1-cascardo@canonical.com commit c32349f3257f329a01e776e02b577bf7af97f30b Merge: c9f21106d97b5 7b02f40350f1b Author: David S. Miller Date: Mon Jul 18 12:44:37 2022 +0100 Merge branch 'dsa-docs' Vladimir Oltean says: ==================== Update DSA documentation These are some updates of dsa.rst, since it hasn't kept up with development (in some cases, even since 2017). I've added Fixes: tags as I thought was appropriate. ==================== Signed-off-by: David S. Miller commit 7b02f40350f1b8011f724a052dcb0849cffa6c38 Author: Vladimir Oltean Date: Sat Jul 16 21:53:44 2022 +0300 docs: net: dsa: mention that VLANs are now refcounted on shared ports The blamed commit updated the way in which VLANs are handled at the cross-chip notifier layer and didn't update the documentation to say that. Fix it. Fixes: 134ef2388e7f ("net: dsa: add explicit support for host bridge VLANs") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 6ba1a4aa5974f8a47e6322cecc965e6357b58d80 Author: Vladimir Oltean Date: Sat Jul 16 21:53:43 2022 +0300 docs: net: dsa: delete misinformation about -EOPNOTSUPP for FDB/MDB/VLAN Returning -EOPNOTSUPP does *NOT* mean anything special. port_vlan_add() is actually called from 2 code paths, one is vlan_vid_add() from 8021q module and the other is br_switchdev_port_vlan_add() from switchdev. The bridge has a wrapper __vlan_vid_add() which first tries via switchdev, then if that returns -EOPNOTSUPP, tries again via the VLAN RX filters in the 8021q module. But DSA doesn't distinguish between one call path and the other when calling the driver's port_vlan_add(), so if the driver returns -EOPNOTSUPP to switchdev, it also returns -EOPNOTSUPP to the 8021q module. And the latter is a hard error. port_fdb_add() is called from the deferred dsa_owq only, so obviously its return code isn't propagated anywhere, and cannot be interpreted in any way. The return code from port_mdb_add() is propagated to the bridge, but again, this doesn't do anything special when -EOPNOTSUPP is returned, but rather, br_switchdev_mdb_notify() returns void. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ea7006a7aaee54a8861e0bfd5cf6a8495fb998a7 Author: Vladimir Oltean Date: Sat Jul 16 21:53:42 2022 +0300 docs: net: dsa: re-explain what port_fdb_dump actually does Switchdev has changed radically from its initial implementation, and the currently provided definition is incorrect and very confusing. Rewrite it in light of what it actually does. Fixes: 2bedde1abbef ("net: dsa: Move FDB dump implementation inside DSA") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4e9d9bb6df6b4ef87f217e81a8eb37c359400e2e Author: Vladimir Oltean Date: Sat Jul 16 21:53:41 2022 +0300 docs: net: dsa: add a section for address databases The given definition for what VID 0 represents in the current port_fdb_add and port_mdb_add is blatantly wrong. Delete it and explain the concepts surrounding DSA's understanding of FDB isolation. Fixes: c26933639b54 ("net: dsa: request drivers to perform FDB isolation") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 7f75d3dd4f5b00a1d3ef853f044a25b4cb55082a Author: Vladimir Oltean Date: Sat Jul 16 21:53:40 2022 +0300 docs: net: dsa: delete port_mdb_dump This was deleted in 2017, stop documenting it. Fixes: dc0cbff3ff9f ("net: dsa: Remove redundant MDB dump support") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e465d507c76ce2552e1e08513f1d1ca8c4175e9c Author: Vladimir Oltean Date: Sat Jul 16 21:53:39 2022 +0300 docs: net: dsa: remove port_vlan_dump This was deleted in 2017, delete the obsolete documentation. Fixes: c069fcd82c57 ("net: dsa: Remove support for bypass bridge port attributes/vlan set") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 308362394850b680ef3e2cd548bfaa27fd120a4d Author: Vladimir Oltean Date: Sat Jul 16 21:53:38 2022 +0300 docs: net: dsa: remove port_bridge_tx_fwd_offload We've changed the API through which we can offload the bridge TX forwarding process. Update the documentation in light of the removal of 2 DSA switch ops. Fixes: b079922ba2ac ("net: dsa: add a "tx_fwd_offload" argument to ->port_bridge_join") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 0cb8682ebf5eedbfd71a8b212f23afc1aedfe1ba Author: Vladimir Oltean Date: Sat Jul 16 21:53:37 2022 +0300 docs: net: dsa: document port_fast_age The provided information about FDB flushing is not really up to date. The DSA core automatically calls port_fast_age() when necessary, and drivers should just implement that rather than hooking it to port_bridge_leave, port_stp_state_set and others. Fixes: 732f794c1baf ("net: dsa: add port fast ageing") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 3c87237ecd27fe5534f3324a4dccbce059c04e40 Author: Vladimir Oltean Date: Sat Jul 16 21:53:36 2022 +0300 docs: net: dsa: document port_setup and port_teardown These methods were added without being documented, fix that. Fixes: fd292c189a97 ("net: dsa: tear down devlink port regions when tearing down the devlink port on error") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b763f50dc157c2796dded090fac3e05cb5147348 Author: Vladimir Oltean Date: Sat Jul 16 21:53:35 2022 +0300 docs: net: dsa: document the teardown method A teardown method was added to dsa_switch_ops without being documented. Do so now. Fixes: 5e3f847a02aa ("net: dsa: Add teardown callback for drivers") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit d6a0336addd47af8869953a480e44a63726fad8f Author: Vladimir Oltean Date: Sat Jul 16 21:53:34 2022 +0300 docs: net: dsa: document change_tag_protocol Support for changing the tagging protocol was added without this operation being documented; do so now. Fixes: 53da0ebaad10 ("net: dsa: allow changing the tag protocol via the "tagging" device attribute") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c56313a42aaa0c353af6425aed63719823ccfc32 Author: Vladimir Oltean Date: Sat Jul 16 21:53:33 2022 +0300 docs: net: dsa: add more info about the other arguments to get_tag_protocol Changes were made to the prototype of get_tag_protocol without describing at a high level what they are about. Update the documentation to explain that. Fixes: 5ed4e3eb0217 ("net: dsa: Pass a port to get_tag_protocol()") Fixes: 4d776482ecc6 ("net: dsa: Get information about stacked DSA protocol") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c3f0e84d10862b2b2ed927561f12fe0bf8033590 Author: Vladimir Oltean Date: Sat Jul 16 21:53:32 2022 +0300 docs: net: dsa: rename tag_protocol to get_tag_protocol Since the blamed commit, the enum was turned into a function pointer and also renamed. Update the documentation. Fixes: 7b314362a234 ("net: dsa: Allow the DSA driver to indicate the tag protocol") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 54367831c5d0ce273d82814f5fcb35c004f6a912 Author: Vladimir Oltean Date: Sat Jul 16 21:53:31 2022 +0300 docs: net: dsa: document the shutdown behavior Document the changes that took place in the DSA core in the blamed commit. Fixes: 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 19b3b13c932fc8d613e50e3e92c1944f9fcc02c7 Author: Vladimir Oltean Date: Sat Jul 16 21:53:30 2022 +0300 docs: net: dsa: update probing documentation Since the blamed commit we don't have register_switch_driver() and unregister_switch_driver() anymore. Additionally, the expected dsa_register_switch() and dsa_unregister_switch() calls aren't documented. Update the probing section with the details of how things are currently done. Fixes: 93e86b3bc842 ("net: dsa: Remove legacy probing support") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c9f21106d97b5056f36613792fe55284a9c5f75b Merge: 1e20904e41773 021266ec640c7 Author: David S. Miller Date: Mon Jul 18 12:21:54 2022 +0100 Merge branch 'net-ipv4-sysctl-races-part-3' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Round 3). This series fixes data-races around 21 knobs after igmp_link_local_mcast_reports in ipv4_net_table. These 4 knobs are skipped because they are safe. - tcp_congestion_control: Safe with RCU and xchg(). - tcp_available_congestion_control: Read only. - tcp_allowed_congestion_control: Safe with RCU and spinlock(). - tcp_fastopen_key: Safe with RCU and xchg() So, round 4 will start with fib_multipath_use_neigh. ==================== Signed-off-by: David S. Miller commit 021266ec640c7a4527e6cd4b7349a512b351de1d Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:55 2022 -0700 tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. While reading sysctl_tcp_fastopen_blackhole_timeout, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: cf1ef3f0719b ("net/tcp_fastopen: Disable active side TFO in certain scenarios") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 5a54213318c43f4009ae158347aa6016e3b9b55a Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:54 2022 -0700 tcp: Fix data-races around sysctl_tcp_fastopen. While reading sysctl_tcp_fastopen, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 2100c8d2d9db ("net-tcp: Fast Open base") Signed-off-by: Kuniyuki Iwashima Acked-by: Yuchung Cheng Signed-off-by: David S. Miller commit 79539f34743d3e14cc1fa6577d326a82cc64d62f Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:53 2022 -0700 tcp: Fix data-races around sysctl_max_syn_backlog. While reading sysctl_max_syn_backlog, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit cbfc6495586a3f09f6f07d9fb3c7cafe807e3c55 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:52 2022 -0700 tcp: Fix a data-race around sysctl_tcp_tw_reuse. While reading sysctl_tcp_tw_reuse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 55be873695ed8912eb77ff46d1d1cadf028bd0f3 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:51 2022 -0700 tcp: Fix a data-race around sysctl_tcp_notsent_lowat. While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 39e24435a776e9de5c6dd188836cf2523547804b Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:50 2022 -0700 tcp: Fix data-races around some timeout sysctl knobs. While reading these sysctl knobs, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - tcp_retries1 - tcp_retries2 - tcp_orphan_retries - tcp_fin_timeout Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 46778cd16e6a5ad1b2e3a91f6c057c907379418e Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:49 2022 -0700 tcp: Fix data-races around sysctl_tcp_reordering. While reading sysctl_tcp_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4177f545895b1da08447a80692f30617154efa6e Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:48 2022 -0700 tcp: Fix data-races around sysctl_tcp_migrate_req. While reading sysctl_tcp_migrate_req, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: f9ac779f881c ("net: Introduce net.ipv4.tcp_migrate_req.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit f2e383b5bb6bbc60a0b94b87b3e49a2b1aefd11e Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:47 2022 -0700 tcp: Fix data-races around sysctl_tcp_syncookies. While reading sysctl_tcp_syncookies, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 20a3b1c0f603e8c55c3396abd12dfcfb523e4d3c Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:46 2022 -0700 tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. While reading sysctl_tcp_syn(ack)?_retries, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit f2f316e287e6c2e3a1c5bab8d9b77ee03daa0463 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:45 2022 -0700 tcp: Fix data-races around keepalive sysctl knobs. While reading sysctl_tcp_keepalive_(time|probes|intvl), they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8ebcc62c738f68688ee7c6fec2efe5bc6d3d7e60 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:44 2022 -0700 igmp: Fix data-races around sysctl_igmp_qrv. While reading sysctl_igmp_qrv, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next. qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv); Fixes: a9fe8e29945d ("ipv4: implement igmp_qrv sysctl to tune igmp robustness variable") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 6ae0f2e553737b8cce49a1372573c81130ffa80e Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:43 2022 -0700 igmp: Fix data-races around sysctl_igmp_max_msf. While reading sysctl_igmp_max_msf, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 6305d821e3b9b5379d348528e5b5faf316383bc2 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:42 2022 -0700 igmp: Fix a data-race around sysctl_igmp_max_memberships. While reading sysctl_igmp_max_memberships, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit f6da2267e71106474fbc0943dc24928b9cb79119 Author: Kuniyuki Iwashima Date: Fri Jul 15 10:17:41 2022 -0700 igmp: Fix data-races around sysctl_igmp_llm_reports. While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next. if (ipv4_is_local_multicast(pmc->multiaddr) && !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) Fixes: df2cf4a78e48 ("IGMP: Inhibit reports for local multicast groups") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 41ef3c1a6bb0fd4a3f81170dd17de3adbff80783 Author: Mario Limonciello Date: Wed Jul 13 12:59:50 2022 -0500 pinctrl: Don't allow PINCTRL_AMD to be a module It was observed that by allowing pinctrl_amd to be loaded later in the boot process that interrupts sent to the GPIO controller early in the boot are not serviced. The kernel treats these as a spurious IRQ and disables the IRQ. This problem was exacerbated because it happened on a system with an encrypted partition so the kernel object was not accesssible for an extended period of time while waiting for a passphrase. To avoid this situation from occurring, stop allowing pinctrl-amd from being built as a module and instead require it to be built-in or disabled. Reported-by: madcatx@atlas.cz Suggested-by: jwrdegoede@fedoraproject.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=216230 Signed-off-by: Mario Limonciello Acked-by: Hans de Goede Link: https://lore.kernel.org/r/20220713175950.964-1-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 1e20904e417738066b26490de2daf7ef3ed34483 Author: Maksym Glubokiy Date: Fri Jul 15 15:55:50 2022 +0300 net: prestera: acl: use proper mask for port selector Adjusted as per packet processor documentation. This allows to properly match 'indev' for clsact rules. Fixes: 47327e198d42 ("net: prestera: acl: migrate to new vTCAM api") Signed-off-by: Maksym Glubokiy Signed-off-by: David S. Miller commit f08d8c1bb97c48f24a82afaa2fd8c140f8d3da8b Author: Tariq Toukan Date: Fri Jul 15 11:42:16 2022 +0300 net/tls: Fix race in TLS device down flow Socket destruction flow and tls_device_down function sync against each other using tls_device_lock and the context refcount, to guarantee the device resources are freed via tls_dev_del() by the end of tls_device_down. In the following unfortunate flow, this won't happen: - refcount is decreased to zero in tls_device_sk_destruct. - tls_device_down starts, skips the context as refcount is zero, going all the way until it flushes the gc work, and returns without freeing the device resources. - only then, tls_device_queue_ctx_destruction is called, queues the gc work and frees the context's device resources. Solve it by decreasing the refcount in the socket's destruction flow under the tls_device_lock, for perfect synchronization. This does not slow down the common likely destructor flow, in which both the refcount is decreased and the spinlock is acquired, anyway. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Reviewed-by: Maxim Mikityanskiy Signed-off-by: Tariq Toukan Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 613b065ca32e90209024ec4a6bb5ca887ee70980 Author: Junxiao Chang Date: Fri Jul 15 15:47:01 2022 +0800 net: stmmac: fix dma queue left shift overflow issue When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. If CONFIG_UBSAN is enabled, kernel dumps below warning: [ 10.363842] ================================================================== [ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/ linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12 [ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' [ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg [ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021 [ 10.363958] Call Trace: [ 10.363960] [ 10.363963] dump_stack_lvl+0x4a/0x5f [ 10.363971] dump_stack+0x10/0x12 [ 10.363974] ubsan_epilogue+0x9/0x45 [ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e [ 10.363979] ? wake_up_klogd+0x4a/0x50 [ 10.363983] ? vprintk_emit+0x8f/0x240 [ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac] [ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac] [ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac] [ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac] [ 10.364030] ? page_pool_alloc_pages+0x4d/0x70 [ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac] [ 10.364042] stmmac_open+0x39e/0x920 [stmmac] [ 10.364050] __dev_open+0xf0/0x1a0 [ 10.364054] __dev_change_flags+0x188/0x1f0 [ 10.364057] dev_change_flags+0x26/0x60 [ 10.364059] do_setlink+0x908/0xc40 [ 10.364062] ? do_setlink+0xb10/0xc40 [ 10.364064] ? __nla_validate_parse+0x4c/0x1a0 [ 10.364068] __rtnl_newlink+0x597/0xa10 [ 10.364072] ? __nla_reserve+0x41/0x50 [ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0 [ 10.364079] ? pskb_expand_head+0x75/0x310 [ 10.364082] ? nla_reserve_64bit+0x21/0x40 [ 10.364086] ? skb_free_head+0x65/0x80 [ 10.364089] ? security_sock_rcv_skb+0x2c/0x50 [ 10.364094] ? __cond_resched+0x19/0x30 [ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420 [ 10.364100] rtnl_newlink+0x49/0x70 This change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue mapping warning. Fixes: d43042f4da3e ("net: stmmac: mapping mtl rx to dma channel") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216195 Reported-by: Cedric Wassenaar Signed-off-by: Junxiao Chang Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 76c16d3e19446deea98b7883f261758b96b8781a Author: Wong Vee Khee Date: Thu Jul 14 15:54:27 2022 +0800 net: stmmac: switch to use interrupt for hw crosstimestamping Using current implementation of polling mode, there is high chances we will hit into timeout error when running phc2sys. Hence, update the implementation of hardware crosstimestamping to use the MAC interrupt service routine instead of polling for TSIS bit in the MAC Timestamp Interrupt Status register to be set. Cc: Richard Cochran Signed-off-by: Wong Vee Khee Signed-off-by: David S. Miller commit ba9c4745fca70bf773b2d5c602dcd85d1a40b07a Author: Horatiu Vultur Date: Wed Jul 13 21:37:50 2022 +0200 pinctrl: ocelot: Fix pincfg The blamed commit changed to use regmaps instead of __iomem. But it didn't update the register offsets to be at word offset, so it uses byte offset. Another issue with the same commit is that it has a limit of 32 registers which is incorrect. The sparx5 has 64 while lan966x has 77. Fixes: 076d9e71bcf8 ("pinctrl: ocelot: convert pinctrl to regmap") Acked-by: Colin Foster Reviewed-by: Andy Shevchenko Signed-off-by: Horatiu Vultur Link: https://lore.kernel.org/r/20220713193750.4079621-3-horatiu.vultur@microchip.com Signed-off-by: Linus Walleij commit dc62db7138aa9365480254dda4c3e1316b1b1bbc Author: Horatiu Vultur Date: Wed Jul 13 21:37:49 2022 +0200 pinctrl: ocelot: Fix pincfg for lan966x The blamed commit introduce support for lan966x which use the same pinconf_ops as sparx5. The problem is that pinconf_ops is specific to sparx5. More precisely the offset of the bits in the pincfg register are different and also lan966x doesn't have support for PIN_CONFIG_INPUT_SCHMITT_ENABLE. Fix this by making pinconf_ops more generic such that it can be also used by lan966x. This is done by introducing 'ocelot_pincfg_data' which contains the offset and what is supported for each SOC. Fixes: 531d6ab36571 ("pinctrl: ocelot: Extend support for lan966x") Signed-off-by: Horatiu Vultur Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220713193750.4079621-2-horatiu.vultur@microchip.com Signed-off-by: Linus Walleij commit dbd0da2453c694f2f74651834d90fb280b57f151 Author: Christian König Date: Fri Jul 15 09:57:22 2022 +0200 drm/ttm: fix locking in vmap/vunmap TTM GEM helpers I've stumbled over this while reviewing patches for DMA-buf and it looks like we completely messed the locking up here. In general most TTM function should only be called while holding the appropriate BO resv lock. Without this we could break the internal buffer object state here. Only compile tested! Signed-off-by: Christian König Fixes: 43676605f890 ("drm/ttm: Add vmap/vunmap to TTM and TTM GEM helpers") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20220715111533.467012-1-christian.koenig@amd.com commit ef0324b6415db6742bd632dc0dfbb8fbc111473b Author: Michael Walle Date: Sat Mar 26 20:40:28 2022 +0100 ARM: dts: lan966x: fix sys_clk frequency The sys_clk frequency is 165.625MHz. The register reference of the Generic Clock controller lists the CPU clock as 600MHz, the DDR clock as 300MHz and the SYS clock as 162.5MHz. This is wrong. It was first noticed during the fan driver development and it was measured and verified via the CLK_MON output of the SoC which can be configured to output sys_clk/64. The core PLL settings (which drives the SYS clock) seems to be as follows: DIVF = 52 DIVQ = 3 DIVR = 1 With a refernce clock of 25MHz, this means we have a post divider clock Fpfd = Fref / (DIVR + 1) = 25MHz / (1 + 1) = 12.5MHz The resulting VCO frequency is then Fvco = Fpfd * (DIVF + 1) * 2 = 12.5MHz * (52 + 1) * 2 = 1325MHz And the output frequency is Fout = Fvco / 2^DIVQ = 1325MHz / 2^3 = 165.625Mhz This all adds up to the constrains of the PLL: 10MHz <= Fpfd <= 200MHz 20MHz <= Fout <= 1000MHz 1000MHz <= Fvco <= 2000MHz Fixes: 290deaa10c50 ("ARM: dts: add DT for lan966 SoC and 2-port board pcb8291") Signed-off-by: Michael Walle Reviewed-by: Kavyasree Kotagiri Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220326194028.2945985-1-michael@walle.cc commit ff6992735ade75aae3e35d16b17da1008d753d28 Author: Linus Torvalds Date: Sun Jul 17 13:30:22 2022 -0700 Linux 5.19-rc7 commit 55ea9bd666887ed4159df38d1494c204246cf2bc Merge: f7f4da303dd89 ced7866db39fc Author: Linus Torvalds Date: Sun Jul 17 13:08:03 2022 -0700 Merge tag 'drm-intel-fixes-2022-07-17' of git://anongit.freedesktop.org/drm/drm-intel Pull intel drm build fix from Rodrigo Vivi: "Our 'dim' flow has a problem with fixes of fixes getting missed. We need to take a look on that later. Meanwhile, please allow me to quickly propagate this fix for the 32-bit build issue here upstream" * tag 'drm-intel-fixes-2022-07-17' of git://anongit.freedesktop.org/drm/drm-intel: drm/i915/ttm: fix 32b build commit f7f4da303dd8946228860e78bd7f36c2cc47a636 Merge: 2b18593e4b9f5 4b335e1e0d6f8 Author: Linus Torvalds Date: Sun Jul 17 12:42:57 2022 -0700 Merge tag 'perf-tools-fixes-for-v5.19-2022-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix SIGSEGV when processing syscall args in perf.data files in 'perf trace' - Sync kvm, msr-index and cpufeatures headers with the kernel sources - Fix 'convert perf time to TSC' 'perf test': - No need to open events twice - Fix finding correct event on hybrid systems * tag 'perf-tools-fixes-for-v5.19-2022-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf trace: Fix SIGSEGV when processing syscall args perf tests: Fix Convert perf time to TSC test for hybrid perf tests: Stop Convert perf time to TSC test opening events twice tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources commit ced7866db39fc5c59ee05e154d4abc0977a17f6b Author: Matthew Auld Date: Tue Jul 12 18:40:50 2022 +0100 drm/i915/ttm: fix 32b build Since segment_pages is no longer a compile time constant, it looks the DIV_ROUND_UP(node->size, segment_pages) breaks the 32b build. Simplest is just to use the ULL variant, but really we should need not need more than u32 for the page alignment (also we are limited by that due to the sg->length type), so also make it all u32. Reported-by: Ville Syrjälä Fixes: aff1e0b09b54 ("drm/i915/ttm: fix sg_table construction") Signed-off-by: Matthew Auld Cc: Nirmoy Das Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20220712174050.592550-1-matthew.auld@intel.com (cherry picked from commit 9306b2b2dfce6931241ef804783692cee526599c) Signed-off-by: Rodrigo Vivi commit 2b18593e4b9f5781a7683fca256036515bd9b946 Merge: 59c80f053d504 68e3c69803dad Author: Linus Torvalds Date: Sun Jul 17 08:34:02 2022 -0700 Merge tag 'perf_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - A single data race fix on the perf event cleanup path to avoid endless loops due to insufficient locking * tag 'perf_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() commit 59c80f053d50467758c8284348b463fa820b1b1f Merge: 2eccaca7b62b2 bcf163150cd37 Author: Linus Torvalds Date: Sun Jul 17 08:27:30 2022 -0700 Merge tag 'x86_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Improve the check whether the kernel supports WP mappings so that it can accomodate a XenPV guest due to how the latter is setting up the PAT machinery - Now that the retbleed nightmare is public, here's the first round of fallout fixes: * Fix a build failure on 32-bit due to missing include * Remove an untraining point in espfix64 return path * other small cleanups * tag 'x86_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Remove apostrophe typo um: Add missing apply_returns() x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt x86/bugs: Mark retbleed_strings static x86/pat: Fix x86_has_pat_wp() x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit commit 2eccaca7b62b2836260c6fb22156a44e3d99a74a Merge: 8ad4b6fa0f874 7329b07172964 Author: Linus Torvalds Date: Sun Jul 17 07:58:19 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - fix a configfs attribute of the gpio-sim module * tag 'gpio-fixes-for-v5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sim: fix the chip_name configfs item commit 8ad4b6fa0f874ec8ec6e92a90116e3ab43cded6c Merge: 396df7005ba0f 2a96271fb66c4 Author: Linus Torvalds Date: Sun Jul 17 07:52:46 2022 -0700 Merge tag 'input-for-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - fix Goodix driver to properly behave on the Aya Neo Next - some more sanity checks in usbtouchscreen driver - a tweak in wm97xx driver in preparation for remove() to return void - a clarification in input core regarding units of measurement for resolution on touch events. * tag 'input-for-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: document the units for resolution of size axes Input: goodix - call acpi_device_fix_up_power() in some cases Input: wm97xx - make .remove() obviously always return 0 Input: usbtouchscreen - add driver_info sanity check commit 396df7005ba0f02646e96e05456a14b52e0f02f4 Merge: 972a278fe60c3 093d27bb6f2d1 Author: Linus Torvalds Date: Sun Jul 17 07:45:51 2022 -0700 Merge tag 'for-v5.19-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: - power-supply core temperature interpolation regression fix for incorrect boundaries - ab8500 needs to destroy its work queues in error paths - Fix old DT refcount leak in arm-versatile * tag 'for-v5.19-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: core: Fix boundary conditions in interpolation power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe power: supply: ab8500_fg: add missing destroy_workqueue in ab8500_fg_probe commit 4b335e1e0d6f8fa91dac615a44b123c9f26e93d3 Author: Naveen N. Rao Date: Thu Jul 7 14:39:00 2022 +0530 perf trace: Fix SIGSEGV when processing syscall args On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to process a perf.data file created with 'perf trace record -p': #0 0x00000001225b8988 in syscall_arg__scnprintf_augmented_string at builtin-trace.c:1492 #1 syscall_arg__scnprintf_filename at builtin-trace.c:1492 #2 syscall_arg__scnprintf_filename at builtin-trace.c:1486 #3 0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val at builtin-trace.c:1973 #4 syscall__scnprintf_args at builtin-trace.c:2041 #5 0x00000001225bff04 in trace__sys_enter at builtin-trace.c:2319 That points to the below code in tools/perf/builtin-trace.c: /* * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible * arguments, even if the syscall being handled, say "openat", uses only 4 arguments * this breaks syscall__augmented_args() check for augmented args, as we calculate * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, * so when handling, say the openat syscall, we end up getting 6 args for the * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly * thinking that the extra 2 u64 args are the augmented filename, so just check * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. */ if (evsel != trace->syscalls.events.sys_enter) augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); As the comment points out, we should not be trying to augment the args for raw_syscalls. However, when processing a perf.data file, we are not initializing those properly. Fix the same. Reported-by: Claudio Carvalho Signed-off-by: Naveen N. Rao Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20220707090900.572584-1-naveen.n.rao@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit deb44a6249f696106645c63c0603eab08a6122af Author: Adrian Hunter Date: Wed Jul 13 15:34:59 2022 +0300 perf tests: Fix Convert perf time to TSC test for hybrid The test does not always correctly determine the number of events for hybrids, nor allow for more than 1 evsel when parsing. Fix by iterating the events actually created and getting the correct evsel for the events processed. Fixes: d9da6f70eb235110 ("perf tests: Support 'Convert perf time to TSC' test for hybrid") Reviewed-by: Kan Liang Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Namhyung Kim Cc: Thomas Richter Link: https://lore.kernel.org/r/20220713123459.24145-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 498c7a54f169b2699104d3060604d840424f15d2 Author: Adrian Hunter Date: Wed Jul 13 15:34:58 2022 +0300 perf tests: Stop Convert perf time to TSC test opening events twice Do not call evlist__open() twice. Fixes: 5bb017d4b97a0f13 ("perf test: Fix error message for test case 71 on s390, where it is not supported") Reviewed-by: Kan Liang Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Thomas Richter Link: https://lore.kernel.org/r/20220713123459.24145-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 91d248c3b903b46a58cbc7e8d38d684d3e4007c2 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:32:18 2021 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 4ad3278df6fe2b08 ("x86/speculation: Disable RRSBA behavior") d7caac991feeef1b ("x86/cpu/amd: Add Spectral Chicken") That cause no changes to tooling: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after $ Just silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Pawan Gupta Cc: Peter Zijlstra Link: https://lore.kernel.org/lkml/YtQTm9wsB3hxQWvy@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f098addbdb44c8a565367f5162f3ab170ed9404a Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: f43b9876e857c739 ("x86/retbleed: Add fine grained Kconfig knobs") a149180fbcf336e9 ("x86: Add magic AMD return-thunk") 15e67227c49a5783 ("x86: Undo return-thunk damage") 369ae6ffc41a3c11 ("x86/retpoline: Cleanup some #ifdefery") 4ad3278df6fe2b08 x86/speculation: Disable RRSBA behavior 26aae8ccbc197223 x86/cpu/amd: Enumerate BTC_NO 9756bba28470722d x86/speculation: Fill RSB on vmexit for IBRS 3ebc170068885b6f x86/bugs: Add retbleed=ibpb 2dbb887e875b1de3 x86/entry: Add kernel IBRS implementation 6b80b59b35557065 x86/bugs: Report AMD retbleed vulnerability a149180fbcf336e9 x86: Add magic AMD return-thunk 15e67227c49a5783 x86: Undo return-thunk damage a883d624aed463c8 x86/cpufeatures: Move RETPOLINE flags to word 11 51802186158c74a0 x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra commit eee51fe38e372b89317f3950d2dc3e3ea7bace12 Author: Arnaldo Carvalho de Melo Date: Sun May 9 09:39:02 2021 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: 1b870fa5573e260b ("kvm: stats: tell userspace which values are boolean") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This is also by now used by tools/testing/selftests/kvm/, a simple test build succeeded. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/YtQLDvQrBhJNl3n5@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 972a278fe60c361eb8f37619f562f092e8786d7c Merge: c5fe7a97f20c7 088aea3b97e0a Author: Linus Torvalds Date: Sat Jul 16 13:48:55 2022 -0700 Merge tag 'for-5.19-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs reverts from David Sterba: "Due to a recent report [1] we need to revert the radix tree to xarray conversion patches. There's a problem with sleeping under spinlock, when xa_insert could allocate memory under pressure. We use GFP_NOFS so this is a real problem that we unfortunately did not discover during review. I'm sorry to do such change at rc6 time but the revert is IMO the safer option, there are patches to use mutex instead of the spin locks but that would need more testing. The revert branch has been tested on a few setups, all seem ok. The conversion to xarray will be revisited in the future" Link: https://lore.kernel.org/linux-btrfs/cover.1657097693.git.fdmanana@suse.com/ [1] * tag 'for-5.19-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Revert "btrfs: turn delayed_nodes_tree into an XArray" Revert "btrfs: turn name_cache radix tree into XArray in send_ctx" Revert "btrfs: turn fs_info member buffer_radix into XArray" Revert "btrfs: turn fs_roots_radix in btrfs_fs_info into an XArray" commit c5fe7a97f20c7f3070ac870144515c0fabc6b999 Merge: 6bca047ecd675 355bf2e036c95 Author: Linus Torvalds Date: Sat Jul 16 11:45:40 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Six small and reasonably obvious fixes, all in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pm80xx: Set stopped phy's linkrate to Disabled scsi: pm80xx: Fix 'Unknown' max/min linkrate scsi: ufs: core: Fix missing clk change notification on host reset scsi: ufs: core: Drop loglevel of WriteBoost message scsi: megaraid: Clear READ queue map's nr_queues scsi: target: Fix WRITE_SAME No Data Buffer crash commit 6bca047ecd675325eca4bc0753ef91864954bd3d Merge: 9ed714dbd5746 957a2b345cbcf Author: Linus Torvalds Date: Sat Jul 16 11:40:10 2022 -0700 Merge tag 'block-5.19-2022-07-15' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Two NVMe fixes, and a regression fix for the core block layer from this merge window" * tag 'block-5.19-2022-07-15' of git://git.kernel.dk/linux-block: block: fix missing blkcg_bio_issue_init nvme: fix block device naming collision nvme-pci: fix freeze accounting for error handling commit 9ed714dbd574663c1fcb01dde07e949fe7473fa8 Merge: 8c91723ac9c60 3486af89dd3c0 Author: Linus Torvalds Date: Sat Jul 16 11:21:15 2022 -0700 Merge tag 'usb-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 5.19-rc7. They include: - new usb-serial driver ids - typec uevent fix - uvc gadget driver fix - dwc3 driver fixes - ehci-fsl driver fix All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: ftdi_sio: add Belimo device ids drivers/usb/host/ehci-fsl: Fix interrupt setup in host mode. usb: gadget: uvc: fix changing interface name via configfs usb: typec: add missing uevent when partner support PD usb: dwc3-am62: remove unnecesary clk_put() usb: dwc3: gadget: Fix event pending check commit 8c91723ac9c60840e3a9819e5f767af3e7ca2660 Merge: c658cabbfd325 a501ab75e7624 Author: Linus Torvalds Date: Sat Jul 16 11:11:56 2022 -0700 Merge tag 'tty-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty and serial driver fixes from Greg KH: "Here are some TTY and Serial driver fixes for 5.19-rc7. They resolve a number of reported problems including: - longtime bug in pty_write() that has been reported in the past. - 8250 driver fixes - new serial device ids - vt overlapping data copy bugfix - other tiny serial driver bugfixes All of these have been in linux-next for a while with no reported problems" * tag 'tty-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() serial: 8250: dw: Fix the macro RZN1_UART_xDMACR_8_WORD_BURST vt: fix memory overlapping when deleting chars in the buffer serial: mvebu-uart: correctly report configured baudrate value serial: 8250: Fix PM usage_count for console handover serial: 8250: fix return error code in serial8250_request_std_resource() serial: stm32: Clear prev values before setting RTS delays tty: Add N_CAN327 line discipline ID for ELM327 based CAN driver serial: 8250: Fix __stop_tx() & DMA Tx restart races serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle tty: serial: samsung_tty: set dma burst_size to 1 serial: 8250: dw: enable using pdata with ACPI commit c658cabbfd32527060c2367f405bafb4e5815c6e Merge: ab6efe68a7367 2f23256c0ea20 Author: Linus Torvalds Date: Sat Jul 16 11:00:40 2022 -0700 Merge tag 's390-5.19-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix building of out-of-tree kernel modules without a pre-built kernel in case CONFIG_EXPOLINE_EXTERN=y. - Fix a reference counting error that could prevent unloading of zcrypt modules. * tag 's390-5.19-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ap: fix error handling in __verify_queue_reservations() s390/nospec: remove unneeded header includes s390/nospec: build expoline.o for modules_prepare target commit ab6efe68a736748cf922a7641751583a3c783cb1 Merge: 16c957f089d52 5a5adb1528e59 Author: Linus Torvalds Date: Sat Jul 16 10:56:28 2022 -0700 Merge tag 'pm-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki "Fix recent regression in the cpufreq mediatek driver related to incorrect handling of regulator_get_optional() return value (AngeloGioacchino Del Regno)" * tag 'pm-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: mediatek: Handle sram regulator probe deferral commit 16c957f089d520893b0b08e06641329fbcec492d Merge: be9b7b6acfeae fbd74d16890b9 Author: Linus Torvalds Date: Sat Jul 16 10:52:41 2022 -0700 Merge tag 'acpi-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix more fallout from recent changes of the ACPI CPPC handling on AMD platforms (Mario Limonciello)" * tag 'acpi-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: CPPC: Fix enabling CPPC on AMD systems with shared memory commit be9b7b6acfeae47778f829d9d176ab1f9269593e Merge: 829d680e82a96 1ac8ec2731a5a Author: Linus Torvalds Date: Sat Jul 16 10:46:03 2022 -0700 Merge tag 'printk-for-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Make pr_flush() fast when consoles are suspended. * tag 'printk-for-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: do not wait for consoles when suspended commit 829d680e82a961c5370d9636130b43009ac36eb8 Author: Jason A. Donenfeld Date: Wed Jul 13 17:11:15 2022 +0200 random: cap jitter samples per bit to factor of HZ Currently the jitter mechanism will require two timer ticks per iteration, and it requires N iterations per bit. This N is determined with a small measurement, and if it's too big, it won't waste time with jitter entropy because it'd take too long or not have sufficient entropy anyway. With the current max N of 32, there are large timeouts on systems with a small CONFIG_HZ. Rather than set that maximum to 32, instead choose a factor of CONFIG_HZ. In this case, 1/30 seems to yield sane values for different configurations of CONFIG_HZ. Reported-by: Vladimir Murzin Fixes: 78c768e619fb ("random: vary jitter iterations based on cycle counter speed") Signed-off-by: Jason A. Donenfeld Tested-by: Vladimir Murzin Signed-off-by: Linus Torvalds commit 51a6fa0732d6be6a44e0032752ad2ac10d67c796 Author: Thadeu Lima de Souza Cascardo Date: Fri Jul 15 16:45:50 2022 -0300 efi/x86: use naked RET on mixed mode call wrapper When running with return thunks enabled under 32-bit EFI, the system crashes with: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: 000000005bc02900 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0011) - permissions violation PGD 18f7063 P4D 18f7063 PUD 18ff063 PMD 190e063 PTE 800000005bc02063 Oops: 0011 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc6+ #166 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:0x5bc02900 Code: Unable to access opcode bytes at RIP 0x5bc028d6. RSP: 0018:ffffffffb3203e10 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000048 RDX: 000000000190dfac RSI: 0000000000001710 RDI: 000000007eae823b RBP: ffffffffb3203e70 R08: 0000000001970000 R09: ffffffffb3203e28 R10: 747563657865206c R11: 6c6977203a696665 R12: 0000000000001710 R13: 0000000000000030 R14: 0000000001970000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8e013ca00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 0000000080050033 CR2: 000000005bc02900 CR3: 0000000001930000 CR4: 00000000000006f0 Call Trace: ? efi_set_virtual_address_map+0x9c/0x175 efi_enter_virtual_mode+0x4a6/0x53e start_kernel+0x67c/0x71e x86_64_start_reservations+0x24/0x2a x86_64_start_kernel+0xe9/0xf4 secondary_startup_64_no_verify+0xe5/0xeb That's because it cannot jump to the return thunk from the 32-bit code. Using a naked RET and marking it as safe allows the system to proceed booting. Fixes: aa3d480315ba ("x86: Use return-thunk in asm code") Reported-by: Guenter Roeck Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Peter Zijlstra (Intel) Cc: Borislav Petkov Cc: Josh Poimboeuf Cc: Tested-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 4ca8ca873d454635c20d508261bfc0081af75cf8 Author: Robert Hancock Date: Tue Jun 14 17:29:19 2022 -0600 i2c: cadence: Change large transfer count reset logic to be unconditional Problems were observed on the Xilinx ZynqMP platform with large I2C reads. When a read of 277 bytes was performed, the controller NAKed the transfer after only 252 bytes were transferred and returned an ENXIO error on the transfer. There is some code in cdns_i2c_master_isr to handle this case by resetting the transfer count in the controller before it reaches 0, to allow larger transfers to work, but it was conditional on the CDNS_I2C_BROKEN_HOLD_BIT quirk being set on the controller, and ZynqMP uses the r1p14 version of the core where this quirk is not being set. The requirement to do this to support larger reads seems like an inherently required workaround due to the core only having an 8-bit transfer size register, so it does not appear that this should be conditional on the broken HOLD bit quirk which is used elsewhere in the driver. Remove the dependency on the CDNS_I2C_BROKEN_HOLD_BIT for this transfer size reset logic to fix this problem. Fixes: 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq Ultrascale+ MPSoC") Signed-off-by: Robert Hancock Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit 824a826e2e767ae1051a4c5c8ea44ec7a0c1dd26 Author: Flavio Suligoi Date: Fri Jul 15 15:42:18 2022 +0200 i2c: imx: fix typo in comment to provid --> to provide Signed-off-by: Flavio Suligoi Acked-by: Oleksij Rempel Signed-off-by: Wolfram Sang commit e1f77ecc75aaee6bed04e8fd7830e00032af012e Author: Vadim Pasternak Date: Wed Jul 13 12:14:05 2022 +0300 i2c: mlxcpld: Fix register setting for 400KHz frequency Fix setting of 'Half Cycle' register for 400KHz frequency. Fixes: fa1049135c15 ("i2c: mlxcpld: Modify register setting for 400KHz frequency") Signed-off-by: Vadim Pasternak Signed-off-by: Wolfram Sang commit bcf163150cd37348a0cb59e95c916a83a9344b0e Author: Kim Phillips Date: Fri Jul 8 16:21:28 2022 -0500 x86/bugs: Remove apostrophe typo Remove a superfluous ' in the mitigation string. Fixes: e8ec1b6e08a2 ("x86/bugs: Enable STIBP for JMP2RET") Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov commit 11052589cf5c0bab3b4884d423d5f60c38fcf25d Author: Kuniyuki Iwashima Date: Wed Jul 13 10:52:07 2022 -0700 tcp/udp: Make early_demux back namespacified. Commit e21145a9871a ("ipv4: namespacify ip_early_demux sysctl knob") made it possible to enable/disable early_demux on a per-netns basis. Then, we introduced two knobs, tcp_early_demux and udp_early_demux, to switch it for TCP/UDP in commit dddb64bcb346 ("net: Add sysctl to toggle early demux for tcp and udp"). However, the .proc_handler() was wrong and actually disabled us from changing the behaviour in each netns. We can execute early_demux if net.ipv4.ip_early_demux is on and each proto .early_demux() handler is not NULL. When we toggle (tcp|udp)_early_demux, the change itself is saved in each netns variable, but the .early_demux() handler is a global variable, so the handler is switched based on the init_net's sysctl variable. Thus, netns (tcp|udp)_early_demux knobs have nothing to do with the logic. Whether we CAN execute proto .early_demux() is always decided by init_net's sysctl knob, and whether we DO it or not is by each netns ip_early_demux knob. This patch namespacifies (tcp|udp)_early_demux again. For now, the users of the .early_demux() handler are TCP and UDP only, and they are called directly to avoid retpoline. So, we can remove the .early_demux() handler from inet6?_protos and need not dereference them in ip6?_rcv_finish_core(). If another proto needs .early_demux(), we can restore it at that time. Fixes: dddb64bcb346 ("net: Add sysctl to toggle early demux for tcp and udp") Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20220713175207.7727-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit df254d4508f96f298be8aff08da4d7e33d8584a0 Merge: a14bd7475452c 7c1ddcee5311f Author: Jakub Kicinski Date: Fri Jul 15 16:45:29 2022 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-07-14 This series contains updates to e1000e and igc drivers. Sasha re-enables GPT clock when exiting s0ix to prevent hardware unit hang and reverts a workaround for this issue on e1000e. Lennert Buytenhek restores checks for removed device while accessing registers to prevent NULL pointer dereferences for igc. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: Reinstate IGC_REMOVED logic and implement it properly Revert "e1000e: Fix possible HW unit hang after an s0ix exit" e1000e: Enable GPT clock before sending message to CSME ==================== Link: https://lore.kernel.org/r/20220714175857.933537-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit a14bd7475452c51835dd5a0cee4c8fa48dd0b539 Author: Liang He Date: Thu Jul 14 23:31:38 2022 +0800 net: dsa: microchip: ksz_common: Fix refcount leak bug In ksz_switch_register(), we should call of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 912aae27c6af ("net: dsa: microchip: really look for phy-mode in port nodes") Signed-off-by: Liang He Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220714153138.375919-1-windhl@126.com Signed-off-by: Jakub Kicinski commit 9b59ec8d50a1f28747ceff9a4f39af5deba9540e Merge: a8ebfcd33caf2 7fccd72391270 Author: Linus Torvalds Date: Fri Jul 15 10:40:50 2022 -0700 Merge tag 'riscv-for-linus-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix to avoid printing a warning when modules do not exercise any errata-dependent behavior and the SiFive errata are enabled. - A fix to the Microchip PFSOC to attach the L2 cache to the CPU nodes. * tag 'riscv-for-linus-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: don't warn for sifive erratas in modules riscv: dts: microchip: hook up the mpfs' l2cache commit a8ebfcd33caf29592957229c8350f67b48b8efce Merge: 1ce9d792e8ef2 79629181607e8 Author: Linus Torvalds Date: Fri Jul 15 10:31:46 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "RISC-V: - Fix missing PAGE_PFN_MASK - Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests() x86: - Fix for nested virtualization when TSC scaling is active - Estimate the size of fastcc subroutines conservatively, avoiding disastrous underestimation when return thunks are enabled - Avoid possible use of uninitialized fields of 'struct kvm_lapic_irq' Generic: - Mark as such the boolean values available from the statistics file descriptors - Clarify statistics documentation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: emulate: do not adjust size of fastop and setcc subroutines KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() Documentation: kvm: clarify histogram units kvm: stats: tell userspace which values are boolean x86/kvm: fix FASTOP_SIZE when return thunks are enabled KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 RISC-V: KVM: Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests() riscv: Fix missing PAGE_PFN_MASK commit 1ce9d792e8ef286ed03b151b9bdfcd921e04a988 Merge: 8006112d6c413 fac47b43c760e Author: Linus Torvalds Date: Fri Jul 15 10:27:28 2022 -0700 Merge tag 'ceph-for-5.19-rc7' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A folio locking fixup that Xiubo and David cooperated on, marked for stable. Most of it is in netfs but I picked it up into ceph tree on agreement with David" * tag 'ceph-for-5.19-rc7' of https://github.com/ceph/ceph-client: netfs: do not unlock and put the folio twice commit 8006112d6c4137bc48ca723261198c63d9e6d38a Merge: 1c49f281c9b78 73d5fe0462702 Author: Linus Torvalds Date: Fri Jul 15 10:23:43 2022 -0700 Merge tag 'spi-fix-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few driver specific fixes, none especially remarkable, plus a MAINTAINERS file update due to the previous maintainer for the NXP FSPI driver having left the company" * tag 'spi-fix-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Remove spi_master_put() in probe failure path MAINTAINERS: change the NXP FSPI driver maintainer. spi: amd: Limit max transfer and message size spi: aspeed: Fix division by zero spi: aspeed: Add dev_dbg() to dump the spi-mem direct mapping descriptor commit 1c49f281c9b78da9c0f0d7a8965c26fb46e71a53 Merge: 2a347a06ebb1b d332a1f6b4c4b Author: Linus Torvalds Date: Fri Jul 15 10:16:44 2022 -0700 Merge tag 'soc-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Most of the contents are bugfixes for the devicetree files: - A Qualcomm MSM8974 pin controller regression, caused by a cleanup patch that gets partially reverted here. - Missing properties for Broadcom BCM49xx to fix timer detection and SMP boot. - Fix touchscreen pinctrl for imx6ull-colibri board - Multiple fixes for Rockchip rk3399 based machines including the vdu clock-rate fix, otg port fix on Quartz64-A and ethernet on Quartz64-B - Fixes for misspelled DT contents causing minor problems on imx6qdl-ts7970m, orangepi-zero, sama5d2, kontron-kswitch-d10, and ls1028a And a couple of changes elsewhere: - Fix binding for Allwinner D1 display pipeline - Trivial code fixes to the TEE and reset controller driver subsystems and the rockchip platform code. - Multiple updates to the MAINTAINERS files, marking the Palm Treo support as orphaned, and fixing some entries for added or changed file names" * tag 'soc-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits) arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero ARM: dts: at91: sama5d2: Fix typo in i2s1 node tee: tee_get_drvdata(): fix description of return value optee: Remove duplicate 'of' in two places. ARM: dts: kswitch-d10: use open drain mode for coma-mode pins ARM: dts: colibri-imx6ull: fix snvs pinmux group optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR() MAINTAINERS: add polarfire rng, pci and clock drivers MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count arm64: dts: ls1028a: Update SFP node to include clock dt-bindings: display: sun4i: Fix D1 pipeline count ARM: dts: qcom: msm8974: re-add missing pinctrl reset: Fix devm bulk optional exclusive control getter MAINTAINERS: rectify entry for SYNOPSYS AXS10x RESET CONTROLLER DRIVER ARM: rockchip: Add missing of_node_put() in rockchip_suspend_init() arm64: dts: rockchip: Assign RK3399 VDU clock rate arm64: dts: rockchip: Fix Quartz64-A dwc3 otg port behavior ... commit 088aea3b97e0ae5a2a86f5d142ad10fec8a1b80f Author: David Sterba Date: Fri Jul 15 13:59:45 2022 +0200 Revert "btrfs: turn delayed_nodes_tree into an XArray" This reverts commit 253bf57555e451dec5a7f09dc95d380ce8b10e5b. Revert the xarray conversion, there's a problem with potential sleep-inside-spinlock [1] when calling xa_insert that triggers GFP_NOFS allocation. The radix tree used the preloading mechanism to avoid sleeping but this is not available in xarray. Conversion from spin lock to mutex is possible but at time of rc6 is riskier than a clean revert. [1] https://lore.kernel.org/linux-btrfs/cover.1657097693.git.fdmanana@suse.com/ Reported-by: Filipe Manana Signed-off-by: David Sterba commit 5b8418b84303d9a0a0f7f28d6eaed915247ebdc3 Author: David Sterba Date: Fri Jul 15 13:59:38 2022 +0200 Revert "btrfs: turn name_cache radix tree into XArray in send_ctx" This reverts commit 4076942021fe14efecae33bf98566df6dd5ae6f7. Revert the xarray conversion, there's a problem with potential sleep-inside-spinlock [1] when calling xa_insert that triggers GFP_NOFS allocation. The radix tree used the preloading mechanism to avoid sleeping but this is not available in xarray. Conversion from spin lock to mutex is possible but at time of rc6 is riskier than a clean revert. [1] https://lore.kernel.org/linux-btrfs/cover.1657097693.git.fdmanana@suse.com/ Reported-by: Filipe Manana Signed-off-by: David Sterba commit 01cd390903e00c8f42ba0e84f25a70e3d613a15c Author: David Sterba Date: Fri Jul 15 13:59:31 2022 +0200 Revert "btrfs: turn fs_info member buffer_radix into XArray" This reverts commit 8ee922689d67b7cfa6acbe2aa1ee76ac72e6fc8a. Revert the xarray conversion, there's a problem with potential sleep-inside-spinlock [1] when calling xa_insert that triggers GFP_NOFS allocation. The radix tree used the preloading mechanism to avoid sleeping but this is not available in xarray. Conversion from spin lock to mutex is possible but at time of rc6 is riskier than a clean revert. [1] https://lore.kernel.org/linux-btrfs/cover.1657097693.git.fdmanana@suse.com/ Reported-by: Filipe Manana Signed-off-by: David Sterba commit fc7cbcd4890e297de5d6487e04344a99b39de9be Author: David Sterba Date: Fri Jul 15 13:59:21 2022 +0200 Revert "btrfs: turn fs_roots_radix in btrfs_fs_info into an XArray" This reverts commit 48b36a602a335c184505346b5b37077840660634. Revert the xarray conversion, there's a problem with potential sleep-inside-spinlock [1] when calling xa_insert that triggers GFP_NOFS allocation. The radix tree used the preloading mechanism to avoid sleeping but this is not available in xarray. Conversion from spin lock to mutex is possible but at time of rc6 is riskier than a clean revert. [1] https://lore.kernel.org/linux-btrfs/cover.1657097693.git.fdmanana@suse.com/ Reported-by: Filipe Manana Signed-off-by: David Sterba commit 2a347a06ebb1b186a5cb919c9f5ab6e040554be7 Merge: 339f74e38f53c 5ad26161a371e Author: Linus Torvalds Date: Fri Jul 15 10:12:22 2022 -0700 Merge tag 'platform-drivers-x86-v5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Highlights: - Fix brightness key events getting reported twice on some Dells. Regression caused by recent Panasonic hotkey fixes - Fix poweroff no longer working on some devices regression caused by recent poweroff handler rework - Mark new (in 5.19) Intel IFS driver as broken, because of some issues surrounding the userspace (sysfs) API which need to be cleared up - Some hardware-id / quirk additions" * tag 'platform-drivers-x86-v5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: ACPI: video: Fix acpi_video_handles_brightness_key_presses() platform/x86: intel_atomisp2_led: Also turn off the always-on camera LED on the Asus T100TAF platform/x86/intel/ifs: Mark as BROKEN platform/x86: asus-wmi: Add key mappings efi: Fix efi_power_off() not being run before acpi_power_off() when necessary platform/x86: x86-android-tablets: Fix Lenovo Yoga Tablet 2 830/1050 poweroff again platform/x86: gigabyte-wmi: add support for B660I AORUS PRO DDR4 platform/x86/amd/pmc: Add new platform support platform/x86/amd/pmc: Add new acpi id for PMC controller commit 339f74e38f53c83b5715abd28f7002b66731d917 Merge: fcd1b2b9c7b08 166d386323166 Author: Linus Torvalds Date: Fri Jul 15 10:00:49 2022 -0700 Merge tag 'for-linus-5.19a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "Fix for the Xen gntdev driver causing inappropriate WARN() messages" * tag 'for-linus-5.19a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE commit fcd1b2b9c7b085e9c200f73c079b322eb8c666f9 Merge: 862161e8af0db 093f8d8f10aa2 Author: Linus Torvalds Date: Fri Jul 15 09:56:24 2022 -0700 Merge tag 'drm-fixes-2022-07-15' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This is the regular fixes pull for this week. This has a bunch of amdgpu fixes, major one reverts the buddy allocator until it can be tested more, otherwise just small ones, then i915 has a bunch of fixes. The outstanding firmware regressions reported by phoronix will hopefully be dealt with ASAP. amdgpu: - revert buddy allocator support for now - DP MST blank screen fix for specific platforms - MEC firmware check fix for GC 10.3.7 - Deep color fix for DCE - Fix possible divide by 0 - Coverage blend mode fix - Fix cursor only commit timestamps i915: - Selftest fix - TTM fix sg_table construction - Error return fixes - Fix a performance regression related to waitboost - Fix GT resets" * tag 'drm-fixes-2022-07-15' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Ensure valid event timestamp for cursor-only commits drm/amd/display: correct check of coverage blend mode drm/amd/pm: Prevent divide by zero drm/amd/display: Only use depth 36 bpp linebuffers on DCN display engines. drm/amdkfd: correct the MEC atomic support firmware checking for GC 10.3.7 drm/amd/display: Ignore First MST Sideband Message Return Error drm/i915/selftests: fix subtraction overflow bug drm/i915/gem: Look for waitboosting across the whole object prior to individual waits drm/i915/gt: Serialize TLB invalidates with GT resets drm/i915/gt: Serialize GRDOM access between multiple engine resets drm/i915/ttm: fix sg_table construction drm/i915/selftests: fix a couple IS_ERR() vs NULL tests drm/i915: Fix vm use-after-free in vma destruction drm/i915/guc: ADL-N should use the same GuC FW as ADL-S drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() drm/i915/gvt: IS_ERR() vs NULL bug in intel_gvt_update_reg_whitelist() Revert "drm/amdgpu: add drm buddy support to amdgpu" commit 862161e8af0db1b725c6ad5fd93aa636125f3db5 Merge: e5d523f1ae8f2 43b5240ca6b33 Author: Linus Torvalds Date: Fri Jul 15 09:52:35 2022 -0700 Merge tag 'sysctl-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pyll sysctl fix from Luis Chamberlain: "Only one fix for sysctl" * tag 'sysctl-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE commit 0fddf9ad06fd9f439f137139861556671673e31c Author: Sascha Hauer Date: Fri Jul 1 13:03:41 2022 +0200 mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times 06781a5026350 Fixes the calculation of the DEVICE_BUSY_TIMEOUT register value from busy_timeout_cycles. busy_timeout_cycles is calculated wrong though: It is calculated based on the maximum page read time, but the timeout is also used for page write and block erase operations which require orders of magnitude bigger timeouts. Fix this by calculating busy_timeout_cycles from the maximum of tBERS_max and tPROG_max. This is for now the easiest and most obvious way to fix the driver. There's room for improvements though: The NAND_OP_WAITRDY_INSTR tells us the desired timeout for the current operation, so we could program the timeout dynamically for each operation instead of setting a fixed timeout. Also we could wire up the interrupt handler to actually detect and forward timeouts occurred when waiting for the chip being ready. As a sidenote I verified that the change in 06781a5026350 is really correct. I wired up the interrupt handler in my tree and measured the time between starting the operation and the timeout interrupt handler coming in. The time increases 41us with each step in the timeout register which corresponds to 4096 clock cycles with the 99MHz clock that I have. Fixes: 06781a5026350 ("mtd: rawnand: gpmi: Fix setting busy timeout setting") Fixes: b1206122069aa ("mtd: rawniand: gpmi: use core timings instead of an empirical derivation") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer Acked-by: Han Xu Tested-by: Tomasz Moń Signed-off-by: Richard Weinberger commit 1ac8ec2731a5ae0f283d103873be7b945ba97e90 Merge: 51889d225ce2c 9023ca0866250 Author: Petr Mladek Date: Fri Jul 15 16:43:42 2022 +0200 Merge branch 'rework/kthreads' into for-linus commit 9b04369b060fd4885f728b7a4ab4851ffb1abb64 Author: Dmitry Osipenko Date: Tue Apr 12 01:15:36 2022 +0300 drm/scheduler: Don't kill jobs in interrupt context Interrupt context can't sleep. Drivers like Panfrost and MSM are taking mutex when job is released, and thus, that code can sleep. This results into "BUG: scheduling while atomic" if locks are contented while job is freed. There is no good reason for releasing scheduler's jobs in IRQ context, hence use normal context to fix the trouble. Cc: stable@vger.kernel.org Fixes: 542cff7893a3 ("drm/sched: Avoid lockdep spalt on killing a processes") Signed-off-by: Dmitry Osipenko Signed-off-by: Andrey Grodzovsky Link: https://patchwork.freedesktop.org/patch/msgid/20220411221536.283312-1-dmitry.osipenko@collabora.com commit 2d4bd81fea1ad6ebba543bd6da3ef5179d130e6a Author: Stylon Wang Date: Thu Jul 7 16:23:29 2022 +0800 drm/amd/display: Fix new dmub notification enabling in DM [Why] Changes from "Fix for dmub outbox notification enable" need to land in DM or DMUB outbox notification would be disabled. [How] Enable outbox notification only after interrupt are enabled and IRQ handlers registered. Any pending notification will be sent by DMUB once outbox notification is enabled. Fixes: ed7208706448 ("drm/amd/display: Fix for dmub outbox notification enable") Reviewed-by: Nicholas Kazlauskas Acked-by: Solomon Chiu Signed-off-by: Stylon Wang Acked-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5a5adb1528e59e8a4b23ffa7dda4849b61e97cf8 Merge: 32346491ddf24 d2394860b45c3 Author: Rafael J. Wysocki Date: Fri Jul 15 13:54:14 2022 +0200 Merge tag 'cpufreq-arm-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull a cpufreq ARM fix for 5.19-rc7 from Viresh Kumar: - mediatek: Handle sram regulator probe deferral * tag 'cpufreq-arm-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: mediatek: Handle sram regulator probe deferral commit 79629181607e801c0b41b8790ac4ee2eb5d7bc3e Author: Paolo Bonzini Date: Fri Jul 15 07:34:55 2022 -0400 KVM: emulate: do not adjust size of fastop and setcc subroutines Instead of doing complicated calculations to find the size of the subroutines (which are even more complicated because they need to be stringified into an asm statement), just hardcode to 16. It is less dense for a few combinations of IBT/SLS/retbleed, but it has the advantage of being really simple. Cc: stable@vger.kernel.org # 5.15.x: 84e7051c0bc1: x86/kvm: fix FASTOP_SIZE when return thunks are enabled Cc: stable@vger.kernel.org Suggested-by: Linus Torvalds Signed-off-by: Paolo Bonzini commit 8f3184b951164131a8b35770f225082cc02008be Merge: 782d86fe44e38 f4c7d8948e866 Author: David S. Miller Date: Fri Jul 15 12:06:56 2022 +0100 Merge branch 'stmmac-dwmac-mediatec-clock-fix' Biao Huang says: ==================== stmmac: dwmac-mediatek: fix clock issue changes in v5: 1. add reivewd-by as Matthias's comments. 2. fix "warning: unused variable 'ret' [-Wunused-variable]" as Jakub's comments changes in v4: 1. improve commit message and test ko insertion/remove as Matthias's comments. 2. add patch "net: stmmac: fix pm runtime issue in stmmac_dvr_remove()" to fix vlan filter deletion issue. 3. add patch "net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow" to fix unbalanced ptp clock issue in suspend/resume flow. changes in v3: 1. delete mediatek_dwmac_exit() since there is no operation in it, as Matthias's comments. changes in v2: 1. clock configuration is still needed in probe, and invoke mediatek_dwmac_clks_config() instead. 2. update commit message. v1: remove duplicated clock configuration in init/exit. ==================== Signed-off-by: David S. Miller commit f4c7d8948e866918d61493264dbbd67e45ef2bda Author: Biao Huang Date: Thu Jul 14 14:00:14 2022 +0800 net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow Current stmmac driver will prepare/enable ptp_ref clock in stmmac_init_tstamp_counter(). The stmmac_pltfr_noirq_suspend will disable it once in suspend flow. But in resume flow, stmmac_pltfr_noirq_resume --> stmmac_init_tstamp_counter stmmac_resume --> stmmac_hw_setup --> stmmac_init_ptp --> stmmac_init_tstamp_counter ptp_ref clock reference counter increases twice, which leads to unbalance ptp clock when resume back. Move ptp_ref clock prepare/enable out of stmmac_init_tstamp_counter to fix it. Fixes: 0735e639f129d ("net: stmmac: skip only stmmac_ptp_register when resume from suspend") Signed-off-by: Biao Huang Signed-off-by: David S. Miller commit 0d9a15913b871e03fdd3b3d90a2e665fb22f9bcf Author: Biao Huang Date: Thu Jul 14 14:00:13 2022 +0800 net: stmmac: fix pm runtime issue in stmmac_dvr_remove() If netif is running when stmmac_dvr_remove is invoked, the unregister_netdev will call ndo_stop(stmmac_release) and vlan_kill_rx_filter(stmmac_vlan_rx_kill_vid). Currently, stmmac_dvr_remove() will disable pm runtime before unregister_netdev. When stmmac_vlan_rx_kill_vid is invoked, pm_runtime_resume_and_get in it returns EACCESS error number, and reports: dwmac-mediatek 11021000.ethernet eth0: stmmac_dvr_remove: removing driver dwmac-mediatek 11021000.ethernet eth0: FPE workqueue stop dwmac-mediatek 11021000.ethernet eth0: failed to kill vid 0081/0 Move the pm_runtime_disable to the end of stmmac_dvr_remove to fix this issue. Fixes: 6449520391dfc ("net: stmmac: properly handle with runtime pm in stmmac_dvr_remove()") Signed-off-by: Biao Huang Signed-off-by: David S. Miller commit fa4b3ca60e8011d3046765b3de8d3f1ffc53af28 Author: Biao Huang Date: Thu Jul 14 14:00:12 2022 +0800 stmmac: dwmac-mediatek: fix clock issue The pm_runtime takes care of the clock handling in current stmmac drivers, and dwmac-mediatek implement the mediatek_dwmac_clks_config() as the callback for pm_runtime. Then, stripping duplicated clocks handling in old init()/exit() to fix clock issue in suspend/resume test. As to clocks in probe/remove, vendor need symmetric handling to ensure clocks balance. Test pass, including suspend/resume and ko insertion/remove. Fixes: 3186bdad97d5 ("stmmac: dwmac-mediatek: add platform level clocks management") Signed-off-by: Biao Huang Reviewed-by: Matthias Brugger Signed-off-by: David S. Miller commit 782d86fe44e38c0a02e92042fff2ce417d62c61a Merge: db886979683a8 2a85388f1d94a Author: David S. Miller Date: Fri Jul 15 11:49:56 2022 +0100 Merge branch 'net-sysctl-races-round2' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Round 2). This series fixes data-races around 15 knobs after ip_default_ttl in ipv4_net_table. These two knobs are skipped. - ip_local_port_range is safe with its own lock. - ip_local_reserved_ports uses proc_do_large_bitmap(), which will need an additional lock and can be fixed later. So, the next round will start with igmp_link_local_mcast_reports. ==================== Signed-off-by: David S. Miller commit 2a85388f1d94a9f8b5a529118a2c5eaa0520d85c Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:05 2022 -0700 tcp: Fix a data-race around sysctl_tcp_probe_interval. While reading sysctl_tcp_probe_interval, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 05cbc0db03e8 ("ipv4: Create probe timer for tcp PMTU as per RFC4821") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 92c0aa4175474483d6cf373314343d4e624e882a Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:04 2022 -0700 tcp: Fix a data-race around sysctl_tcp_probe_threshold. While reading sysctl_tcp_probe_threshold, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 6b58e0a5f32d ("ipv4: Use binary search to choose tcp PMTU probe_size") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8e92d4423615a5257d0d871fc067aa561f597deb Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:03 2022 -0700 tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. While reading sysctl_tcp_mtu_probe_floor, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: c04b79b6cfd7 ("tcp: add new tcp_mtu_probe_floor sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 78eb166cdefcc3221c8c7c1e2d514e91a2eb5014 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:02 2022 -0700 tcp: Fix data-races around sysctl_tcp_min_snd_mss. While reading sysctl_tcp_min_snd_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 5f3e2bf008c2 ("tcp: add tcp_min_snd_mss sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 88d78bc097cd8ebc6541e93316c9d9bf651b13e8 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:01 2022 -0700 tcp: Fix data-races around sysctl_tcp_base_mss. While reading sysctl_tcp_base_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 5d424d5a674f ("[TCP]: MTU probing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit f47d00e077e7d61baf69e46dde3210c886360207 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:52:00 2022 -0700 tcp: Fix data-races around sysctl_tcp_mtu_probing. While reading sysctl_tcp_mtu_probing, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 5d424d5a674f ("[TCP]: MTU probing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 08a75f10679470552a3a443f9aefd1399604d31d Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:59 2022 -0700 tcp: Fix data-races around sysctl_tcp_l3mdev_accept. While reading sysctl_tcp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 6dd9a14e92e5 ("net: Allow accepted sockets to be bound to l3mdev domain") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1a0008f9df59451d0a17806c1ee1a19857032fa8 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:58 2022 -0700 tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. While reading sysctl_tcp_fwmark_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 84f39b08d786 ("net: support marking accepting TCP sockets") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9a Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:57 2022 -0700 ip: Fix a data-race around sysctl_fwmark_reflect. While reading sysctl_fwmark_reflect, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: e110861f8609 ("net: add a sysctl to reflect the fwmark on replies") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 0db232765887d9807df8bcb7b6f29b2871539eab Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:56 2022 -0700 ip: Fix a data-race around sysctl_ip_autobind_reuse. While reading sysctl_ip_autobind_reuse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 4b01a9674231 ("tcp: bind(0) remove the SO_REUSEADDR restriction when ephemeral ports are exhausted.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 289d3b21fb0bfc94c4e98f10635bba1824e5f83c Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:55 2022 -0700 ip: Fix data-races around sysctl_ip_nonlocal_bind. While reading sysctl_ip_nonlocal_bind, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 7bf9e18d9a5e99e3c83482973557e9f047b051e7 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:54 2022 -0700 ip: Fix data-races around sysctl_ip_fwd_update_priority. While reading sysctl_ip_fwd_update_priority, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 432e05d32892 ("net: ipv4: Control SKB reprioritization after forwarding") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 60c158dc7b1f0558f6cadd5b50d0386da0000d50 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:53 2022 -0700 ip: Fix data-races around sysctl_ip_fwd_use_pmtu. While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: f87c10a8aa1e ("ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against pmtu spoofing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 0968d2a441bf6afb551fd99e60fa65ed67068963 Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:52 2022 -0700 ip: Fix data-races around sysctl_ip_no_pmtu_disc. While reading sysctl_ip_no_pmtu_disc, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8281b7ec5c56b71cb2cc5a1728b41607be66959c Author: Kuniyuki Iwashima Date: Wed Jul 13 13:51:51 2022 -0700 ip: Fix data-races around sysctl_ip_default_ttl. While reading sysctl_ip_default_ttl, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit cf33ce6f0c220fbfe5dafcb08d4c5655097a5fa4 Merge: 9b043a8f38648 1e347f861da8d Author: Takashi Iwai Date: Fri Jul 15 12:31:07 2022 +0200 Merge tag 'asoc-fix-v5.19-rc4-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Drop Rockchip BCLK management for v5.19 As covered in the second revert commit in this pull request the version of the BCLK muxing that's in v5.19 is causing issues, let's just revert it and wait for the more complete support in v5.20 instead. commit 9023ca0866250d268b047f21e1392e7a81277a54 Author: John Ogness Date: Fri Jul 15 08:16:42 2022 +0206 printk: do not wait for consoles when suspended The console_stop() and console_start() functions call pr_flush(). When suspending, these functions are called by the serial subsystem while the serial port is suspended. In this scenario, if there are any pending messages, a call to pr_flush() will always result in a timeout because the serial port cannot make forward progress. This causes longer suspend and resume times. Add a check in pr_flush() so that it will immediately timeout if the consoles are suspended. Fixes: 3b604ca81202 ("printk: add pr_flush()") Reported-by: Todd Brandt Signed-off-by: John Ogness Tested-by: Todd Brandt Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220715061042.373640-2-john.ogness@linutronix.de commit 2f23256c0ea20627c91ea2d468cda945f68c3395 Author: Tony Krowiak Date: Wed Jul 6 17:43:29 2022 -0400 s390/ap: fix error handling in __verify_queue_reservations() The AP bus's __verify_queue_reservations function increments the ref count for the device driver passed in as a parameter, but fails to decrement it before returning control to the caller. This will prevents any subsequent removal of the module. Signed-off-by: Tony Krowiak Reported-by: Tony Krowiak Reviewed-by: Harald Freudenberger Fixes: 4f8206b88286 ("s390/ap: driver callback to indicate resource in use") Link: https://lore.kernel.org/r/20220706222619.602094-1-akrowiak@linux.ibm.com Cc: stable@vger.kernel.org [agordeev@linux.ibm.com fixed description, added Fixes and Link] Signed-off-by: Alexander Gordeev commit 093f8d8f10aa22935bc8bf7100700f714ebaba9c Merge: 5bde069b30503 3283c83eb6fcf Author: Dave Airlie Date: Fri Jul 15 11:26:20 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-07-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-07-13: amdgpu: - DP MST blank screen fix for specific platforms - MEC firmware check fix for GC 10.3.7 - Deep color fix for DCE - Fix possible divide by 0 - Coverage blend mode fix - Fix cursor only commit timestamps Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220713172920.6037-1-alexander.deucher@amd.com commit 5bde069b305037f9a0beb95094e047d45de9a249 Merge: b1f4347f732f8 333991c4e66b3 Author: Dave Airlie Date: Fri Jul 15 09:27:05 2022 +1000 Merge tag 'drm-intel-fixes-2022-07-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Selftest fix (Andrzej) - TTM fix sg_table construction (Matt Auld) - Error return fixes (Dan) - Fix a performance regression related to waitboost (Chris) - Fix GT resets (Chris) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Ys87yMujcG2sJC1R@intel.com commit b1f4347f732f84c7ef77467a20edc893e9ec5f92 Merge: 3590b44b9434a 925b6e59138ce Author: Dave Airlie Date: Fri Jul 15 09:26:00 2022 +1000 Merge tag 'drm-misc-fixes-2022-07-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Only a revert for amdgpu reverting the switch to the drm buddy allocator. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220714071821.hsejxpsgkbbzlec2@houat commit e5d523f1ae8f2cef01f8e071aeee432654166708 Author: Nick Desaulniers Date: Thu Jul 14 13:56:43 2022 -0700 ubsan: disable UBSAN_DIV_ZERO for clang Building with UBSAN_DIV_ZERO with clang produces numerous fallthrough warnings from objtool. In the case of uncheck division, UBSAN_DIV_ZERO may introduce new control flow to check for division by zero. Because the result of the division is undefined, LLVM may optimize the control flow such that after the call to __ubsan_handle_divrem_overflow doesn't matter. If panic_on_warn was set, __ubsan_handle_divrem_overflow would panic. The problem is is that panic_on_warn is run time configurable. If it's disabled, then we cannot guarantee that we will be able to recover safely. Disable this config for clang until we can come up with a solution in LLVM. Link: https://github.com/ClangBuiltLinux/linux/issues/1657 Link: https://github.com/llvm/llvm-project/issues/56289 Link: https://lore.kernel.org/lkml/CAHk-=wj1qhf7y3VNACEexyp5EbkNpdcu_542k-xZpzmYLOjiCg@mail.gmail.com/ Reported-by: Sudip Mukherjee Suggested-by: Linus Torvalds Signed-off-by: Nick Desaulniers Acked-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit b926f2adb0442090351dc8321ec1f99b22e372da Author: Linus Torvalds Date: Thu Jul 14 15:35:24 2022 -0700 Revert "vf/remap: return the amount of bytes actually deduplicated" This reverts commit 4a57a8400075bc5287c5c877702c68aeae2a033d. Dave Chinner reports: "As I suspected would occur, this change causes test failures. e.g generic/517 in fstests fails with: generic/517 1s ... - output mismatch [..] -deduped 131172/131172 bytes at offset 65536 +deduped 131072/131172 bytes at offset 65536" can you please revert this commit for the 5.19 series to give us more time to investigate and consider the impact of the the API change on userspace applications before we commit to changing the API" That changed return value seems to reflect reality, but with the fstest change, let's revert for now. Requested-by: Dave Chinner Link: https://lore.kernel.org/all/20220714223238.GH3600936@dread.disaster.area/ Cc: Ansgar Lößer Signed-off-by: Linus Torvalds commit db886979683a8360ced9b24ab1125ad0c4d2cf76 Author: Nathan Chancellor Date: Wed Jul 13 08:24:37 2022 -0700 x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Clang warns: arch/x86/kernel/cpu/bugs.c:58:21: error: section attribute is specified on redeclared variable [-Werror,-Wsection] DEFINE_PER_CPU(u64, x86_spec_ctrl_current); ^ arch/x86/include/asm/nospec-branch.h:283:12: note: previous declaration is here extern u64 x86_spec_ctrl_current; ^ 1 error generated. The declaration should be using DECLARE_PER_CPU instead so all attributes stay in sync. Cc: stable@vger.kernel.org Fixes: fc02735b14ff ("KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS") Reported-by: kernel test robot Signed-off-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 89551fdd44a272ac88258b231b07e5644fd2b2e7 Author: Krzysztof Kozlowski Date: Fri Jun 24 19:08:11 2022 +0200 riscv: dts: align gpio-key node names with dtschema The node names should be generic and DT schema expects certain pattern (e.g. with key/button/switch). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220624170811.66395-1-krzysztof.kozlowski@linaro.org Link: https://lore.kernel.org/all/20220616005224.18391-1-krzysztof.kozlowski@linaro.org/ Signed-off-by: Palmer Dabbelt commit 3a66a087599483612a6e6a4970ec403e61c30821 Author: Li Zhengyu Date: Wed Jun 1 15:02:04 2022 +0800 RISC-V: kexec: Fix build error without CONFIG_KEXEC When CONFIG_KEXEC_FILE=y but CONFIG_KEXEC is not set: kernel/kexec_core.o: In function `kimage_free': kexec_core.c:(.text+0xa0c): undefined reference to `machine_kexec_cleanup' kernel/kexec_core.o: In function `.L0 ': kexec_core.c:(.text+0xde8): undefined reference to `machine_crash_shutdown' kexec_core.c:(.text+0xdf4): undefined reference to `machine_kexec' kernel/kexec_core.o: In function `.L231': kexec_core.c:(.text+0xe1c): undefined reference to `riscv_crash_save_regs' kernel/kexec_core.o: In function `.L0 ': kexec_core.c:(.text+0x119e): undefined reference to `machine_shutdown' kernel/kexec_core.o: In function `.L312': kexec_core.c:(.text+0x11b2): undefined reference to `machine_kexec' kernel/kexec_file.o: In function `.L0 ': kexec_file.c:(.text+0xb84): undefined reference to `machine_kexec_prepare' kernel/kexec_file.o: In function `.L177': kexec_file.c:(.text+0xc5a): undefined reference to `machine_kexec_prepare' Makefile:1160: recipe for target 'vmlinux' failed make: *** [vmlinux] Error 1 These symbols should depend on CONFIG_KEXEC_CORE rather than CONFIG_KEXEC when kexec_file has been implemented on RISC-V, like the other archs have done. Signed-off-by: Li Zhengyu Reviewed-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20220601070204.26882-1-lizhengyu3@huawei.com Fixes: 6261586e0c91 ("RISC-V: Add kexec_file support") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit a927444aa953f757eaea5bb3615916fba6db58bf Author: Li Zhengyu Date: Wed Jun 1 14:39:24 2022 +0800 RISCV: kexec: Fix build error without CONFIG_MODULES When CONFIG_MODULES is not set/enabled: ../arch/riscv/kernel/elf_kexec.c:353:9: error: unknown type name 'Elf_Rela'; did you mean 'Elf64_Rela'? 353 | Elf_Rela *relas; | ^~~~~~~~ | Elf64_Rela Replace Elf_Rela by Elf64_Rela to avoid relying on CONFIG_MODULES. Signed-off-by: Li Zhengyu Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20220601063924.13037-1-lizhengyu3@huawei.com Fixes: 838b3e28488f ("RISC-V: Load purgatory in kexec_file") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 43b5240ca6b33108998810593248186b1e3ae34a Author: Muchun Song Date: Thu Jun 9 18:40:32 2022 +0800 mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE "numa_stat" should not be included in the scope of CONFIG_HUGETLB_PAGE, if CONFIG_HUGETLB_PAGE is not configured even if CONFIG_NUMA is configured, "numa_stat" is missed form /proc. Move it out of CONFIG_HUGETLB_PAGE to fix it. Fixes: 4518085e127d ("mm, sysctl: make NUMA stats configurable") Signed-off-by: Muchun Song Cc: Acked-by: Michal Hocko Acked-by: Mel Gorman Signed-off-by: Luis Chamberlain commit 9bd572ec7a66b56e1aed896217ff311d981cf575 Merge: f41d5df5f146d 656bd03a2cd85 Author: Linus Torvalds Date: Thu Jul 14 12:48:07 2022 -0700 Merge tag 'net-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, bpf and wireless. Still no major regressions, the release continues to be calm. An uptick of fixes this time around due to trivial data race fixes and patches flowing down from subtrees. There has been a few driver fixes (particularly a few fixes for false positives due to 66e4c8d95008 which went into -next in May!) that make me worry the wide testing is not exactly fully through. So "calm" but not "let's just cut the final ASAP" vibes over here. Current release - regressions: - wifi: rtw88: fix write to const table of channel parameters Current release - new code bugs: - mac80211: add gfp_t arg to ieeee80211_obss_color_collision_notify - mlx5: - TC, allow offload from uplink to other PF's VF - Lag, decouple FDB selection and shared FDB - Lag, correct get the port select mode str - bnxt_en: fix and simplify XDP transmit path - r8152: fix accessing unset transport header Previous releases - regressions: - conntrack: fix crash due to confirmed bit load reordering (after atomic -> refcount conversion) - stmmac: dwc-qos: disable split header for Tegra194 Previous releases - always broken: - mlx5e: ring the TX doorbell on DMA errors - bpf: make sure mac_header was set before using it - mac80211: do not wake queues on a vif that is being stopped - mac80211: fix queue selection for mesh/OCB interfaces - ip: fix dflt addr selection for connected nexthop - seg6: fix skb checksums for SRH encapsulation/insertion - xdp: fix spurious packet loss in generic XDP TX path - bunch of sysctl data race fixes - nf_log: incorrect offset to network header Misc: - bpf: add flags arg to bpf_dynptr_read and bpf_dynptr_write APIs" * tag 'net-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (87 commits) nfp: flower: configure tunnel neighbour on cmsg rx net/tls: Check for errors in tls_device_init MAINTAINERS: Add an additional maintainer to the AMD XGBE driver xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue selftests/net: test nexthop without gw ip: fix dflt addr selection for connected nexthop net: atlantic: remove aq_nic_deinit() when resume net: atlantic: remove deep parameter on suspend/resume functions sfc: fix kernel panic when creating VF seg6: bpf: fix skb checksum in bpf_push_seg6_encap() seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors seg6: fix skb checksum evaluation in SRH encapsulation/insertion sfc: fix use after free when disabling sriov net: sunhme: output link status with a single print. r8152: fix accessing unset transport header net: stmmac: fix leaks in probe net: ftgmac100: Hold reference returned by of_get_child_by_name() nexthop: Fix data-races around nexthop_compat_mode. ipv4: Fix data-races around sysctl_ip_dynaddr. tcp: Fix a data-race around sysctl_tcp_ecn_fallback. ... commit 5ad26161a371e4aa2d2553286f0cac580987a493 Author: Hans de Goede Date: Wed Jul 13 23:11:01 2022 +0200 ACPI: video: Fix acpi_video_handles_brightness_key_presses() Commit 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness key-presses are handled") made acpi_video_handles_brightness_key_presses() report false when none of the ACPI Video Devices support backlight control. But it turns out that at least on a Dell Inspiron N4010 there is no ACPI backlight control, yet brightness hotkeys are still reported through the ACPI Video Bus; and since acpi_video_handles_brightness_key_presses() now returns false, brightness keypresses are now reported twice. To fix this rename the has_backlight flag to may_report_brightness_keys and also set it the first time a brightness key press event is received. Depending on the delivery of the other ACPI (WMI) event vs the ACPI Video Bus event this means that the first brightness key press might still get reported twice, but all further keypresses will be filtered as before. Note that this relies on other drivers reporting brightness key events calling acpi_video_handles_brightness_key_presses() when delivering the events (rather then once during driver probe). This is already required and documented in include/acpi/video.h: /* * Note: The value returned by acpi_video_handles_brightness_key_presses() * may change over time and should not be cached. */ Fixes: 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness key-presses are handled") Link: https://lore.kernel.org/regressions/CALF=6jEe5G8+r1Wo0vvz4GjNQQhdkLT5p8uCHn6ZXhg4nsOWow@mail.gmail.com/ Reported-and-tested-by: Ben Greening Signed-off-by: Hans de Goede Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20220713211101.85547-2-hdegoede@redhat.com commit f41d5df5f146d606df02ec8fafd080a5ee6e6e81 Merge: a24a6c05ffa7a 32f319183c439 Author: Linus Torvalds Date: Thu Jul 14 12:35:15 2022 -0700 Merge tag '5.19-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Three smb3 client fixes: - two multichannel fixes: fix a potential deadlock freeing a channel, and fix a race condition on failed creation of a new channel - mount failure fix: work around a server bug in some common older Samba servers by avoiding padding at the end of the negotiate protocol request" * tag '5.19-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: workaround negprot bug in some Samba servers cifs: remove unnecessary locking of chan_lock while freeing session cifs: fix race condition with delayed threads commit a24a6c05ffa7adb3f2d4b417ca46eedbe67b7302 Merge: 4adfa865bb972 1197eb5906a54 Author: Linus Torvalds Date: Thu Jul 14 12:29:43 2022 -0700 Merge tag 'nfsd-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Notable regression fixes: - Enable SETATTR(time_create) to fix regression with Mac OS clients - Fix a lockd crasher and broken NLM UNLCK behavior" * tag 'nfsd-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: lockd: fix nlm_close_files lockd: set fl_owner when unlocking files NFSD: Decode NFSv4 birth time attribute commit 4adfa865bb972d38d35a6fb19e59a86074d25a75 Merge: 2eb5866cac071 067d252187413 Author: Linus Torvalds Date: Thu Jul 14 12:15:42 2022 -0700 Merge tag 'integrity-v5.19-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity fixes from Mimi Zohar: "Here are a number of fixes for recently found bugs. Only 'ima: fix violation measurement list record' was introduced in the current release. The rest address existing bugs" * tag 'integrity-v5.19-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Fix potential memory leak in ima_init_crypto() ima: force signature verification when CONFIG_KEXEC_SIG is configured ima: Fix a potential integer overflow in ima_appraise_measurement ima: fix violation measurement list record Revert "evm: Fix memleak in init_desc" commit 2eb5866cac07121b0990d0af5085e36ca5b1ccad Merge: 097da1a44d1ae 29589ca09a74c Author: Linus Torvalds Date: Thu Jul 14 12:08:59 2022 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - quieten the spectre-bhb prints - mark flattened device tree sections as shareable - remove some obsolete CPU domain code and help text - fix thumb unaligned access abort emulation - fix amba_device_add() refcount underflow - fix literal placement * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9208/1: entry: add .ltorg directive to keep literals in range ARM: 9207/1: amba: fix refcount underflow if amba_device_add() fails ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction ARM: 9213/1: Print message about disabled Spectre workarounds only once ARM: 9212/1: domain: Modify Kconfig help text ARM: 9211/1: domain: drop modify_domain() ARM: 9210/1: Mark the FDT_FIXED sections as shareable ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle commit 097da1a44d1aef15739214fecf8f4c63792bb665 Author: Guenter Roeck Date: Thu Jul 14 11:46:00 2022 -0700 um: Replace to_phys() and to_virt() with less generic function names The UML function names to_virt() and to_phys() are exposed by UML headers, and are very generic and may be defined by drivers. As it turns out, commit 9409c9b6709e ("pmem: refactor pmem_clear_poison()") did exactly that. This results in build errors such as the following when trying to build um:allmodconfig: drivers/nvdimm/pmem.c: In function ‘pmem_dax_zero_page_range’: ./arch/um/include/asm/page.h:105:20: error: too few arguments to function ‘to_phys’ 105 | #define __pa(virt) to_phys((void *) (unsigned long) (virt)) | ^~~~~~~ Use less generic function names for the um specific to_phys() and to_virt() functions to fix the problem and to avoid similar problems in the future. Fixes: 9409c9b6709e ("pmem: refactor pmem_clear_poison()") Cc: Dan Williams Cc: Christoph Hellwig Signed-off-by: Guenter Roeck Signed-off-by: Linus Torvalds commit c4634a3c7dcabed7321304efc00b5a81559adeca Merge: d11219ad53dcf 9b043a8f38648 Author: Linus Torvalds Date: Thu Jul 14 11:34:16 2022 -0700 Merge tag 'sound-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Hopefully the last one for 5.19. This became bigger than wished, but all changes are pretty device-specific small fixes, which look less worrisome. The majority of changes are about various ASoC fixes, while the usual HD-audio quirks are included as well" * tag 'sound-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (28 commits) ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 ALSA: hda/realtek: fix mute/micmute LEDs for HP machines ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda - Add fixup for Dell Latitidue E5430 ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model ALSA: hda/realtek: Fix headset mic for Acer SF313-51 ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() ASoC: rt5640: Fix the wrong state of JD1 and JD2 ASoC: Intel: sof_rt5682: fix out-of-bounds array access ASoC: qdsp6: fix potential memory leak in q6apm_get_audioreach_graph() ASoC: tas2764: Fix amp gain register offset & default ASoC: tas2764: Correct playback volume range ASoC: tas2764: Fix and extend FSYNC polarity handling ASoC: tas2764: Add post reset delays ASoC: dt-bindings: Fix description for msm8916 ASoC: doc: Capitalize RESET line name ASoC: arizona: Update arizona_aif_cfg_changed to use RX_BCLK_RATE ASoC: cs47l92: Fix event generation for OUT1 demux ... commit 656bd03a2cd853e7c7c4e08968ad8c0ea993737d Author: Tianyu Yuan Date: Thu Jul 14 10:19:15 2022 +0200 nfp: flower: configure tunnel neighbour on cmsg rx nfp_tun_write_neigh() function will configure a tunnel neighbour when calling nfp_tun_neigh_event_handler() or nfp_flower_cmsg_process_one_rx() (with no tunnel neighbour type) from firmware. When configuring IP on physical port as a tunnel endpoint, no operation will be performed after receiving the cmsg mentioned above. Therefore, add a progress to configure tunnel neighbour in this case. v2: Correct format of fixes tag. Fixes: f1df7956c11f ("nfp: flower: rework tunnel neighbour configuration") Signed-off-by: Tianyu Yuan Reviewed-by: Louis Peens Reviewed-by: Baowen Zheng Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220714081915.148378-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit 3d8c51b25a235e283e37750943bbf356ef187230 Author: Tariq Toukan Date: Thu Jul 14 10:07:54 2022 +0300 net/tls: Check for errors in tls_device_init Add missing error checks in tls_device_init. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Reported-by: Jakub Kicinski Reviewed-by: Maxim Mikityanskiy Signed-off-by: Tariq Toukan Link: https://lore.kernel.org/r/20220714070754.1428-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 51f1c31f8ba713f70f1659e7c91e837fe5f5554f Author: Tom Lendacky Date: Wed Jul 13 17:31:41 2022 -0500 MAINTAINERS: Add an additional maintainer to the AMD XGBE driver Add Shyam Sundar S K as an additional maintainer to support the AMD XGBE network device driver. Cc: Shyam Sundar S K Signed-off-by: Tom Lendacky Link: https://lore.kernel.org/r/db367f24089c2bbbcd1cec8e21af49922017a110.1657751501.git.thomas.lendacky@amd.com Signed-off-by: Jakub Kicinski commit 94e8100678889ab428e68acadf042de723f094b9 Author: Juergen Gross Date: Wed Jul 13 15:53:22 2022 +0200 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue xenvif_rx_next_skb() is expecting the rx queue not being empty, but in case the loop in xenvif_rx_action() is doing multiple iterations, the availability of another skb in the rx queue is not being checked. This can lead to crashes: [40072.537261] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [40072.537407] IP: xenvif_rx_skb+0x23/0x590 [xen_netback] [40072.537534] PGD 0 P4D 0 [40072.537644] Oops: 0000 [#1] SMP NOPTI [40072.537749] CPU: 0 PID: 12505 Comm: v1-c40247-q2-gu Not tainted 4.12.14-122.121-default #1 SLE12-SP5 [40072.537867] Hardware name: HP ProLiant DL580 Gen9/ProLiant DL580 Gen9, BIOS U17 11/23/2021 [40072.537999] task: ffff880433b38100 task.stack: ffffc90043d40000 [40072.538112] RIP: e030:xenvif_rx_skb+0x23/0x590 [xen_netback] [40072.538217] RSP: e02b:ffffc90043d43de0 EFLAGS: 00010246 [40072.538319] RAX: 0000000000000000 RBX: ffffc90043cd7cd0 RCX: 00000000000000f7 [40072.538430] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffc90043d43df8 [40072.538531] RBP: 000000000000003f R08: 000077ff80000000 R09: 0000000000000008 [40072.538644] R10: 0000000000007ff0 R11: 00000000000008f6 R12: ffffc90043ce2708 [40072.538745] R13: 0000000000000000 R14: ffffc90043d43ed0 R15: ffff88043ea748c0 [40072.538861] FS: 0000000000000000(0000) GS:ffff880484600000(0000) knlGS:0000000000000000 [40072.538988] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [40072.539088] CR2: 0000000000000080 CR3: 0000000407ac8000 CR4: 0000000000040660 [40072.539211] Call Trace: [40072.539319] xenvif_rx_action+0x71/0x90 [xen_netback] [40072.539429] xenvif_kthread_guest_rx+0x14a/0x29c [xen_netback] Fix that by stopping the loop in case the rx queue becomes empty. Cc: stable@vger.kernel.org Fixes: 98f6d57ced73 ("xen-netback: process guest rx packets in batches") Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Reviewed-by: Paul Durrant Link: https://lore.kernel.org/r/20220713135322.19616-1-jgross@suse.com Signed-off-by: Jakub Kicinski commit d11219ad53dcf61ced53ca60fe0c4a8d34393e6c Author: Linus Torvalds Date: Wed Jul 13 12:36:50 2022 -0700 amdgpu: disable powerpc support for the newer display engine The DRM_AMD_DC_DCN display engine support (Raven, Navi, and newer) has not been building cleanly on powerpc and causes link errors due to mixing hard- and soft-float object files: powerpc64-linux-ld: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/display_mode_lib.o uses hard float, drivers/gpu/drm/amd/amdgpu/../display/dc/dcn31/dcn31_resource.o uses soft float powerpc64-linux-ld: failed to merge target specific data of file drivers/gpu/drm/amd/amdgpu/../display/dc/dcn31/dcn31_resource.o [..] and while patches are floating around, it's not exactly obvious what is going on. The problem bisects to commit 41b7a347bf14 ("powerpc: Book3S 64-bit outline-only KASAN support") but that is probably more about changing config variables than the fundamental cause. Despite the bisection result, a more directly related commit seems to be 26f4712aedbd ("drm/amd/display: move FPU related code from dcn31 to dml/dcn31 folder"). It's probably a combination of the two. This has been going on since the merge window, without any final word. So instead of blindly applying patches that may or may not be the right thing, let's disable this for now. As Michael Ellerman says: "IIUIC this code was never enabled on ppc before, so disabling it seems like a reasonable fix to get the build clean" and once we have more actual feedback (and find any potential users) we can always re-enable it with the patch that fixes the issues and back-port as necessary. Fixes: 41b7a347bf14 ("powerpc: Book3S 64-bit outline-only KASAN support") Fixes: 26f4712aedbd ("drm/amd/display: move FPU related code from dcn31 to dml/dcn31 folder") Reported-and-tested-by: Guenter Roeck Link: https://lore.kernel.org/all/20220606153910.GA1773067@roeck-us.net/ Link: https://lore.kernel.org/all/20220618232737.2036722-1-linux@roeck-us.net/ Link: https://lore.kernel.org/all/20220713050724.GA2471738@roeck-us.net/ Acked-by: Michael Ellerman Acked-by: Alex Deucher Signed-off-by: Linus Torvalds commit 957a2b345cbcf41b4b25d471229f0e35262f066c Author: Muchun Song Date: Wed Jul 13 22:02:26 2022 +0800 block: fix missing blkcg_bio_issue_init The commit 513616843d73 ("block: remove superfluous calls to blkcg_bio_issue_init") has removed blkcg_bio_issue_init from __bio_clone since submit_bio will override ->bi_issue. However, __blk_queue_split is called after blkcg_bio_issue_init (see blk_mq_submit_bio) in submit_bio. In this case, the ->bi_issue is 0. Fix it. Fixes: 513616843d73 ("block: remove superfluous calls to blkcg_bio_issue_init") Signed-off-by: Muchun Song Link: https://lore.kernel.org/r/20220713140226.68135-1-songmuchun@bytedance.com Signed-off-by: Jens Axboe commit c24b06e1c237ee2bf3245786b0ee844ddd1610be Merge: 6b0de7d0f3285 6961b5e02876b Author: Jens Axboe Date: Thu Jul 14 10:29:56 2022 -0600 Merge tag 'nvme-5.19-2022-07-14' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - fix a block device naming collision (Israel Rukshin) - fix freeze accounting for PCI error handling (Keith Busch)" * tag 'nvme-5.19-2022-07-14' of git://git.infradead.org/nvme: nvme: fix block device naming collision nvme-pci: fix freeze accounting for error handling commit 7c1ddcee5311f3315096217881d2dbe47cc683f9 Author: Lennert Buytenhek Date: Thu Jun 2 18:58:11 2022 +0300 igc: Reinstate IGC_REMOVED logic and implement it properly The initially merged version of the igc driver code (via commit 146740f9abc4, "igc: Add support for PF") contained the following IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors: u32 igc_rd32(struct igc_hw *hw, u32 reg) { u8 __iomem *hw_addr = READ_ONCE(hw->hw_addr); u32 value = 0; if (IGC_REMOVED(hw_addr)) return ~value; value = readl(&hw_addr[reg]); /* reads should not return all F's */ if (!(~value) && (!reg || !(~readl(hw_addr)))) hw->hw_addr = NULL; return value; } And: #define wr32(reg, val) \ do { \ u8 __iomem *hw_addr = READ_ONCE((hw)->hw_addr); \ if (!IGC_REMOVED(hw_addr)) \ writel((val), &hw_addr[(reg)]); \ } while (0) E.g. igb has similar checks in its MMIO accessors, and has a similar macro E1000_REMOVED, which is implemented as follows: #define E1000_REMOVED(h) unlikely(!(h)) These checks serve to detect and take note of an 0xffffffff MMIO read return from the device, which can be caused by a PCIe link flap or some other kind of PCI bus error, and to avoid performing MMIO reads and writes from that point onwards. However, the IGC_REMOVED macro was not originally implemented: #ifndef IGC_REMOVED #define IGC_REMOVED(a) (0) #endif /* IGC_REMOVED */ This led to the IGC_REMOVED logic to be removed entirely in a subsequent commit (commit 3c215fb18e70, "igc: remove IGC_REMOVED function"), with the rationale that such checks matter only for virtualization and that igc does not support virtualization -- but a PCIe device can become detached even without virtualization being in use, and without proper checks, a PCIe bus error affecting an igc adapter will lead to various NULL pointer dereferences, as the first access after the error will set hw->hw_addr to NULL, and subsequent accesses will blindly dereference this now-NULL pointer. This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and implements IGC_REMOVED the way it is done for igb, by checking for the unlikely() case of hw_addr being NULL. This change prevents the oopses seen when a PCIe link flap occurs on an igc adapter. Fixes: 146740f9abc4 ("igc: Add support for PF") Signed-off-by: Lennert Buytenhek Tested-by: Naama Meir Acked-by: Sasha Neftin Signed-off-by: Tony Nguyen commit 6cfa45361d3eac31ba67d7d0bbef547151450106 Author: Sasha Neftin Date: Mon May 9 11:52:54 2022 +0300 Revert "e1000e: Fix possible HW unit hang after an s0ix exit" This reverts commit 1866aa0d0d6492bc2f8d22d0df49abaccf50cddd. Commit 1866aa0d0d64 ("e1000e: Fix possible HW unit hang after an s0ix exit") was a workaround for CSME problem to handle messages comes via H2ME mailbox. This problem has been fixed by patch "e1000e: Enable the GPT clock before sending message to the CSME". Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214821 Signed-off-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit b49feacbeffc7635cc6692cbcc6a1eae2c17da6f Author: Sasha Neftin Date: Sun May 8 10:09:05 2022 +0300 e1000e: Enable GPT clock before sending message to CSME On corporate (CSME) ADL systems, the Ethernet Controller may stop working ("HW unit hang") after exiting from the s0ix state. The reason is that CSME misses the message sent by the host. Enabling the dynamic GPT clock solves this problem. This clock is cleared upon HW initialization. Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214821 Reviewed-by: Dima Ruinskiy Signed-off-by: Sasha Neftin Tested-by: Chia-Lin Kao (AceLan) Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 8a414f943f8b5f94bbaafdec863d6f3dbef33f8a Author: Vitaly Kuznetsov Date: Fri Jul 8 14:51:47 2022 +0200 KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() 'vector' and 'trig_mode' fields of 'struct kvm_lapic_irq' are left uninitialized in kvm_pv_kick_cpu_op(). While these fields are normally not needed for APIC_DM_REMRD, they're still referenced by __apic_accept_irq() for trace_kvm_apic_accept_irq(). Fully initialize the structure to avoid consuming random stack memory. Fixes: a183b638b61c ("KVM: x86: make apic_accept_irq tracepoint more generic") Reported-by: syzbot+d6caa905917d353f0d07@syzkaller.appspotmail.com Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Message-Id: <20220708125147.593975-1-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit 6961b5e02876b3b47f030a1f1ee8fd3e631ac270 Author: Israel Rukshin Date: Thu Jul 14 12:42:10 2022 +0000 nvme: fix block device naming collision The issue exists when multipath is enabled and the namespace is shared, but all the other controller checks at nvme_is_unique_nsid() are false. The reason for this issue is that nvme_is_unique_nsid() returns false when is called from nvme_mpath_alloc_disk() due to an uninitialized value of head->shared. The patch fixes it by setting head->shared before nvme_mpath_alloc_disk() is called. Fixes: 5974ea7ce0f9 ("nvme: allow duplicate NSIDs for private namespaces") Signed-off-by: Israel Rukshin Reviewed-by: Keith Busch Reviewed-by: Max Gurtovoy Signed-off-by: Christoph Hellwig commit 081f5e753c9c4cd1dd86000bcc7f5fe14cbdcab0 Author: Keith Busch Date: Tue Jul 12 08:16:32 2022 -0700 nvme-pci: fix freeze accounting for error handling A reset on a live device experiencing a link error still needs to have the queue freeze state started for the subsequent reinitialization. Skip only the register read if the device is not present instead of bypassing the freeze checks. Fixes: b98235d3a471e ("nvme-pci: harden drive presence detect in nvme_dev_disable()") Reported-by: Niklas Schnelle Signed-off-by: Keith Busch Tested-by: Niklas Schnelle Signed-off-by: Christoph Hellwig commit 3486af89dd3c0b0bef194c4bccf17c31ef16b99f Merge: 7e50133234007 7c239a071d1f0 Author: Greg Kroah-Hartman Date: Thu Jul 14 16:22:12 2022 +0200 Merge tag 'usb-serial-5.19-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.19-rc7 Here are a couple of new device ids for ftdi_sio. Everything has been in linux-next with no reported issues. * tag 'usb-serial-5.19-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: ftdi_sio: add Belimo device ids commit 7e50133234007f77d40c5ad871960a3171b362c3 Merge: bb160ee61c04f 32346491ddf24 Author: Greg Kroah-Hartman Date: Thu Jul 14 16:18:22 2022 +0200 Merge tag 'v5.19-rc6' into usb-linus The usb-serial fixes are based on this branch, so merge it in here to prevent merge confusion when merging in that tree. Signed-off-by: Greg Kroah-Hartman commit cca3f3381bef16ae04933cc3ff480952f7ae298f Merge: 942d9e89524c1 99482726452bd Author: Paolo Bonzini Date: Thu Jul 14 10:04:12 2022 -0400 Merge commit 'kvm-vmx-nested-tsc-fix' into kvm-master Merge bugfix needed in both 5.19 (because it's bad) and 5.20 (because it is a prerequisite to test new features). commit cd72e61bad145a0968df85193dcf1261cb66c4c6 Author: Nicolas Dichtel Date: Wed Jul 13 13:48:53 2022 +0200 selftests/net: test nexthop without gw This test implement the scenario described in the commit "ip: fix dflt addr selection for connected nexthop". The test configures a nexthop object with an output device only (no gateway address) and a route that uses this nexthop. The goal is to check if the kernel selects a valid source address. Link: https://lore.kernel.org/netdev/20220712095545.10947-1-nicolas.dichtel@6wind.com/ Signed-off-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220713114853.29406-2-nicolas.dichtel@6wind.com Signed-off-by: Paolo Abeni commit 747c14307214b55dbd8250e1ab44cad8305756f1 Author: Nicolas Dichtel Date: Wed Jul 13 13:48:52 2022 +0200 ip: fix dflt addr selection for connected nexthop When a nexthop is added, without a gw address, the default scope was set to 'host'. Thus, when a source address is selected, 127.0.0.1 may be chosen but rejected when the route is used. When using a route without a nexthop id, the scope can be configured in the route, thus the problem doesn't exist. To explain more deeply: when a user creates a nexthop, it cannot specify the scope. To create it, the function nh_create_ipv4() calls fib_check_nh() with scope set to 0. fib_check_nh() calls fib_check_nh_nongw() wich was setting scope to 'host'. Then, nh_create_ipv4() calls fib_info_update_nhc_saddr() with scope set to 'host'. The src addr is chosen before the route is inserted. When a 'standard' route (ie without a reference to a nexthop) is added, fib_create_info() calls fib_info_update_nhc_saddr() with the scope set by the user. iproute2 set the scope to 'link' by default. Here is a way to reproduce the problem: ip netns add foo ip -n foo link set lo up ip netns add bar ip -n bar link set lo up sleep 1 ip -n foo link add name eth0 type dummy ip -n foo link set eth0 up ip -n foo address add 192.168.0.1/24 dev eth0 ip -n foo link add name veth0 type veth peer name veth1 netns bar ip -n foo link set veth0 up ip -n bar link set veth1 up ip -n bar address add 192.168.1.1/32 dev veth1 ip -n bar route add default dev veth1 ip -n foo nexthop add id 1 dev veth0 ip -n foo route add 192.168.1.1 nhid 1 Try to get/use the route: > $ ip -n foo route get 192.168.1.1 > RTNETLINK answers: Invalid argument > $ ip netns exec foo ping -c1 192.168.1.1 > ping: connect: Invalid argument Try without nexthop group (iproute2 sets scope to 'link' by dflt): ip -n foo route del 192.168.1.1 ip -n foo route add 192.168.1.1 dev veth0 Try to get/use the route: > $ ip -n foo route get 192.168.1.1 > 192.168.1.1 dev veth0 src 192.168.0.1 uid 0 > cache > $ ip netns exec foo ping -c1 192.168.1.1 > PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. > 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.039 ms > > --- 192.168.1.1 ping statistics --- > 1 packets transmitted, 1 received, 0% packet loss, time 0ms > rtt min/avg/max/mdev = 0.039/0.039/0.039/0.000 ms CC: stable@vger.kernel.org Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops") Reported-by: Edwin Brossette Signed-off-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220713114853.29406-1-nicolas.dichtel@6wind.com Signed-off-by: Paolo Abeni commit 73d5fe046270281a46344e06bf986c607632f7ea Author: Vaishnav Achath Date: Wed Jun 1 12:46:11 2022 +0530 spi: cadence-quadspi: Remove spi_master_put() in probe failure path Currently the spi_master is allocated by devm_spi_alloc_master() and devres core manages the deallocation, but in probe failure path spi_master_put() is being handled manually which causes "refcount underflow use-after-free" warning when probe failure happens after allocating spi_master. Trimmed backtrace during failure: refcount_t: underflow; use-after-free. pc : refcount_warn_saturate+0xf4/0x144 Call trace: refcount_warn_saturate kobject_put put_device devm_spi_release_controller devres_release_all This commit makes relevant changes to remove spi_master_put() from probe failure path. Fixes: 606e5d408184 ("spi: cadence-quadspi: Handle spi_unregister_master() in remove()") Signed-off-by: Vaishnav Achath Link: https://lore.kernel.org/r/20220601071611.11853-1-vaishnav.a@ti.com Signed-off-by: Mark Brown commit 1e347f861da8ddb17e1d1b3113cb6c188e0de3e5 Author: Mark Brown Date: Wed Jul 13 14:04:51 2022 +0100 ASoC: rockchip-i2s: Undo BCLK pinctrl changes The version of the BCLK pinctrl management changes that made it into v5.19 has caused problems on some systems due to overly strict DT requirements but attempts to fix it have caused further breakage on other platforms. Just drop the changes for this release, we already have a better version queued for -next. Fixes: 26b9f2fa7b1c ("ASoC: rockchip: i2s: Fix NULL pointer dereference when pinctrl is not found") Fixes: a5450aba737d ("ASoC: rockchip: i2s: switch BCLK to GPIO") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220713130451.31481-1-broonie@kernel.org Signed-off-by: Mark Brown commit 29589ca09a74cfc0c50ad002e298bf4b8e69e0bd Author: Ard Biesheuvel Date: Tue May 31 09:49:24 2022 +0100 ARM: 9208/1: entry: add .ltorg directive to keep literals in range LKP reports a build issue on Clang, related to a literal load of __current issued through the ldr_va macro. This turns out to be due to the fact that group relocations are disabled when CONFIG_COMPILE_TEST=y, which means that the ldr_va macro resolves to a pair of LDR instructions, the first one being a literal load issued too far from its literal pool. Due to the introduction of a couple of new uses of this macro in commit 508074607c7b95b2 ("ARM: 9195/1: entry: avoid explicit literal loads"), the literal pools end up getting rearranged in a way that causes the literal for __current to go out of range. Let's fix this up by putting a .ltorg directive in a suitable place in the code. Link: https://lore.kernel.org/all/202205290805.1vZLAr36-lkp@intel.com/ Fixes: 508074607c7b95b2 ("ARM: 9195/1: entry: avoid explicit literal loads") Reported-by: kernel test robot Signed-off-by: Ard Biesheuvel Tested-by: Nathan Chancellor Signed-off-by: Russell King (Oracle) commit 8030aa3ce12e3b9d47afa62344c601ed508c2d9e Author: Wang Kefeng Date: Tue May 24 09:03:46 2022 +0100 ARM: 9207/1: amba: fix refcount underflow if amba_device_add() fails "ARM: 9192/1: amba: fix memory leak in amba_device_try_add()" leads to a refcount underflow if amba_device_add() fails, which called by of_amba_device_create(), the of_amba_device_create() already exists the error handling, so amba_put_device() only need to be added into amba_deferred_retry(). Fixes: 7719a68b2fa4 ("ARM: 9192/1: amba: fix memory leak in amba_device_try_add()") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Kefeng Wang Signed-off-by: Russell King (Oracle) commit 942d9e89524c135615e557fffa144104ea8fb361 Author: Paolo Bonzini Date: Thu Jul 14 07:29:57 2022 -0400 Documentation: kvm: clarify histogram units In the case of histogram statistics, the values are always sample counts; the unit instead applies to the bucket range. For example, halt_poll_success_hist is a nanosecond statistic because the buckets are for 0ns, 1ns, 2-3ns, 4-7ns etc. There isn't really any other sensible interpretation, but clarify this anyway in the Documentation. Signed-off-by: Paolo Bonzini commit 1b870fa5573e260bc74d19f381ab0dd971a8d8e7 Author: Paolo Bonzini Date: Thu Jul 14 07:27:31 2022 -0400 kvm: stats: tell userspace which values are boolean Some of the statistics values exported by KVM are always only 0 or 1. It can be useful to export this fact to userspace so that it can track them specially (for example by polling the value every now and then to compute a % of time spent in a specific state). Therefore, add "boolean value" as a new "unit". While it is not exactly a unit, it walks and quacks like one. In particular, using the type would be wrong because boolean values could be instantaneous or peak values (e.g. "is the rmap allocated?") or even two-bucket histograms (e.g. "number of posted vs. non-posted interrupt injections"). Suggested-by: Amneesh Singh Signed-off-by: Paolo Bonzini commit 84e7051c0bc1f2a13101553959b3a9d9a8e24939 Author: Thadeu Lima de Souza Cascardo Date: Wed Jul 13 14:12:41 2022 -0300 x86/kvm: fix FASTOP_SIZE when return thunks are enabled The return thunk call makes the fastop functions larger, just like IBT does. Consider a 16-byte FASTOP_SIZE when CONFIG_RETHUNK is enabled. Otherwise, functions will be incorrectly aligned and when computing their position for differently sized operators, they will executed in the middle or end of a function, which may as well be an int3, leading to a crash like: [ 36.091116] int3: 0000 [#1] SMP NOPTI [ 36.091119] CPU: 3 PID: 1371 Comm: qemu-system-x86 Not tainted 5.15.0-41-generic #44 [ 36.091120] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 36.091121] RIP: 0010:xaddw_ax_dx+0x9/0x10 [kvm] [ 36.091185] Code: 00 0f bb d0 c3 cc cc cc cc 48 0f bb d0 c3 cc cc cc cc 0f 1f 80 00 00 00 00 0f c0 d0 c3 cc cc cc cc 66 0f c1 d0 c3 cc cc cc cc <0f> 1f 80 00 00 00 00 0f c1 d0 c3 cc cc cc cc 48 0f c1 d0 c3 cc cc [ 36.091186] RSP: 0018:ffffb1f541143c98 EFLAGS: 00000202 [ 36.091188] RAX: 0000000089abcdef RBX: 0000000000000001 RCX: 0000000000000000 [ 36.091188] RDX: 0000000076543210 RSI: ffffffffc073c6d0 RDI: 0000000000000200 [ 36.091189] RBP: ffffb1f541143ca0 R08: ffff9f1803350a70 R09: 0000000000000002 [ 36.091190] R10: ffff9f1803350a70 R11: 0000000000000000 R12: ffff9f1803350a70 [ 36.091190] R13: ffffffffc077fee0 R14: 0000000000000000 R15: 0000000000000000 [ 36.091191] FS: 00007efdfce8d640(0000) GS:ffff9f187dd80000(0000) knlGS:0000000000000000 [ 36.091192] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.091192] CR2: 0000000000000000 CR3: 0000000009b62002 CR4: 0000000000772ee0 [ 36.091195] PKRU: 55555554 [ 36.091195] Call Trace: [ 36.091197] [ 36.091198] ? fastop+0x5a/0xa0 [kvm] [ 36.091222] x86_emulate_insn+0x7b8/0xe90 [kvm] [ 36.091244] x86_emulate_instruction+0x2f4/0x630 [kvm] [ 36.091263] ? kvm_arch_vcpu_load+0x7c/0x230 [kvm] [ 36.091283] ? vmx_prepare_switch_to_host+0xf7/0x190 [kvm_intel] [ 36.091290] complete_emulated_mmio+0x297/0x320 [kvm] [ 36.091310] kvm_arch_vcpu_ioctl_run+0x32f/0x550 [kvm] [ 36.091330] kvm_vcpu_ioctl+0x29e/0x6d0 [kvm] [ 36.091344] ? kvm_vcpu_ioctl+0x120/0x6d0 [kvm] [ 36.091357] ? __fget_files+0x86/0xc0 [ 36.091362] ? __fget_files+0x86/0xc0 [ 36.091363] __x64_sys_ioctl+0x92/0xd0 [ 36.091366] do_syscall_64+0x59/0xc0 [ 36.091369] ? syscall_exit_to_user_mode+0x27/0x50 [ 36.091370] ? do_syscall_64+0x69/0xc0 [ 36.091371] ? syscall_exit_to_user_mode+0x27/0x50 [ 36.091372] ? __x64_sys_writev+0x1c/0x30 [ 36.091374] ? do_syscall_64+0x69/0xc0 [ 36.091374] ? exit_to_user_mode_prepare+0x37/0xb0 [ 36.091378] ? syscall_exit_to_user_mode+0x27/0x50 [ 36.091379] ? do_syscall_64+0x69/0xc0 [ 36.091379] ? do_syscall_64+0x69/0xc0 [ 36.091380] ? do_syscall_64+0x69/0xc0 [ 36.091381] ? do_syscall_64+0x69/0xc0 [ 36.091381] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.091384] RIP: 0033:0x7efdfe6d1aff [ 36.091390] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ 36.091391] RSP: 002b:00007efdfce8c460 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 36.091393] RAX: ffffffffffffffda RBX: 000000000000ae80 RCX: 00007efdfe6d1aff [ 36.091393] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000c [ 36.091394] RBP: 0000558f1609e220 R08: 0000558f13fb8190 R09: 00000000ffffffff [ 36.091394] R10: 0000558f16b5e950 R11: 0000000000000246 R12: 0000000000000000 [ 36.091394] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 36.091396] [ 36.091397] Modules linked in: isofs nls_iso8859_1 kvm_intel joydev kvm input_leds serio_raw sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ipmi_devintf ipmi_msghandler drm msr ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel virtio_net net_failover crypto_simd ahci xhci_pci cryptd psmouse virtio_blk libahci xhci_pci_renesas failover [ 36.123271] ---[ end trace db3c0ab5a48fabcc ]--- [ 36.123272] RIP: 0010:xaddw_ax_dx+0x9/0x10 [kvm] [ 36.123319] Code: 00 0f bb d0 c3 cc cc cc cc 48 0f bb d0 c3 cc cc cc cc 0f 1f 80 00 00 00 00 0f c0 d0 c3 cc cc cc cc 66 0f c1 d0 c3 cc cc cc cc <0f> 1f 80 00 00 00 00 0f c1 d0 c3 cc cc cc cc 48 0f c1 d0 c3 cc cc [ 36.123320] RSP: 0018:ffffb1f541143c98 EFLAGS: 00000202 [ 36.123321] RAX: 0000000089abcdef RBX: 0000000000000001 RCX: 0000000000000000 [ 36.123321] RDX: 0000000076543210 RSI: ffffffffc073c6d0 RDI: 0000000000000200 [ 36.123322] RBP: ffffb1f541143ca0 R08: ffff9f1803350a70 R09: 0000000000000002 [ 36.123322] R10: ffff9f1803350a70 R11: 0000000000000000 R12: ffff9f1803350a70 [ 36.123323] R13: ffffffffc077fee0 R14: 0000000000000000 R15: 0000000000000000 [ 36.123323] FS: 00007efdfce8d640(0000) GS:ffff9f187dd80000(0000) knlGS:0000000000000000 [ 36.123324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.123325] CR2: 0000000000000000 CR3: 0000000009b62002 CR4: 0000000000772ee0 [ 36.123327] PKRU: 55555554 [ 36.123328] Kernel panic - not syncing: Fatal exception in interrupt [ 36.123410] Kernel Offset: 0x1400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 36.135305] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: aa3d480315ba ("x86: Use return-thunk in asm code") Signed-off-by: Thadeu Lima de Souza Cascardo Co-developed-by: Peter Zijlstra (Intel) Cc: Borislav Petkov Cc: Josh Poimboeuf Cc: Paolo Bonzini Reported-by: Linux Kernel Functional Testing Message-Id: <20220713171241.184026-1-cascardo@canonical.com> Tested-by: Jack Wang Signed-off-by: Paolo Bonzini commit 99482726452bdf8be9325199022b17fa6d7d58fe Author: Vitaly Kuznetsov Date: Tue Jul 12 15:50:09 2022 +0200 KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 Windows 10/11 guests with Hyper-V role (WSL2) enabled are observed to hang upon boot or shortly after when a non-default TSC frequency was set for L1. The issue is observed on a host where TSC scaling is supported. The problem appears to be that Windows doesn't use TSC frequency for its guests even when the feature is advertised and KVM filters SECONDARY_EXEC_TSC_SCALING out when creating L2 controls from L1's. This leads to L2 running with the default frequency (matching host's) while L1 is running with an altered one. Keep SECONDARY_EXEC_TSC_SCALING in secondary exec controls for L2 when it was set for L1. TSC_MULTIPLIER is already correctly computed and written by prepare_vmcs02(). Signed-off-by: Vitaly Kuznetsov Reviewed-by: Maxim Levitsky Message-Id: <20220712135009.952805-1-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit 564d998106397394b6aad260f219b882b3347e62 Author: Peter Zijlstra Date: Thu Jul 14 12:20:19 2022 +0200 um: Add missing apply_returns() Implement apply_returns() stub for UM, just like all the other patching routines. Fixes: 15e67227c49a ("x86: Undo return-thunk damage") Reported-by: Randy Dunlap Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/Ys%2Ft45l%2FgarIrD0u@worktop.programming.kicks-ass.net commit 2e15c51fefaffaf9f72255eaef4fada05055e4c5 Author: Chia-Lin Kao (AceLan) Date: Wed Jul 13 19:12:24 2022 +0800 net: atlantic: remove aq_nic_deinit() when resume aq_nic_deinit() has been called while suspending, so we don't have to call it again on resume. Actually, call it again leads to another hang issue when resuming from S3. Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992345] Call Trace: Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992346] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992356] aq_pm_thaw+0x7f/0x100 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992362] pci_pm_resume+0x5c/0x90 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992366] ? pci_pm_thaw+0x80/0x80 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992368] dpm_run_callback+0x4e/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992371] device_resume+0xad/0x200 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992373] async_resume+0x1e/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_entry_fn+0x33/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992377] process_one_work+0x220/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992380] worker_thread+0x4d/0x3f0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992382] ? process_one_work+0x3c0/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992384] kthread+0x12a/0x150 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992386] ? set_kthread_struct+0x40/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992391] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992392] ---[ end trace 1ec8c79604ed5e0d ]--- Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992394] PM: dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -110 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992397] atlantic 0000:02:00.0: PM: failed to resume async: error -110 Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") Signed-off-by: Chia-Lin Kao (AceLan) Link: https://lore.kernel.org/r/20220713111224.1535938-2-acelan.kao@canonical.com Signed-off-by: Paolo Abeni commit 0f33250760384e05c36466b0a2f92f3c6007ba92 Author: Chia-Lin Kao (AceLan) Date: Wed Jul 13 19:12:23 2022 +0800 net: atlantic: remove deep parameter on suspend/resume functions Below commit claims that atlantic NIC requires to reset the device on pm op, and had set the deep to true for all suspend/resume functions. commit 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") So, we could remove deep parameter on suspend/resume functions without any functional change. Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") Signed-off-by: Chia-Lin Kao (AceLan) Link: https://lore.kernel.org/r/20220713111224.1535938-1-acelan.kao@canonical.com Signed-off-by: Paolo Abeni commit ada74c5539eba06cf8b47d068f92e0b3963a9a6e Author: Íñigo Huguet Date: Wed Jul 13 11:21:16 2022 +0200 sfc: fix kernel panic when creating VF When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUG_ON(in_interrupt()); This patch reenables BH to release the buffer. Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip... Fixes: d778819609a2 ("sfc: DMA the VF stats only when requested") Reported-by: Ma Yuying Signed-off-by: Íñigo Huguet Acked-by: Edward Cree Link: https://lore.kernel.org/r/20220713092116.21238-1-ihuguet@redhat.com Signed-off-by: Paolo Abeni commit d13122ca3cdf75f0ab82b4080c2058604834d1da Merge: 4a57a8400075b be82abe6a76ba Author: Paolo Bonzini Date: Thu Jul 14 06:01:53 2022 -0400 Merge tag 'kvm-riscv-fixes-5.19-2' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 5.19, take #2 - Fix missing PAGE_PFN_MASK - Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests() commit cc91b09b9ef8f8a9f29b4fdff5f65ab5700872e2 Merge: f46a5a9c679f4 4889fbd98deaf Author: Paolo Abeni Date: Thu Jul 14 10:15:15 2022 +0200 Merge branch 'seg6-fix-skb-checksum-for-srh-encapsulation-insertion' Andrea Mayer says: ==================== seg6: fix skb checksum for SRH encapsulation/insertion The Linux kernel supports Segment Routing Header (SRH) encapsulation/insertion operations by providing the capability to: i) encapsulate a packet in an outer IPv6 header with a specified SRH; ii) insert a specified SRH directly after the IPv6 header of the packet. Note that the insertion operation is also referred to as 'injection'. The two operations are respectively supported by seg6_do_srh_encap() and seg6_do_srh_inline(), which operate on the skb associated to the packet as needed (e.g. adding the necessary headers and initializing them, while taking care to recalculate the skb checksum). seg6_do_srh_encap() and seg6_do_srh_inline() do not initialize the payload length of the IPv6 header, which is carried out by the caller functions. However, this approach causes the corruption of the skb checksum which needs to be updated only after initialization of headers is completed (thanks to Paolo Abeni for detecting this issue). The patchset fixes the skb checksum corruption by moving the IPv6 header payload length initialization from the callers of seg6_do_srh_encap() and seg6_do_srh_inline() directly into these functions. This patchset is organized as follows: - patch 1/3, seg6: fix skb checksum evaluation in SRH encapsulation/insertion; (* SRH encapsulation/insertion available since v4.10) - patch 2/3, seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors; (* SRv6 End.B6 and End.B6.Encaps behaviors available since v4.14) - patch 3/3, seg6: bpf: fix skb checksum in bpf_push_seg6_encap(); (* bpf IPv6 Segment Routing helpers available since v4.18) ==================== Link: https://lore.kernel.org/r/20220712175837.16267-1-andrea.mayer@uniroma2.it Signed-off-by: Paolo Abeni commit 4889fbd98deaf243c3baadc54e296d71c6af1eb0 Author: Andrea Mayer Date: Tue Jul 12 19:58:37 2022 +0200 seg6: bpf: fix skb checksum in bpf_push_seg6_encap() Both helper functions bpf_lwt_seg6_action() and bpf_lwt_push_encap() use the bpf_push_seg6_encap() to encapsulate the packet in an IPv6 with Segment Routing Header (SRH) or insert an SRH between the IPv6 header and the payload. To achieve this result, such helper functions rely on bpf_push_seg6_encap() which, in turn, leverages seg6_do_srh_{encap,inline}() to perform the required operation (i.e. encap/inline). This patch removes the initialization of the IPv6 header payload length from bpf_push_seg6_encap(), as it is now handled properly by seg6_do_srh_{encap,inline}() to prevent corruption of the skb checksum. Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers") Signed-off-by: Andrea Mayer Signed-off-by: Paolo Abeni commit f048880fc77058d864aff5c674af7918b30f312a Author: Andrea Mayer Date: Tue Jul 12 19:58:36 2022 +0200 seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors The SRv6 End.B6 and End.B6.Encaps behaviors rely on functions seg6_do_srh_{encap,inline}() to, respectively: i) encapsulate the packet within an outer IPv6 header with the specified Segment Routing Header (SRH); ii) insert the specified SRH directly after the IPv6 header of the packet. This patch removes the initialization of the IPv6 header payload length from the input_action_end_b6{_encap}() functions, as it is now handled properly by seg6_do_srh_{encap,inline}() to avoid corruption of the skb checksum. Fixes: 140f04c33bbc ("ipv6: sr: implement several seg6local actions") Signed-off-by: Andrea Mayer Signed-off-by: Paolo Abeni commit df8386d13ea280d55beee1b95f61a59234a3798b Author: Andrea Mayer Date: Tue Jul 12 19:58:35 2022 +0200 seg6: fix skb checksum evaluation in SRH encapsulation/insertion Support for SRH encapsulation and insertion was introduced with commit 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels"), through the seg6_do_srh_encap() and seg6_do_srh_inline() functions, respectively. The former encapsulates the packet in an outer IPv6 header along with the SRH, while the latter inserts the SRH between the IPv6 header and the payload. Then, the headers are initialized/updated according to the operating mode (i.e., encap/inline). Finally, the skb checksum is calculated to reflect the changes applied to the headers. The IPv6 payload length ('payload_len') is not initialized within seg6_do_srh_{inline,encap}() but is deferred in seg6_do_srh(), i.e. the caller of seg6_do_srh_{inline,encap}(). However, this operation invalidates the skb checksum, since the 'payload_len' is updated only after the checksum is evaluated. To solve this issue, the initialization of the IPv6 payload length is moved from seg6_do_srh() directly into the seg6_do_srh_{inline,encap}() functions and before the skb checksum update takes place. Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") Reported-by: Paolo Abeni Link: https://lore.kernel.org/all/20220705190727.69d532417be7438b15404ee1@uniroma2.it Signed-off-by: Andrea Mayer Signed-off-by: Paolo Abeni commit fac47b43c760ea90e64b895dba60df0327be7775 Author: Xiubo Li Date: Mon Jul 11 12:11:21 2022 +0800 netfs: do not unlock and put the folio twice check_write_begin() will unlock and put the folio when return non-zero. So we should avoid unlocking and putting it twice in netfs layer. Change the way ->check_write_begin() works in the following two ways: (1) Pass it a pointer to the folio pointer, allowing it to unlock and put the folio prior to doing the stuff it wants to do, provided it clears the folio pointer. (2) Change the return values such that 0 with folio pointer set means continue, 0 with folio pointer cleared means re-get and all error codes indicating an error (no special treatment for -EAGAIN). [ bagasdotme: use Sphinx code text syntax for *foliop pointer ] Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/56423 Link: https://lore.kernel.org/r/cf169f43-8ee7-8697-25da-0204d1b4343e@redhat.com Co-developed-by: David Howells Signed-off-by: Xiubo Li Signed-off-by: David Howells Signed-off-by: Bagas Sanjaya Signed-off-by: Ilya Dryomov commit d16e0b26672066035439b2f49887f6576c4a3689 Author: Alexandre Chartre Date: Wed Jul 13 21:58:08 2022 +0200 x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt UNTRAIN_RET is not needed in native_irq_return_ldt because RET untraining has already been done at this point. In addition, when the RETBleed mitigation is IBPB, UNTRAIN_RET clobbers several registers (AX, CX, DX) so here it trashes user values which are in these registers. Signed-off-by: Alexandre Chartre Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/35b0d50f-12d1-10c3-f5e8-d6c140486d4a@oracle.com commit 33a8573bdfeec5b746aedeea880733a4c7993158 Author: Jiapeng Chong Date: Thu Jul 14 15:29:39 2022 +0800 x86/bugs: Mark retbleed_strings static This symbol is not used outside of bugs.c, so mark it static. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220714072939.71162-1-jiapeng.chong@linux.alibaba.com commit 355bf2e036c954317ddc4a9618b4f7e38ea5a970 Author: Changyuan Lyu Date: Fri Jul 8 13:50:26 2022 -0700 scsi: pm80xx: Set stopped phy's linkrate to Disabled Negotiated link rate needs to be updated to 'Disabled' when phy is stopped. Link: https://lore.kernel.org/r/20220708205026.969161-1-changyuanl@google.com Reviewed-by: Igor Pylypiv Signed-off-by: Changyuan Lyu Signed-off-by: Martin K. Petersen commit e78276cadb669d3e55cffe66bd166ff3c8572e38 Author: Changyuan Lyu Date: Thu Jul 7 10:52:10 2022 -0700 scsi: pm80xx: Fix 'Unknown' max/min linkrate Currently, the data flow of the max/min linkrate in the driver is * in pm8001_get_lrate_mode(): hardcoded value ==> struct sas_phy * in pm8001_bytes_dmaed(): struct pm8001_phy ==> struct sas_phy * in pm8001_phy_control(): libsas data ==> struct pm8001_phy Since pm8001_bytes_dmaed() follows pm8001_get_lrate_mode(), and the fields in struct pm8001_phy are not initialized, sysfs `/sys/class/sas_phy/phy-*/maximum_linkrate` always shows `Unknown`. To fix the issue, change the dataflow to the following: * in pm8001_phy_init(): initial value ==> struct pm8001_phy * in pm8001_get_lrate_mode(): struct pm8001_phy ==> struct sas_phy * in pm8001_phy_control(): libsas data ==> struct pm8001_phy For negotiated linkrate, the current dataflow is: * in pm8001_get_lrate_mode(): iomb data ==> struct asd_sas_phy ==> struct sas_phy * in pm8001_bytes_dmaed(): struct asd_sas_phy ==> struct sas_phy Since pm8001_bytes_dmaed() follows pm8001_get_lrate_mode(), the assignment statements in pm8001_bytes_dmaed() are unnecessary and cleaned up. Link: https://lore.kernel.org/r/20220707175210.528858-1-changyuanl@google.com Reviewed-by: Igor Pylypiv Acked-by: Jack Wang Signed-off-by: Changyuan Lyu Signed-off-by: Martin K. Petersen commit 52a518019ca187227b786f8b8ee20869a97f3af4 Author: Po-Wen Kao Date: Mon Jul 11 22:42:23 2022 +0800 scsi: ufs: core: Fix missing clk change notification on host reset In ufshcd_host_reset_and_restore(), ufshcd_set_clk_freq() is called to scale clock rate. However, this did not call vops->clk_scale_notify() to inform platform driver of clock change. Call ufshcd_scale_clks() instead so that clock change can be properly handled. Link: https://lore.kernel.org/r/20220711144224.17916-2-powen.kao@mediatek.com Reviewed-by: Bart Van Assche Reviewed-by: Stanley Chu Signed-off-by: Po-Wen Kao Signed-off-by: Martin K. Petersen commit 2ae57c995003a7840cb6b5ec5f0c06193695321b Author: Bjorn Andersson Date: Fri Jul 8 17:00:27 2022 -0700 scsi: ufs: core: Drop loglevel of WriteBoost message Commit '3b5f3c0d0548 ("scsi: ufs: core: Tidy up WB configuration code")' changed the log level of the write boost enable/disable notification from debug to info. This results in a lot of noise in the kernel log during normal operation. Drop it back to debug level to avoid this. Link: https://lore.kernel.org/r/20220709000027.3929970-1-bjorn.andersson@linaro.org Fixes: 3b5f3c0d0548 ("scsi: ufs: core: Tidy up WB configuration code") Reviewed-by: Alim Akhtar Acked-by: Bean Huo Signed-off-by: Bjorn Andersson Signed-off-by: Martin K. Petersen commit f46a5a9c679f495c555b7842807db5e886a9e650 Merge: ebe41da5d47ac 7b6f9462a3234 Author: Jakub Kicinski Date: Wed Jul 13 20:16:03 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-07-12 This series contains updates to ice driver only. Paul fixes detection of E822 devices for firmware update and changes NVM read for snapshot creation to be done in chunks as some systems cannot read the entire NVM in the allotted time. ==================== Link: https://lore.kernel.org/r/20220712164829.7275-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8312cd3a7b835ae3033a679e5f0014a40e7891c5 Author: Ming Lei Date: Wed Jul 6 20:59:42 2022 +0800 scsi: megaraid: Clear READ queue map's nr_queues The megaraid SCSI driver sets set->nr_maps as 3 if poll_queues is > 0, and blk-mq actually initializes each map's nr_queues as nr_hw_queues. Consequently the driver has to clear READ queue map's nr_queues, otherwise the queue map becomes broken if poll_queues is set as non-zero. Link: https://lore.kernel.org/r/20220706125942.528533-1-ming.lei@redhat.com Fixes: 9e4bec5b2a23 ("scsi: megaraid_sas: mq_poll support") Cc: Kashyap Desai Cc: sumit.saxena@broadcom.com Cc: chandrakanth.patil@broadcom.com Cc: linux-block@vger.kernel.org Cc: Hannes Reinecke Reported-by: Guangwu Zhang Tested-by: Guangwu Zhang Reviewed-by: Bart Van Assche Signed-off-by: Ming Lei Signed-off-by: Martin K. Petersen commit ebe41da5d47ac0fff877e57bd14c54dccf168827 Author: Íñigo Huguet Date: Tue Jul 12 08:26:42 2022 +0200 sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vports, called from efx_ef10_sriov_free_vf_vswitching. Set the pointer to NULL at release time to not trying to read it later. Reproducer and dmesg log (note that kfence doesn't detect it every time): $ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs $ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] efx_ef10_pci_sriov_disable+0x38/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k allocated by task 6771 on cpu 10 at 3137.860196s: pci_alloc_dev+0x21/0x60 pci_iov_add_virtfn+0x2a2/0x320 sriov_enable+0x212/0x3e0 efx_ef10_sriov_configure+0x67/0x80 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xba/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae freed by task 6771 on cpu 12 at 3170.991309s: device_release+0x34/0x90 kobject_cleanup+0x3a/0x130 pci_iov_remove_virtfn+0xd9/0x120 sriov_disable+0x30/0xe0 efx_ef10_pci_sriov_disable+0x57/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 3c5eb87605e85 ("sfc: create vports for VFs and assign random MAC addresses") Reported-by: Yanghang Liu Signed-off-by: Íñigo Huguet Acked-by: Martin Habets Link: https://lore.kernel.org/r/20220712062642.6915-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 32f319183c439b239294cb2d70ada3564c4c7c39 Author: Steve French Date: Tue Jul 12 00:11:42 2022 -0500 smb3: workaround negprot bug in some Samba servers Mount can now fail to older Samba servers due to a server bug handling padding at the end of the last negotiate context (negotiate contexts typically are rounded up to 8 bytes by adding padding if needed). This server bug can be avoided by switching the order of negotiate contexts, placing a negotiate context at the end that does not require padding (prior to the recent netname context fix this was the case on the client). Fixes: 73130a7b1ac9 ("smb3: fix empty netname context on secondary channels") Reported-by: Julian Sikorski Tested-by: Julian Sikorski Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit fbd74d16890b9f5d08ea69b5282b123c894f8860 Author: Mario Limonciello Date: Wed Jul 13 12:53:46 2022 -0500 ACPI: CPPC: Fix enabling CPPC on AMD systems with shared memory When commit 72f2ecb7ece7 ("ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported") was introduced, we found collateral damage that a number of AMD systems that supported CPPC but didn't advertise support in _OSC stopped having a functional amd-pstate driver. The _OSC was only enforced on Intel systems at that time. This was fixed for the MSR based designs by commit 8b356e536e69f ("ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported") but some shared memory based designs also support CPPC but haven't advertised support in the _OSC. Add support for those designs as well by hardcoding the list of systems. Fixes: 72f2ecb7ece7 ("ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported") Fixes: 8b356e536e69f ("ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported") Link: https://lore.kernel.org/all/3559249.JlDtxWtqDm@natalenko.name/ Cc: 5.18+ # 5.18+ Reported-and-tested-by: Oleksandr Natalenko Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit 4a57a8400075bc5287c5c877702c68aeae2a033d Author: Ansgar Lößer Date: Wed Jul 13 20:51:44 2022 +0200 vf/remap: return the amount of bytes actually deduplicated When using the FIDEDUPRANGE ioctl, in case of success the requested size is returned. In some cases this might not be the actual amount of bytes deduplicated. This change modifies vfs_dedupe_file_range() to report the actual amount of bytes deduplicated, instead of the requested amount. Link: https://lore.kernel.org/linux-fsdevel/5548ef63-62f9-4f46-5793-03165ceccacc@tu-darmstadt.de/ Reported-by: Ansgar Lößer Reported-by: Max Schlecht Reported-by: Björn Scheuermann Cc: Dave Chinner Cc: Darrick J Wong Signed-off-by: Ansgar Lößer Signed-off-by: Linus Torvalds commit d0b97f3891fb414bd1fd1cb3d83f0f6b9fd0d357 Merge: 5750676b64a56 07fd5b6cdf3cc Author: Linus Torvalds Date: Wed Jul 13 11:47:01 2022 -0700 Merge tag 'cgroup-for-5.19-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "Fix an old and subtle bug in the migration path. css_sets are used to track tasks and migrations are tasks moving from a group of css_sets to another group of css_sets. The migration path pins all source and destination css_sets in the prep stage. Unfortunately, it was overloading the same list_head entry to track sources and destinations, which got confused for migrations which are partially identity leading to use-after-frees. Fixed by using dedicated list_heads for tracking sources and destinations" * tag 'cgroup-for-5.19-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Use separate src/dst nodes when preloading css_sets for migration commit 7fccd723912702acfc2d75e8f0596982534f7f24 Merge: dc5cb7a833e83 efa310ba00716 Author: Palmer Dabbelt Date: Wed Jul 13 10:42:57 2022 -0700 Merge tag 'dt-fixes-for-palmer-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git into fixes Microchip RISC-V devicetree fixes for 5.19-rc6 A single fix for mpfs.dtsi: - The l2 cache controller was never hooked up in the dt, so userspace is presented with the wrong topology information, so it has been hooked up. * tag 'dt-fixes-for-palmer-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git: riscv: dts: microchip: hook up the mpfs' l2cache commit 5750676b64a561f7ec920d7c6ba130fc9c7378f3 Author: Dave Chinner Date: Wed Jul 13 17:49:15 2022 +1000 fs/remap: constrain dedupe of EOF blocks If dedupe of an EOF block is not constrainted to match against only other EOF blocks with the same EOF offset into the block, it can match against any other block that has the same matching initial bytes in it, even if the bytes beyond EOF in the source file do not match. Fix this by constraining the EOF block matching to only match against other EOF blocks that have identical EOF offsets and data. This allows "whole file dedupe" to continue to work without allowing eof blocks to randomly match against partial full blocks with the same data. Reported-by: Ansgar Lößer Fixes: 1383a7ed6749 ("vfs: check file ranges before cloning files") Link: https://lore.kernel.org/linux-fsdevel/a7c93559-4ba1-df2f-7a85-55a143696405@tu-darmstadt.de/ Signed-off-by: Dave Chinner Signed-off-by: Linus Torvalds commit 3283c83eb6fcfbda8ea03d7149d8e42e71c5d45e Author: Michel Dänzer Date: Mon Jul 11 16:51:31 2022 +0200 drm/amd/display: Ensure valid event timestamp for cursor-only commits Requires enabling the vblank machinery for them. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2030 Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 47053b1e7382628dd30415685ae257f766a311e4 Author: Melissa Wen Date: Tue Jul 12 10:32:39 2022 -0100 drm/amd/display: correct check of coverage blend mode Check the value of per_pixel_alpha to decide whether the Coverage pixel blend mode is applicable or not. Fixes: 76818cdd11a2 ("drm/amd/display: add Coverage blend mode for overlay plane") Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Harry Wentland Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit 0638c98c17aa12fe914459c82cd178247e21fb2b Author: Yefim Barashkin Date: Mon Jul 11 14:35:11 2022 -0800 drm/amd/pm: Prevent divide by zero divide error: 0000 [#1] SMP PTI CPU: 3 PID: 78925 Comm: tee Not tainted 5.15.50-1-lts #1 Hardware name: MSI MS-7A59/Z270 SLI PLUS (MS-7A59), BIOS 1.90 01/30/2018 RIP: 0010:smu_v11_0_set_fan_speed_rpm+0x11/0x110 [amdgpu] Speed is user-configurable through a file. I accidentally set it to zero, and the driver crashed. Reviewed-by: Evan Quan Reviewed-by: André Almeida Signed-off-by: Yefim Barashkin Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit add61d3c31de6a4b5e11a2ab96aaf4c873481568 Author: Mario Kleiner Date: Mon Jul 11 19:39:28 2022 +0200 drm/amd/display: Only use depth 36 bpp linebuffers on DCN display engines. Various DCE versions had trouble with 36 bpp lb depth, requiring fixes, last time in commit 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display on CIK GPUs") for DCE-8. So far >= DCE-11.2 was considered ok, but now I found out that on DCE-11.2 it causes dithering when there shouldn't be any, so identity pixel passthrough with identity gamma LUTs doesn't work when it should. This breaks various important neuroscience applications, as reported to me by scientific users of Polaris cards under Ubuntu 22.04 with Linux 5.15, and confirmed by testing it myself on DCE-11.2. Lets only use depth 36 for DCN engines, where my testing showed that it is both necessary for high color precision output, e.g., RGBA16 fb's, and not harmful, as far as more than one year in real-world use showed. DCE engines seem to work fine for high precision output at 30 bpp, so this ("famous last words") depth 30 should hopefully fix all known problems without introducing new ones. Successfully retested on DCE-11.2 Polaris and DCN-1.0 Raven Ridge on top of Linux 5.19.0-rc2 + drm-next. Fixes: 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display on CIK GPUs") Signed-off-by: Mario Kleiner Tested-by: Mario Kleiner Cc: stable@vger.kernel.org # 5.14.0 Cc: Alex Deucher Cc: Harry Wentland Signed-off-by: Alex Deucher commit c0044865480a162146b9dfe7783e73a08e97b2b9 Author: Prike Liang Date: Mon Jul 11 16:03:08 2022 +0800 drm/amdkfd: correct the MEC atomic support firmware checking for GC 10.3.7 On the GC 10.3.7 platform the initial MEC release version #3 can support atomic operation,so need correct and set its MEC atomic support version to #3. Signed-off-by: Prike Liang Reviewed-by: Aaron Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit acea108fa067d140bd155161a79b1fcd967f4137 Author: Fangzhi Zuo Date: Wed Jul 6 15:52:46 2022 -0400 drm/amd/display: Ignore First MST Sideband Message Return Error [why] First MST sideband message returns AUX_RET_ERROR_HPD_DISCON on certain intel platform. Aux transaction considered failure if HPD unexpected pulled low. The actual aux transaction success in such case, hence do not return error. [how] Not returning error when AUX_RET_ERROR_HPD_DISCON detected on the first sideband message. v2: squash in additional DMI entries v3: squash in static fix Signed-off-by: Fangzhi Zuo Acked-by: Solomon Chiu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 067d2521874135267e681c19d42761c601d503d6 Author: Jianglei Nie Date: Tue Jul 12 09:10:37 2022 +0800 ima: Fix potential memory leak in ima_init_crypto() On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the ima_algo_array. Add the missing kfree() for ima_algo_array to avoid the potential memory leak. Signed-off-by: Jianglei Nie Fixes: 6d94809af6b0 ("ima: Allocate and initialize tfm for each PCR bank") Signed-off-by: Mimi Zohar commit af16df54b89dee72df253abc5e7b5e8a6d16c11c Author: Coiby Xu Date: Wed Jul 13 15:21:11 2022 +0800 ima: force signature verification when CONFIG_KEXEC_SIG is configured Currently, an unsigned kernel could be kexec'ed when IMA arch specific policy is configured unless lockdown is enabled. Enforce kernel signature verification check in the kexec_file_load syscall when IMA arch specific policy is configured. Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") Reported-and-suggested-by: Mimi Zohar Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit b11e5f6a3a5c170d16c2cf0b1d8053bbf1f6b7de Author: Nick Bowler Date: Tue Jul 12 21:58:35 2022 -0400 net: sunhme: output link status with a single print. This driver currently prints the link status using four separate printk calls, which these days gets presented to the user as four distinct messages, not exactly ideal: [ 32.582778] eth0: Link is up using [ 32.582828] internal [ 32.582837] transceiver at [ 32.582888] 100Mb/s, Full Duplex. Restructure the display_link_mode function to use a single netdev_info call to present all this information as a single message, which is much nicer: [ 33.640143] hme 0000:00:01.1 eth0: Link is up using internal transceiver at 100Mb/s, Full Duplex. The display_forced_link_mode function has a similar structure, so adjust it in a similar fashion. Signed-off-by: Nick Bowler Signed-off-by: David S. Miller commit 057cc8c9005e23330e368afd18839ce3764dc0af Author: Hayes Wang Date: Wed Jul 13 11:31:11 2022 +0800 r8152: fix accessing unset transport header A warning is triggered by commit 66e4c8d95008 ("net: warn if transport header was not set"). The warning is harmless, because the value from skb_transport_offset() is only used for skb_is_gso() is true or the skb->ip_summed is equal to CHECKSUM_PARTIAL. Fixes: 66e4c8d95008 ("net: warn if transport header was not set") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 67de8acdd375e6f0d4ee9aa5745b9f9b329980b7 Merge: 23aa6d5088e3b 50e2ab3929194 Author: David S. Miller Date: Wed Jul 13 14:27:38 2022 +0100 Merge tag 'wireless-2022-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== A small set of fixes for * queue selection in mesh/ocb * queue handling on interface stop * hwsim virtio device vs. some other virtio changes * dt-bindings email addresses * color collision memory allocation * a const variable in rtw88 * shared SKB transmit in the ethernet format path * P2P client port authorization ==================== Signed-off-by: David S. Miller commit a0b0987a781157263b82f4022649cf686d36c787 Author: Vasily Gorbik Date: Mon Jun 27 14:50:56 2022 +0200 s390/nospec: remove unneeded header includes Commit 4efd417f298b ("s390: raise minimum supported machine generation to z10") removed the usage of alternatives and lowcore in expolines macros. Remove unneeded header includes as well. With that, expoline.S doesn't require asm-offsets.h and expoline_prepare target dependency could be removed. Tested-by: Joe Lawrence Link: https://lore.kernel.org/r/patch-2.thread-d13b6c.git-d13b6c96fb5f.your-ad-here.call-01656331067-ext-4899@work.hours Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit c4e789572557aa147b13bf7fe09cc99663ed0cf5 Author: Vasily Gorbik Date: Mon Jun 27 14:50:53 2022 +0200 s390/nospec: build expoline.o for modules_prepare target When CONFIG_EXPOLINE_EXTERN is used expoline thunks are generated from arch/s390/lib/expoline.S and postlinked into every module. This is also true for external modules. Add expoline.o build to the modules_prepare target. Fixes: 1d2ad084800e ("s390/nospec: add an option to use thunk-extern") Reported-by: Joe Lawrence Tested-by: Sumanth Korikkar Acked-by: Sumanth Korikkar Tested-by: C. Erastus Toe Tested-by: Joe Lawrence Link: https://lore.kernel.org/r/patch-1.thread-d13b6c.git-a2387a74dc49.your-ad-here.call-01656331067-ext-4899@work.hours Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit 23aa6d5088e3bd65de77c5c307237b9937f8b48a Author: Dan Carpenter Date: Tue Jul 12 17:42:25 2022 +0300 net: stmmac: fix leaks in probe These two error paths should clean up before returning. Fixes: 2bb4b98b60d7 ("net: stmmac: Add Ingenic SoCs MAC support.") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 49b9f431ff0d845a36be0b3ede35ec324f2e5fee Author: Liang He Date: Tue Jul 12 14:14:17 2022 +0800 net: ftgmac100: Hold reference returned by of_get_child_by_name() In ftgmac100_probe(), we should hold the refernece returned by of_get_child_by_name() and use it to call of_node_put() for reference balance. Fixes: 39bfab8844a0 ("net: ftgmac100: Add support for DT phy-handle property") Signed-off-by: Liang He Signed-off-by: David S. Miller commit 7d5424b26f17b74d94e73815718b424ad207a3e7 Merge: 22b9c41a3fb8e bdf00bf24bef9 Author: David S. Miller Date: Wed Jul 13 12:56:50 2022 +0100 Merge branch 'net-sysctl-races' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_net_table (Roun). This series fixes data-races around the first 13 knobs and nexthop_compat_mode in ipv4_net_table. I will post another patch for three early_demux knobs later, so the next round will start from ip_default_ttl. ==================== Signed-off-by: David S. Miller commit bdf00bf24bef9be1ca641a6390fd5487873e0d2e Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:33 2022 -0700 nexthop: Fix data-races around nexthop_compat_mode. While reading nexthop_compat_mode, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 4f80116d3df3 ("net: ipv4: add sysctl for nexthop api compatibility mode") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit e49e4aff7ec19b2d0d0957ee30e93dade57dab9e Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:32 2022 -0700 ipv4: Fix data-races around sysctl_ip_dynaddr. While reading sysctl_ip_dynaddr, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 12b8d9ca7e678abc48195294494f1815b555d658 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:31 2022 -0700 tcp: Fix a data-race around sysctl_tcp_ecn_fallback. While reading sysctl_tcp_ecn_fallback, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 492135557dc0 ("tcp: add rfc3168, section 6.1.1.1. fallback") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4785a66702f086cf2ea84bdbe6ec921f274bd9f2 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:30 2022 -0700 tcp: Fix data-races around sysctl_tcp_ecn. While reading sysctl_tcp_ecn, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1dace014928e6e385363032d359a04dee9158af0 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:29 2022 -0700 raw: Fix a data-race around sysctl_raw_l3mdev_accept. While reading sysctl_raw_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 6897445fb194 ("net: provide a sysctl raw_l3mdev_accept for raw socket lookup with VRFs") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1ebcb25ad6fc3d50fca87350acf451b9a66dd31e Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:28 2022 -0700 icmp: Fix a data-race around sysctl_icmp_ratemask. While reading sysctl_icmp_ratemask, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2a4eb714841f288cf51c7d942d98af6a8c6e4b01 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:27 2022 -0700 icmp: Fix a data-race around sysctl_icmp_ratelimit. While reading sysctl_icmp_ratelimit, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit d2efabce81db7eed1c98fa1a3f203f0edd738ac3 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:26 2022 -0700 icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. While reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1c2fb7f93cb2 ("[IPV4]: Sysctl configurable icmp error source address.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit b04f9b7e85c7d7aecbada620e8759a662af068d3 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:25 2022 -0700 icmp: Fix a data-race around sysctl_icmp_ignore_bogus_error_responses. While reading sysctl_icmp_ignore_bogus_error_responses, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 66484bb98ed2dfa1dda37a32411483d8311ac269 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:24 2022 -0700 icmp: Fix a data-race around sysctl_icmp_echo_ignore_broadcasts. While reading sysctl_icmp_echo_ignore_broadcasts, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4a2f7083cc6cb72dade9a63699ca352fad26d1cd Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:23 2022 -0700 icmp: Fix data-races around sysctl_icmp_echo_enable_probe. While reading sysctl_icmp_echo_enable_probe, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") Fixes: 1fd07f33c3ea ("ipv6: ICMPV6: add response to ICMPV6 RFC 8335 PROBE messages") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit bb7bb35a63b4812da8e3aff587773678e31d23e3 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:22 2022 -0700 icmp: Fix a data-race around sysctl_icmp_echo_ignore_all. While reading sysctl_icmp_echo_ignore_all, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 6f605b57f3782114e330e108ce1903ede22ec675 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:21 2022 -0700 tcp: Fix a data-race around sysctl_max_tw_buckets. While reading sysctl_max_tw_buckets, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 7d1025e559782b58824b36cb8ad547a69f2e4b31 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:20 2022 -0700 sysctl: Fix data-races in proc_dointvec_ms_jiffies(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dointvec_ms_jiffies() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dointvec_ms_jiffies() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 7dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf18 Author: Kuniyuki Iwashima Date: Mon Jul 11 17:15:19 2022 -0700 sysctl: Fix data-races in proc_dou8vec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dou8vec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dou8vec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: cb9444130662 ("sysctl: add proc_dou8vec_minmax()") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit d2394860b45c3c1484e4b0a5d09909a1e3f6569e Author: AngeloGioacchino Del Regno Date: Wed Jul 13 13:15:36 2022 +0200 cpufreq: mediatek: Handle sram regulator probe deferral If the regulator_get_optional() call for the SRAM regulator returns a probe deferral, we must bail out and retry probing later: failing to do this will produce unstabilities on platforms requiring the handling for this regulator. Fixes: ffa7bdf7f344 ("cpufreq: mediatek: Make sram regulator optional") Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Viresh Kumar commit 230ec83d4299b30c51a1c133b4f2a669972cc08a Author: Juergen Gross Date: Fri Jul 8 15:14:56 2022 +0200 x86/pat: Fix x86_has_pat_wp() x86_has_pat_wp() is using a wrong test, as it relies on the normal PAT configuration used by the kernel. In case the PAT MSR has been setup by another entity (e.g. Xen hypervisor) it might return false even if the PAT configuration is allowing WP mappings. This due to the fact that when running as Xen PV guest the PAT MSR is setup by the hypervisor and cannot be changed by the guest. This results in the WP related entry to be at a different position when running as Xen PV guest compared to the bare metal or fully virtualized case. The correct way to test for WP support is: 1. Get the PTE protection bits needed to select WP mode by reading __cachemode2pte_tbl[_PAGE_CACHE_MODE_WP] (depending on the PAT MSR setting this might return protection bits for a stronger mode, e.g. UC-) 2. Translate those bits back into the real cache mode selected by those PTE bits by reading __pte2cachemode_tbl[__pte2cm_idx(prot)] 3. Test for the cache mode to be _PAGE_CACHE_MODE_WP Fixes: f88a68facd9a ("x86/mm: Extend early_memremap() support with additional attrs") Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Cc: # 4.14 Link: https://lore.kernel.org/r/20220503132207.17234-1-jgross@suse.com commit 3131ef39fb03bbde237d0b8260445898f3dfda5b Author: Jiri Slaby Date: Wed Jul 13 11:50:46 2022 +0200 x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit The build on x86_32 currently fails after commit 9bb2ec608a20 (objtool: Update Retpoline validation) with: arch/x86/kernel/../../x86/xen/xen-head.S:35: Error: no such instruction: `annotate_unret_safe' ANNOTATE_UNRET_SAFE is defined in nospec-branch.h. And head_32.S is missing this include. Fix this. Fixes: 9bb2ec608a20 ("objtool: Update Retpoline validation") Signed-off-by: Jiri Slaby Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/63e23f80-033f-f64e-7522-2816debbc367@kernel.org commit 9b043a8f386485c74c0f8eea2c287d5bdbdf3279 Author: Meng Tang Date: Wed Jul 13 17:41:33 2022 +0800 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop The headset on this machine is not defined, after applying the quirk ALC256_FIXUP_ASUS_HEADSET_MIC, the headset-mic works well Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220713094133.9894-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 51189eb9ddc88851edc42f539a0f9862fd0630c2 Author: Tony Lindgren Date: Wed Jun 22 08:12:15 2022 +0300 mmc: sdhci-omap: Fix a lockdep warning for PM runtime init We need runtime PM enabled early in probe before sdhci_setup_host() for sdhci_omap_set_capabilities(). But on the first runtime resume we must not call sdhci_runtime_resume_host() as sdhci_setup_host() has not been called yet. Let's check for an initialized controller like we already do for context restore to fix a lockdep warning. Fixes: f433e8aac6b9 ("mmc: sdhci-omap: Implement PM runtime functions") Reported-by: Yegor Yefremov Suggested-by: Arnd Bergmann Signed-off-by: Tony Lindgren Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220622051215.34063-1-tony@atomide.com Signed-off-by: Ulf Hansson commit 68e3c69803dada336893640110cb87221bb01dcf Author: Peter Zijlstra Date: Tue Jul 5 15:07:26 2022 +0200 perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ... if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Reported-by: Yang Jihong Signed-off-by: Peter Zijlstra (Intel) Tested-by: Yang Jihong Link: https://lkml.kernel.org/r/YsQ3jm2GR38SW7uD@worktop.programming.kicks-ass.net commit d332a1f6b4c4b07bf984f04df897818c7c7fce8f Merge: 52905140c3ed4 03110b46c99bb Author: Arnd Bergmann Date: Wed Jul 13 09:37:20 2022 +0200 Merge tag 'qcom-dts-fixes-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm DTS fixe for 5.19 The pinctrl state was lost in the recent refactoring of the MSM8974 Devicetree, this contains a fix for this. * tag 'qcom-dts-fixes-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: msm8974: re-add missing pinctrl Link: https://lore.kernel.org/r/20220713030627.1371156-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 52905140c3ed42a16644650d431cdd1051a0a337 Merge: 01277737e9bed 8bd582ae9a71d Author: Arnd Bergmann Date: Wed Jul 13 09:35:55 2022 +0200 Merge tag 'arm-soc/for-5.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 5.19, please pull the following: - William corrects the BCM4906 DTS to have an armv8-timer Device Tree, necessary for booting, and fixes the BCM4908 DTS to have a proper 'enable-method' and 'cpu-release-addr' properties for the kernel to boot when using u-boot * tag 'arm-soc/for-5.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC Link: https://lore.kernel.org/r/20220712231222.97850-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 4ba5c853d7945b3855c3dcb293f7f9f019db641e Author: Meng Tang Date: Wed Jul 13 14:33:32 2022 +0800 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 On a HP 288 Pro G2 MT (X9W02AV), the front mic could not be detected. In order to get it working, the pin configuration needs to be set correctly, and the ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE fixup needs to be applied. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220713063332.30095-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 61d307855eb1a2ae849da445edd5389db8a58a5c Author: Jeremy Szu Date: Wed Jul 13 10:27:04 2022 +0800 ALSA: hda/realtek: fix mute/micmute LEDs for HP machines The HP ProBook 440/450 G9 and EliteBook 640/650 G9 have multiple motherboard design and they are using different subsystem ID of audio codec. Add the same quirk for other MBs. Signed-off-by: Jeremy Szu Cc: Link: https://lore.kernel.org/r/20220713022706.22892-1-jeremy.szu@canonical.com Signed-off-by: Takashi Iwai commit 7c239a071d1f04b7137789810807b4108d475c72 Author: Lucien Buchmann Date: Sat Jun 25 02:17:44 2022 +0200 USB: serial: ftdi_sio: add Belimo device ids Those two product ids are known. Signed-off-by: Lucien Buchmann Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 22b9c41a3fb8ef4624bcda312665937d2ba98aa7 Merge: f946964a9f79f ddde5412fdaa5 Author: Jakub Kicinski Date: Tue Jul 12 20:36:00 2022 -0700 Merge branch 'bnxt_en-5-bug-fixes' Michael Chan says: ==================== bnxt_en: 5 Bug fixes This patchset fixes various issues, including SRIOV error unwinding, one error recovery path, live patch reporting, XDP transmit path, and PHC clock reading. ==================== Link: https://lore.kernel.org/r/1657592778-12730-1-git-send-email-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit ddde5412fdaa5048bbca31529d46cb8da882870c Author: Pavan Chebbi Date: Mon Jul 11 22:26:18 2022 -0400 bnxt_en: Fix bnxt_refclk_read() The upper 32-bit PHC register is not latched when reading the lower 32-bit PHC register. Current code leaves a small window where we may not read correct higher order bits if the lower order bits are just about to wrap around. This patch fixes this by reading higher order bits twice and makes sure that final value is correctly paired with its lower 32 bits. Fixes: 30e96f487f64 ("bnxt_en: Do not read the PTP PHC during chip reset") Cc: Richard Cochran Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 53f8c2d37efb5b03b9527ad04332df3bb889f0fa Author: Michael Chan Date: Mon Jul 11 22:26:17 2022 -0400 bnxt_en: Fix and simplify XDP transmit path Fix the missing length hint in the TX BD for the XDP transmit path. The length hint is required on legacy chips. Also, simplify the code by eliminating the first_buf local variable. tx_buf contains the same value. The opaque value only needs to be set on the first BD. Fix this also for correctness. Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers") Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 619b9b1622c283cc5ca86f4c487db266a8f55dab Author: Vikas Gupta Date: Mon Jul 11 22:26:16 2022 -0400 bnxt_en: fix livepatch query In the livepatch query fw_target BNXT_FW_SRT_PATCH is applicable for P5 chips only. Fixes: 3c4153394e2c ("bnxt_en: implement firmware live patching") Reviewed-by: Saravanan Vajravel Reviewed-by: Somnath Kotur Signed-off-by: Vikas Gupta Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 4279414bff8af9898e8c53ae6c5bc17f68ad67b7 Author: Michael Chan Date: Mon Jul 11 22:26:15 2022 -0400 bnxt_en: Fix bnxt_reinit_after_abort() code path bnxt_reinit_after_abort() is called during ifup when a previous FW reset sequence has aborted or a previous ifup has failed after detecting FW reset. In all cases, it is safe to assume that a previous FW reset has completed and the driver may not have fully reinitialized. Prior to this patch, it is assumed that the FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE flag will always be set by the firmware in bnxt_hwrm_if_change(). This may not be true if the driver has already attempted to register with the firmware. The firmware may not set the RESET_DONE flag again after the driver has registered, assuming that the driver has seen the flag already. Fix it to always go through the FW reset initialization path if the BNXT_STATE_FW_RESET_DET flag is set. This flag is always set by the driver after successfully going through bnxt_reinit_after_abort(). Fixes: 6882c36cf82e ("bnxt_en: attempt to reinitialize after aborted reset") Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit c5b744d38c36a407a41e918602eec4d89730787b Author: Kashyap Desai Date: Mon Jul 11 22:26:14 2022 -0400 bnxt_en: reclaim max resources if sriov enable fails If bnxt_sriov_enable() fails after some resources have been reserved for the VFs, the current code is not unwinding properly and the reserved resources become unavailable afterwards. Fix it by properly unwinding with a call to bnxt_hwrm_func_qcaps() to reset all maximum resources. Also, add the missing bnxt_ulp_sriov_cfg() call to let the RDMA driver know to abort. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Kashyap Desai Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit b047602d579b4fb028128a525f056bbdc890e7f0 Merge: 72a8e05d4f66b 1e1fb420fe68d Author: Linus Torvalds Date: Tue Jul 12 16:17:40 2022 -0700 Merge tag 'trace-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Fixes and minor clean ups for tracing: - Fix memory leak by reverting what was thought to be a double free. A static tool had gave a false positive that a double free was possible in the error path, but it was actually a different location that confused the static analyzer (and those of us that reviewed it). - Move use of static buffers by ftrace_dump() to a location that can be used by kgdb's ftdump(), as it needs it for the same reasons. - Clarify in the Kconfig description that function tracing has negligible impact on x86, but may have a bit bigger impact on other architectures. - Remove unnecessary extra semicolon in trace event. - Make a local variable static that is used in the fprobes sample - Use KSYM_NAME_LEN for length of function in kprobe sample and get rid of unneeded macro for the same purpose" * tag 'trace-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: samples: Use KSYM_NAME_LEN for kprobes fprobe/samples: Make sample_probe static blk-iocost: tracing: atomic64_read(&ioc->vtime_rate) is assigned an extra semicolon ftrace: Be more specific about arch impact when function tracer is enabled tracing: Fix sleeping while atomic in kdb ftdump tracing/histograms: Fix memory leak problem commit 333991c4e66b3d4b5613315f18016da80344f659 Author: Andrzej Hajda Date: Fri Jun 24 13:35:28 2022 +0200 drm/i915/selftests: fix subtraction overflow bug On some machines hole_end can be small enough to cause subtraction overflow. On the other side (addr + 2 * min_alignment) can overflow in case of mock tests. This patch should handle both cases. Fixes: e1c5f754067b59 ("drm/i915: Avoid overflow in computing pot_hole loop termination") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3674 Signed-off-by: Andrzej Hajda Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20220624113528.2159210-1-andrzej.hajda@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2) Signed-off-by: Rodrigo Vivi commit ad765fae792e16ce3c1d0b69ce939e3f7dba40ab Author: Chris Wilson Date: Fri Jul 8 16:20:11 2022 +0200 drm/i915/gem: Look for waitboosting across the whole object prior to individual waits We employ a "waitboost" heuristic to detect when userspace is stalled waiting for results from earlier execution. Under latency sensitive work mixed between the gpu/cpu, the GPU is typically under-utilised and so RPS sees that low utilisation as a reason to downclock the frequency, causing longer stalls and lower throughput. The user left waiting for the results is not impressed. On applying commit 047a1b877ed4 ("dma-buf & drm/amdgpu: remove dma_resv workaround") it was observed that deinterlacing h264 on Haswell performance dropped by 2-5x. The reason being that the natural workload was not intense enough to trigger RPS (using HW evaluation intervals) to upclock, and so it was depending on waitboosting for the throughput. Commit 047a1b877ed4 ("dma-buf & drm/amdgpu: remove dma_resv workaround") changes the composition of dma-resv from keeping a single write fence + multiple read fences, to a single array of multiple write and read fences (a maximum of one pair of write/read fences per context). The iteration order was also changed implicitly from all-read fences then the single write fence, to a mix of write fences followed by read fences. It is that ordering change that belied the fragility of waitboosting. Currently, a waitboost is inspected at the point of waiting on an outstanding fence. If the GPU is backlogged such that we haven't yet stated the request we need to wait on, we force the GPU to upclock until the completion of that request. By changing the order in which we waited upon requests, we ended up waiting on those requests in sequence and as such we saw that each request was already started and so not a suitable candidate for waitboosting. Instead of asking whether to boost each fence in turn, we can look at whether boosting is required for the dma-resv ensemble prior to waiting on any fence, making the heuristic more robust to the order in which fences are stored in the dma-resv. Reported-by: Thomas Voegtle Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6284 Fixes: 047a1b877ed4 ("dma-buf & drm/amdgpu: remove dma_resv workaround") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Signed-off-by: Karolina Drobnik Tested-by: Thomas Voegtle Reviewed-by: Andi Shyti Acked-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/07e05518d9f6620d20cc1101ec1849203fe973f9.1657289332.git.karolina.drobnik@intel.com (cherry picked from commit 394e2b57a989113de494c52d4683444bcb02d4e1) Signed-off-by: Rodrigo Vivi commit a1c5a7bf79c1faa5633b918b5c0666545e84c4d1 Author: Chris Wilson Date: Tue Jul 12 16:21:33 2022 +0100 drm/i915/gt: Serialize TLB invalidates with GT resets Avoid trying to invalidate the TLB in the middle of performing an engine reset, as this may result in the reset timing out. Currently, the TLB invalidate is only serialised by its own mutex, forgoing the uncore lock, but we can take the uncore->lock as well to serialise the mmio access, thereby serialising with the GDRST. Tested on a NUC5i7RYB, BIOS RYBDWi35.86A.0380.2019.0517.1530 with i915 selftest/hangcheck. Cc: stable@vger.kernel.org # v4.4 and upper Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") Reported-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Andi Shyti Acked-by: Thomas Hellström Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/1e59a7c45dd919a530256b9ac721ac6ea86c0677.1657639152.git.mchehab@kernel.org (cherry picked from commit 33da97894758737895e90c909f16786052680ef4) Signed-off-by: Rodrigo Vivi commit b24dcf1dc507f69ed3b5c66c2b6a0209ae80d4d4 Author: Chris Wilson Date: Tue Jul 12 16:21:32 2022 +0100 drm/i915/gt: Serialize GRDOM access between multiple engine resets Don't allow two engines to be reset in parallel, as they would both try to select a reset bit (and send requests to common registers) and wait on that register, at the same time. Serialize control of the reset requests/acks using the uncore->lock, which will also ensure that no other GT state changes at the same time as the actual reset. Cc: stable@vger.kernel.org # v4.4 and upper Reported-by: Mika Kuoppala Signed-off-by: Chris Wilson Acked-by: Mika Kuoppala Reviewed-by: Andi Shyti Reviewed-by: Andrzej Hajda Acked-by: Thomas Hellström Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/e0a2d894e77aed7c2e36b0d1abdc7dbac3011729.1657639152.git.mchehab@kernel.org (cherry picked from commit 336561a914fc0c6f1218228718f633b31b7af1c3) Signed-off-by: Rodrigo Vivi commit aff1e0b09b54b64944b7fe32997229552737b9e9 Author: Matthew Auld Date: Mon Jul 11 09:58:59 2022 +0100 drm/i915/ttm: fix sg_table construction If we encounter some monster sized local-memory page that exceeds the maximum sg length (UINT32_MAX), ensure that don't end up with some misaligned address in the entry that follows, leading to fireworks later. Also ensure we have some coverage of this in the selftests. v2(Chris): - Use round_down consistently to avoid udiv errors v3(Nirmoy): - Also update the max_segment in the selftest Fixes: f701b16d4cc5 ("drm/i915/ttm: add i915_sg_from_buddy_resource") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6379 Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Nirmoy Das Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20220711085859.24198-1-matthew.auld@intel.com (cherry picked from commit bc99f1209f19fefa3ee11e77464ccfae541f4291) Signed-off-by: Rodrigo Vivi commit 896dcabd1f8f613c533d948df17408c41f8929f5 Author: Dan Carpenter Date: Fri Jul 8 12:41:04 2022 +0300 drm/i915/selftests: fix a couple IS_ERR() vs NULL tests The shmem_pin_map() function doesn't return error pointers, it returns NULL. Fixes: be1cb55a07bf ("drm/i915/gt: Keep a no-frills swappable copy of the default context state") Signed-off-by: Dan Carpenter Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220708094104.GL2316@kadam (cherry picked from commit d50f5a109cf4ed50c5b575c1bb5fc3bd17b23308) Signed-off-by: Rodrigo Vivi commit f99546298a4537965b75d518c210742f641be389 Merge: 48da0f67c53ee e87197fbd137c Author: Rodrigo Vivi Date: Tue Jul 12 18:21:10 2022 -0400 Merge tag 'gvt-fixes-2022-07-11' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2022-07-11 - Fix return value for shmem_pin_map() Signed-off-by: Rodrigo Vivi From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20220711052021.GV1089@zhen-hp.sh.intel.com commit 48da0f67c53eecd2594c302be6c8a665b7740eaf Author: Thomas Hellström Date: Mon Jun 20 14:36:59 2022 +0200 drm/i915: Fix vm use-after-free in vma destruction In vma destruction, the following race may occur: Thread 1: Thread 2: i915_vma_destroy(); ... list_del_init(vma->vm_link); ... mutex_unlock(vma->vm->mutex); __i915_vm_release(); release_references(); And in release_reference() we dereference vma->vm to get to the vm gt pointer, leading to a use-after free. However, __i915_vm_release() grabs the vm->mutex so the vm won't be destroyed before vma->vm->mutex is released, so extract the gt pointer under the vm->mutex to avoid the vma->vm dereference in release_references(). v2: Fix a typo in the commit message (Andi Shyti) Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5944 Fixes: e1a7ab4fca0c ("drm/i915: Remove the vm open count") Cc: Niranjana Vishwanathapura Cc: Matthew Auld Signed-off-by: Thomas Hellström Acked-by: Nirmoy Das Reviewed-by: Andrzej Hajda Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220620123659.381772-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 1926a6b75954fc1a8b44d10bd0c67db957b78cf7) Signed-off-by: Rodrigo Vivi commit 1391b9cfd35bb8f10785a17cb4bb5ea8d10faaae Author: Daniele Ceraolo Spurio Date: Tue Jun 21 16:30:05 2022 -0700 drm/i915/guc: ADL-N should use the same GuC FW as ADL-S The only difference between the ADL S and P GuC FWs is the HWConfig support. ADL-N does not support HWConfig, so we should use the same binary as ADL-S, otherwise the GuC might attempt to fetch a config table that does not exist. ADL-N is internally identified as an ADL-P, so we need to special-case it in the FW selection code. Fixes: 7e28d0b26759 ("drm/i915/adl-n: Enable ADL-N platform") Cc: John Harrison Cc: Tejas Upadhyay Cc: Anusha Srivatsa Cc: Jani Nikula Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20220621233005.3952293-1-daniele.ceraolospurio@intel.com (cherry picked from commit 971e4a9781742aaad1587e25fd5582b2dd595ef8) Signed-off-by: Rodrigo Vivi commit 046cd8a2a9eec7c2b46b03958a2b6252ddff55b2 Author: Hangyu Hua Date: Fri Jun 24 06:04:06 2022 -0700 drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() If drm_connector_init fails, intel_connector_free will be called to take care of proper free. So it is necessary to drop the refcount of port before intel_connector_free. Fixes: 091a4f91942a ("drm/i915: Handle drm-layer errors in intel_dp_add_mst_connector") Signed-off-by: Hangyu Hua Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20220624130406.17996-1-jose.souza@intel.com Signed-off-by: José Roberto de Souza (cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2) Signed-off-by: Rodrigo Vivi commit 1e1fb420fe68d9d938db360fec700dfd230cc22a Author: Tiezhu Yang Date: Wed Jun 8 09:23:22 2022 +0800 samples: Use KSYM_NAME_LEN for kprobes It is better and enough to use KSYM_NAME_LEN for kprobes in samples, no need to define and use the other values. Link: https://lkml.kernel.org/r/1654651402-21552-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Tiezhu Yang Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit e3655dfa58053d614ca9601c36657b469402650f Author: sunliming Date: Mon Jun 6 15:56:59 2022 +0800 fprobe/samples: Make sample_probe static This symbol is not used outside of fprobe_example.c, so marks it static. Fixes the following warning: sparse warnings: (new ones prefixed by >>) >> samples/fprobe/fprobe_example.c:23:15: sparse: sparse: symbol 'sample_probe' was not declared. Should it be static? Link: https://lkml.kernel.org/r/20220606075659.674556-1-sunliming@kylinos.cn Reported-by: kernel test robot Signed-off-by: sunliming Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 0bb7e14c8e15ad78b7300e7d89a615ea8b8c89a9 Author: Li kunyu Date: Wed Jun 29 11:00:13 2022 +0800 blk-iocost: tracing: atomic64_read(&ioc->vtime_rate) is assigned an extra semicolon Remove extra semicolon. Link: https://lkml.kernel.org/r/20220629030013.10362-1-kunyu@nfschina.com Cc: Tejun Heo Cc: Jens Axboe Signed-off-by: Li kunyu Signed-off-by: Steven Rostedt (Google) commit 0a6d7d45414a77876e8e9a77e454af754cea3a60 Author: Steven Rostedt (Google) Date: Wed Jul 6 16:12:31 2022 -0400 ftrace: Be more specific about arch impact when function tracer is enabled It was brought up that on ARMv7, that because the FUNCTION_TRACER does not use nops to keep function tracing disabled because of the use of a link register, it does have some performance impact. The start of functions when -pg is used to compile the kernel is: push {lr} bl 8010e7c0 <__gnu_mcount_nc> When function tracing is tuned off, it becomes: push {lr} add sp, sp, #4 Which just puts the stack back to its normal location. But these two instructions at the start of every function does incur some overhead. Be more honest in the Kconfig FUNCTION_TRACER description and specify that the overhead being in the noise was x86 specific, but other architectures may vary. Link: https://lore.kernel.org/all/20220705105416.GE5208@pengutronix.de/ Link: https://lkml.kernel.org/r/20220706161231.085a83da@gandalf.local.home Reported-by: Sascha Hauer Acked-by: Sascha Hauer Signed-off-by: Steven Rostedt (Google) commit 495fcec8648cdfb483b5b9ab310f3839f07cb3b8 Author: Douglas Anderson Date: Fri Jul 8 17:09:52 2022 -0700 tracing: Fix sleeping while atomic in kdb ftdump If you drop into kdb and type "ftdump" you'll get a sleeping while atomic warning from memory allocation in trace_find_next_entry(). This appears to have been caused by commit ff895103a84a ("tracing: Save off entry when peeking at next entry"), which added the allocation in that path. The problematic commit was already fixed by commit 8e99cf91b99b ("tracing: Do not allocate buffer in trace_find_next_entry() in atomic") but that fix missed the kdb case. The fix here is easy: just move the assignment of the static buffer to the place where it should have been to begin with: trace_init_global_iter(). That function is called in two places, once is right before the assignment of the static buffer added by the previous fix and once is in kdb. Note that it appears that there's a second static buffer that we need to assign that was added in commit efbbdaa22bb7 ("tracing: Show real address for trace event arguments"), so we'll move that too. Link: https://lkml.kernel.org/r/20220708170919.1.I75844e5038d9425add2ad853a608cb44bb39df40@changeid Fixes: ff895103a84a ("tracing: Save off entry when peeking at next entry") Fixes: efbbdaa22bb7 ("tracing: Show real address for trace event arguments") Signed-off-by: Douglas Anderson Signed-off-by: Steven Rostedt (Google) commit 7edc3945bdce9c39198a10d6129377a5c53559c2 Author: Zheng Yejian Date: Mon Jul 11 09:47:31 2022 +0800 tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lkml.kernel.org/r/20220711014731.69520-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: 46bbe5c671e0 ("tracing: fix double free") Reported-by: Hulk Robot Suggested-by: Steven Rostedt Reviewed-by: Tom Zanussi Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 7b6f9462a3234c35cf808453d39a074a04e71de1 Author: Paul M Stillwell Jr Date: Wed Jun 8 14:48:32 2022 -0700 ice: change devlink code to read NVM in blocks When creating a snapshot of the NVM the driver needs to read the entire contents from the NVM and store it. The NVM reads are protected by a lock that is shared between the driver and the firmware. If the driver takes too long to read the entire NVM (which can happen on some systems) then the firmware could reclaim the lock and cause subsequent reads from the driver to fail. We could fix this by increasing the timeout that we pass to the firmware, but we could end up in the same situation again if the system is slow. Instead have the driver break the reading of the NVM into blocks that are small enough that we have confidence that the read will complete within the timeout time, but large enough not to cause significant AQ overhead. Fixes: dce730f17825 ("ice: add a devlink region for dumping NVM contents") Signed-off-by: Paul M Stillwell Jr Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f52d166819a4d8e0d5cca07d8a8dd6397c96dcf1 Author: Paul M Stillwell Jr Date: Wed Jun 8 14:09:52 2022 -0700 ice: handle E822 generic device ID in PLDM header The driver currently presumes that the record data in the PLDM header of the firmware image will match the device ID of the running device. This is true for E810 devices. It appears that for E822 devices that this is not guaranteed to be true. Fix this by adding a check for the generic E822 device. Fixes: d69ea414c9b4 ("ice: implement device flash update via devlink") Signed-off-by: Paul M Stillwell Jr Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 72a8e05d4f66b5af7854df4490e3135168694b6b Merge: 29851567d1aa8 4a47c6385bb4e Author: Linus Torvalds Date: Tue Jul 12 08:59:35 2022 -0700 Merge tag 'ovl-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fix from Miklos Szeredi: "Add a temporary fix for posix acls on idmapped mounts introduced in this cycle. A proper fix will be added in the next cycle" * tag 'ovl-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: turn off SB_POSIXACL with idmapped layers temporarily commit 29851567d1aa8f0045170545d2e1a5d7a4057667 Merge: 0d8ba24e72b6e 3590b44b9434a Author: Linus Torvalds Date: Tue Jul 12 08:52:15 2022 -0700 Merge tag 'drm-fixes-2022-07-12' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "I see you picked up one of the fbdev fixes, this is the other stuff that was queued up last week. A bit of a scattering of fixes, three for i915, one amdgpu, and a couple of panfrost, rockchip, panel and bridge ones. amdgpu: - Hibernation fix dma-buf: - fix use after free of fence i915: - Fix a possible refcount leak in DP MST connector (Hangyu) - Fix on loading guc on ADL-N (Daniele) - Fix vm use-after-free in vma destruction (Thomas) bridge: - fsl-ldb : 3 LVDS modesetting fixes rockchip: - iommu domain fix panfrost: - fix memory corruption - error path fix panel: - orientation quirk fix for Yoga tablet 2 ssd130x: - fix pre-charge period setting" * tag 'drm-fixes-2022-07-12' of git://anongit.freedesktop.org/drm/drm: drm/ssd130x: Fix pre-charge period setting dma-buf: Fix one use-after-free of fence drm/i915: Fix vm use-after-free in vma destruction drm/i915/guc: ADL-N should use the same GuC FW as ADL-S drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() drm/amdgpu/display: disable prefer_shadow for generic fb helpers drm/amdgpu: keep fbdev buffers pinned during suspend drm/panfrost: Fix shrinker list corruption by madvise IOCTL drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error drm/rockchip: Detach from ARM DMA domain in attach_device drm/bridge: fsl-ldb: Drop DE signal polarity inversion drm/bridge: fsl-ldb: Enable split mode for LVDS dual link drm/bridge: fsl-ldb: Fix mode clock rate validation drm/aperture: Run fbdev removal before internal helpers drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Tablet 2 830 commit 0d8ba24e72b6ec45b1d62148c711bad54483b29a Merge: ce114c866860a c27c753ea6fd1 Author: Linus Torvalds Date: Tue Jul 12 08:40:09 2022 -0700 Merge tag 'x86_bugs_retbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull lockdep fix for x86 retbleed from Borislav Petkov: - Fix lockdep complaint for __static_call_fixup() * tag 'x86_bugs_retbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/static_call: Serialize __static_call_fixup() properly commit 2883f4b5a0e1ac9472c7e3ae9bbdb4ea5a2117c6 Author: Shyam Prasad N Date: Wed Jul 6 14:29:12 2022 +0000 cifs: remove unnecessary locking of chan_lock while freeing session In cifs_put_smb_ses, when we're freeing the last ref count to the session, we need to free up each channel. At this point, it is unnecessary to take chan_lock, since we have the last reference to the ses. Picking up this lock also introduced a deadlock because it calls cifs_put_tcp_ses, which locks cifs_tcp_ses_lock. Signed-off-by: Shyam Prasad N Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 50bd7d5a647bdf533575111c5335f49707c2ce2f Author: Shyam Prasad N Date: Tue Jul 5 11:16:24 2022 +0000 cifs: fix race condition with delayed threads On failure to create a new channel, first cancel the delayed threads, which could try to search for this channel, and not find it. The other option was to put the tcp session for the channel first, before decrementing chan_count. But that would leave a reference to the tcp session, when it has been freed already. So going with the former option and cancelling the delayed works first, before rolling back the channel. Fixes: aa45dadd34e4 ("cifs: change iface_list from array to sorted linked list") Signed-off-by: Shyam Prasad N Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit a77c46f2b4d48a81f36442ee0c2160baebf6c1a0 Author: Han Xu Date: Mon Jul 11 11:08:02 2022 -0500 MAINTAINERS: change the NXP FSPI driver maintainer. Haibo Chen and me will take over the NXP FSPI driver maintainer role. Signed-off-by: Han Xu Link: https://lore.kernel.org/r/20220711160802.4938-1-han.xu@nxp.com Signed-off-by: Mark Brown commit c27c753ea6fd1237f4f96abf8b623d7bab505513 Author: Thomas Gleixner Date: Tue Jul 12 14:01:06 2022 +0200 x86/static_call: Serialize __static_call_fixup() properly __static_call_fixup() invokes __static_call_transform() without holding text_mutex, which causes lockdep to complain in text_poke_bp(). Adding the proper locking cures that, but as this is either used during early boot or during module finalizing, it's not required to use text_poke_bp(). Add an argument to __static_call_transform() which tells it to use text_poke_early() for it. Fixes: ee88d363d156 ("x86,static_call: Use alternative RET encoding") Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov commit 7329b071729645e243b6207e76bca2f4951c991b Author: Bartosz Golaszewski Date: Tue Jul 12 09:40:55 2022 +0200 gpio: sim: fix the chip_name configfs item The chip_name configs attribute always displays the device name of the first GPIO bank because the logic of the relevant function is simply wrong. Fix it by correctly comparing the bank's swnode against the GPIO device's children. Fixes: cb8c474e79be ("gpio: sim: new testing module") Cc: stable@vger.kernel.org Reported-by: Kent Gibson Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Kent Gibson Tested-by: Kent Gibson commit e79b9473e9b59e83e23db9b7411c6080b5a6826d Author: Justin Stitt Date: Fri Jul 8 17:37:04 2022 -0700 net: ipv4: fix clang -Wformat warnings When building with Clang we encounter these warnings: | net/ipv4/ah4.c:513:4: error: format specifies type 'unsigned short' but | the argument has type 'int' [-Werror,-Wformat] | aalg_desc->uinfo.auth.icv_fullbits / 8); - | net/ipv4/esp4.c:1114:5: error: format specifies type 'unsigned short' | but the argument has type 'int' [-Werror,-Wformat] | aalg_desc->uinfo.auth.icv_fullbits / 8); `aalg_desc->uinfo.auth.icv_fullbits` is a u16 but due to default argument promotion becomes an int. Variadic functions (printf-like) undergo default argument promotion. Documentation/core-api/printk-formats.rst specifically recommends using the promoted-to-type's format flag. As per C11 6.3.1.1: (https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf) `If an int can represent all values of the original type ..., the value is converted to an int; otherwise, it is converted to an unsigned int. These are called the integer promotions.` Thus it makes sense to change %hu to %d not only to follow this standard but to suppress the warning as well. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Justin Stitt Suggested-by: Joe Perches Suggested-by: Nathan Chancellor Suggested-by: Nick Desaulniers Signed-off-by: Steffen Klassert commit f946964a9f79f8dcb5a6329265281eebfc23aee5 Author: Yevhen Orlov Date: Sun Jul 10 15:20:21 2022 +0300 net: marvell: prestera: fix missed deinit sequence Add unregister_fib_notifier as rollback of register_fib_notifier. Fixes: 4394fbcb78cf ("net: marvell: prestera: handle fib notifications") Signed-off-by: Yevhen Orlov Link: https://lore.kernel.org/r/20220710122021.7642-1-yevhen.orlov@plvision.eu Signed-off-by: Paolo Abeni commit dbe75d314748e08fc6e4576d153d8a69621ee5ca Author: Meng Tang Date: Tue Jul 12 17:22:22 2022 +0800 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 On a HP 288 Pro G6, the front mic could not be detected.In order to get it working, the pin configuration needs to be set correctly, and the ALC671_FIXUP_HP_HEADSET_MIC2 fixup needs to be applied. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220712092222.21738-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 841bdf85c226803a78a9319af9b2caa9bf3e2eda Author: Meng Tang Date: Tue Jul 12 14:00:05 2022 +0800 ALSA: hda - Add fixup for Dell Latitidue E5430 Another Dell model, another fixup entry: Latitude E5430 needs the same fixup as other Latitude E series as workaround for noise problems. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220712060005.20176-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 4a46de446d3fb9ae304dd0f4b4fceb551b152498 Author: Jakub Kicinski Date: Fri Jul 8 19:41:41 2022 -0700 selftest: net: add tun to .gitignore Add missing .gitignore entry. Fixes: 839b92fede7b ("selftest: tun: add test for NAPI dismantle") Link: https://lore.kernel.org/r/20220709024141.321683-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ce114c866860aa9eae3f50974efc68241186ba60 Merge: 5a29232d870d9 4ad3278df6fe2 Author: Linus Torvalds Date: Mon Jul 11 18:15:25 2022 -0700 Merge tag 'x86_bugs_retbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 retbleed fixes from Borislav Petkov: "Just when you thought that all the speculation bugs were addressed and solved and the nightmare is complete, here's the next one: speculating after RET instructions and leaking privileged information using the now pretty much classical covert channels. It is called RETBleed and the mitigation effort and controlling functionality has been modelled similar to what already existing mitigations provide" * tag 'x86_bugs_retbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (54 commits) x86/speculation: Disable RRSBA behavior x86/kexec: Disable RET on kexec x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/retbleed: Add fine grained Kconfig knobs x86/cpu/amd: Enumerate BTC_NO x86/common: Stamp out the stepping madness KVM: VMX: Prevent RSB underflow before vmenter x86/speculation: Fill RSB on vmexit for IBRS KVM: VMX: Fix IBRS handling after vmexit KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Convert launched argument to flags KVM: VMX: Flatten __vmx_vcpu_run() objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} x86/speculation: Remove x86_spec_ctrl_mask x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n ... commit 3590b44b9434af1b9c81c3f40189087ed4fe3635 Merge: 42e0a87233e37 b68277f19e31a Author: Dave Airlie Date: Tue Jul 12 10:43:49 2022 +1000 Merge tag 'drm-misc-fixes-2022-07-07-1' of ssh://git.freedesktop.org/git/drm/drm-misc into drm-fixes Three mode setting fixes for fsl-ldb, a fbdev removal use-after-free fix, a dma-buf fence use-after-free fix, a DMA setup fix for rockchip, an error path fix and memory corruption fix for panfrost and one more orientation quirk Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220708054306.wr6jcfdunuypftbq@houat commit 42e0a87233e373e1c0d0831d342294b1ba103d23 Merge: 7de96365878f7 12058077b2e96 Author: Dave Airlie Date: Tue Jul 12 10:40:24 2022 +1000 Merge tag 'drm-intel-fixes-2022-07-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix a possible refcount leak in DP MST connector (Hangyu) - Fix on loading guc on ADL-N (Daniele) - Fix vm use-after-free in vma destruction (Thomas) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YsbbgWnLTR8fr4lj@intel.com commit 7de96365878f769f21eae8205fc58f7f61250745 Merge: 32346491ddf24 3a4b1cc28fbdc Author: Dave Airlie Date: Tue Jul 12 10:34:42 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-07-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-07-06: amdgpu: - Hibernation fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220707024421.5773-1-alexander.deucher@amd.com commit 5a29232d870d9e63fe5ff30b081be6ea7cc2465d Merge: 23458ac91dc8e b3a3b0255797e Author: Linus Torvalds Date: Mon Jul 11 14:41:44 2022 -0700 Merge tag 'for-5.19-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A more fixes that seem to me to be important enough to get merged before release: - in zoned mode, fix leak of a structure when reading zone info, this happens on normal path so this can be significant - in zoned mode, revert an optimization added in 5.19-rc1 to finish a zone when the capacity is full, but this is not reliable in all cases - try to avoid short reads for compressed data or inline files when it's a NOWAIT read, applications should handle that but there are two, qemu and mariadb, that are affected" * tag 'for-5.19-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: drop optimization of zone finish btrfs: zoned: fix a leaked bioc in read_zone_info btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents commit 23458ac91dc8e9a30c95b4208727f7e053eb5ff8 Merge: 8e59a6a7a4fa0 db7cfc380900b 3418357a32db6 Author: Linus Torvalds Date: Mon Jul 11 14:33:41 2022 -0700 Merge tags 'free-mq_sysctls-for-v5.19' and 'ptrace_unfreeze_fix-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull ipc namespace fix from Eric Biederman: "This fixes a bug with error handling if ipc creation fails that was reported by syzbot" For completeness, this also pulls the ptrace_unfreeze_fix tag that contains the original version of one of the hotfixes that I manually applied earlier so that it would be fixed in rc6. * tag 'free-mq_sysctls-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: ipc: Free mq_sysctls if ipc namespace creation failed * tag 'ptrace_unfreeze_fix-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() commit 1197eb5906a5464dbaea24cac296dfc38499cc00 Author: Jeff Layton Date: Mon Jul 11 14:30:14 2022 -0400 lockd: fix nlm_close_files This loop condition tries a bit too hard to be clever. Just test for the two indices we care about explicitly. Cc: J. Bruce Fields Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 8e59a6a7a4fa0bbcd174ea75f1da9531d3857937 Merge: b5374396e5de0 14c99d6594153 Author: Linus Torvalds Date: Mon Jul 11 12:49:56 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Mainly MM fixes. About half for issues which were introduced after 5.18 and the remainder for longer-term issues" * tag 'mm-hotfixes-stable-2022-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: split huge PUD on wp_huge_pud fallback nilfs2: fix incorrect masking of permission flags for symlinks mm/rmap: fix dereferencing invalid subpage pointer in try_to_migrate_one() riscv/mm: fix build error while PAGE_TABLE_CHECK enabled without MMU Documentation: highmem: use literal block for code example in highmem.h comment mm: sparsemem: fix missing higher order allocation splitting mm/damon: use set_huge_pte_at() to make huge pte old sh: convert nommu io{re,un}map() to static inline functions mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages commit aec158242b87a43d83322e99bc71ab4428e5ab79 Author: Jeff Layton Date: Mon Jul 11 14:30:13 2022 -0400 lockd: set fl_owner when unlocking files Unlocking a POSIX lock on an inode with vfs_lock_file only works if the owner matches. Ensure we set it in the request. Cc: J. Bruce Fields Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit b5374396e5de0402822bce4945c886d2a2962a40 Merge: 816e51dfb5ba4 e69a66147d495 Author: Linus Torvalds Date: Mon Jul 11 12:39:12 2022 -0700 Merge tag 'modules-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module fixes from Luis Chamberlain: "Although most of the move of code in in v5.19-rc1 should have not introduced a regression patch review on one of the file changes captured a checkpatch warning which advised to use strscpy() and it caused a buffer overflow when an incorrect length is passed. Another change which checkpatch complained about was an odd RCU usage, but that was properly addressed in a separate patch to the move by Aaron. That caused a regression with PREEMPT_RT=y due to an unbounded latency. This series fixes both and adjusts documentation which we forgot to do for the move" * tag 'modules-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: kallsyms: Ensure preemption in add_kallsyms() with PREEMPT_RT doc: module: update file references module: Fix "warning: variable 'exit' set but not used" module: Fix selfAssignment cppcheck warning modules: Fix corruption of /proc/kallsyms commit 5b2f3e0777da2a5dd62824bbe2fdab1d12caaf8f Author: Chuck Lever Date: Sun Jul 10 14:46:04 2022 -0400 NFSD: Decode NFSv4 birth time attribute NFSD has advertised support for the NFSv4 time_create attribute since commit e377a3e698fb ("nfsd: Add support for the birth time attribute"). Igor Mammedov reports that Mac OS clients attempt to set the NFSv4 birth time attribute via OPEN(CREATE) and SETATTR if the server indicates that it supports it, but since the above commit was merged, those attempts now fail. Table 5 in RFC 8881 lists the time_create attribute as one that can be both set and retrieved, but the above commit did not add server support for clients to provide a time_create attribute. IMO that's a bug in our implementation of the NFSv4 protocol, which this commit addresses. Whether NFSD silently ignores the new birth time or actually sets it is another matter. I haven't found another filesystem service in the Linux kernel that enables users or clients to modify a file's birth time attribute. This commit reflects my (perhaps incorrect) understanding of whether Linux users can set a file's birth time. NFSD will now recognize a time_create attribute but it ignores its value. It clears the time_create bit in the returned attribute bitmask to indicate that the value was not used. Reported-by: Igor Mammedov Fixes: e377a3e698fb ("nfsd: Add support for the birth time attribute") Tested-by: Igor Mammedov Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e69a66147d49506062cd837f3b230ee3e98102ab Author: Aaron Tomlin Date: Mon Jul 11 18:17:19 2022 +0100 module: kallsyms: Ensure preemption in add_kallsyms() with PREEMPT_RT The commit 08126db5ff73 ("module: kallsyms: Fix suspicious rcu usage") under PREEMPT_RT=y, disabling preemption introduced an unbounded latency since the loop is not fixed. This change caused a regression since previously preemption was not disabled and we would dereference RCU-protected pointers explicitly. That being said, these pointers cannot change. Before kallsyms-specific data is prepared/or set-up, we ensure that the unformed module is known to be unique i.e. does not already exist (see load_module()). Therefore, we can fix this by using the common and more appropriate RCU flavour as this section of code can be safely preempted. Reported-by: Steven Rostedt Fixes: 08126db5ff73 ("module: kallsyms: Fix suspicious rcu usage") Signed-off-by: Aaron Tomlin Signed-off-by: Luis Chamberlain commit 816e51dfb5ba47e4f989af656c956a8c0cc686c0 Merge: d5b36a4dbd06c afe4e376ac5d5 Author: Linus Torvalds Date: Mon Jul 11 10:02:03 2022 -0700 Merge tag 'vfio-v5.19-rc7' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Move IOMMU test to unbreak no-iommu support (Jason Gunthorpe) * tag 'vfio-v5.19-rc7' of https://github.com/awilliam/linux-vfio: vfio: Move IOMMU_CAP_CACHE_COHERENCY test to after we know we have a group commit d5b36a4dbd06c5e8e36ca8ccc552f679069e2946 Author: Oleg Nesterov Date: Mon Jul 11 18:16:25 2022 +0200 fix race between exit_itimers() and /proc/pid/timers As Chris explains, the comment above exit_itimers() is not correct, we can race with proc_timers_seq_ops. Change exit_itimers() to clear signal->posix_timers with ->siglock held. Cc: Reported-by: chris@accessvector.net Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit d16d69bf5a25d91c6d8f3e29711be12551bf56cd Author: Meng Tang Date: Mon Jul 11 18:17:44 2022 +0800 ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model There is another HP ProDesk 600 G3 model with the PCI SSID 103c:82b4 that requires the quirk HP_MIC_NO_PRESENCE. Add the corresponding entry to the quirk table. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220711101744.25189-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 5f3fe25e70559fa3b096ab17e13316c93ddb7020 Author: Meng Tang Date: Mon Jul 11 16:15:27 2022 +0800 ALSA: hda/realtek: Fix headset mic for Acer SF313-51 The issue on Acer SWIFT SF313-51 is that headset microphone doesn't work. The following quirk fixed headset microphone issue. Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF313-51. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220711081527.6254-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 26b9f2fa7b1c6aba6fa9b83274a3e54868f69562 Author: Alexandru Elisei Date: Mon Jul 11 14:05:22 2022 +0100 ASoC: rockchip: i2s: Fix NULL pointer dereference when pinctrl is not found Commit a5450aba737d ("ASoC: rockchip: i2s: switch BCLK to GPIO") switched BCLK to GPIO functions when probing the i2s bus interface, but missed adding a check for when devm_pinctrl_get() returns an error. This can lead to the following NULL pointer dereference on a rockpro64-v2 if there are no "pinctrl" properties in the i2s device tree node. Check that i2s->pinctrl is valid before attempting to search for the bclk_on and bclk_off pinctrl states. Fixes: a5450aba737d ("ASoC: rockchip: i2s: switch BCLK to GPIO") Signed-off-by: Alexandru Elisei Link: https://lore.kernel.org/r/20220711130522.401551-1-alexandru.elisei@arm.com Signed-off-by: Mark Brown commit a9ab5bf33ce9883fbf5c2fc8f4eada00c46dc089 Author: Jacky Bai Date: Mon Jul 11 16:35:28 2022 +0800 MAINTAINERS: Update freescale pin controllers maintainer Add myself as co-maintainer of freescale pin controllers driver. As Stefan is no longer working on NXP pin controller, so remove Stefan from the list as suggested by him. Signed-off-by: Jacky Bai Reviewed-by: Fabio Estevam Acked-by: Stefan Agner Link: https://lore.kernel.org/r/20220711083528.27710-1-ping.bai@nxp.com Signed-off-by: Linus Walleij commit acf50233fc979b566e3b87d329191dcd01e2a72c Author: William Dean Date: Sun Jul 10 23:48:22 2022 +0800 pinctrl: sunplus: Add check for kcalloc As the potential failure of the kcalloc(), it should be better to check it in order to avoid the dereference of the NULL pointer. Fixes: aa74c44be19c8 ("pinctrl: Add driver for Sunplus SP7021") Reported-by: Hacash Robot Signed-off-by: William Dean Link: https://lore.kernel.org/r/20220710154822.2610801-1-williamsukatube@163.com Signed-off-by: Linus Walleij commit c3b821e8e406d5650e587b7ac624ac24e9b780a8 Author: William Dean Date: Sun Jul 10 23:49:22 2022 +0800 pinctrl: ralink: Check for null return of devm_kcalloc Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.". Fixes: a86854d0c599b ("treewide: devm_kzalloc() -> devm_kcalloc()") Reported-by: Hacash Robot Signed-off-by: William Dean Link: https://lore.kernel.org/r/20220710154922.2610876-1-williamsukatube@163.com Signed-off-by: Linus Walleij commit 01277737e9bedf74b094c43704aa2ec7c1bc1230 Merge: 3f231ccb38835 6177a50fd32c6 Author: Arnd Bergmann Date: Mon Jul 11 13:17:23 2022 +0200 Merge tag 'imx-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.19, round 3: - Fix GPIO property for imx6qdl-ts7970 board. - Fix touchscreen pinctrl for imx6ull-colibri board by moving iomuxc-snvs pin to the correct controller device. - Fix SFP node of fsl-ls1028a to have a required clock property. * tag 'imx-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: colibri-imx6ull: fix snvs pinmux group ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count arm64: dts: ls1028a: Update SFP node to include clock Link: https://lore.kernel.org/r/20220709032716.GA9868@dragon Signed-off-by: Arnd Bergmann commit e45955766b4300e7bbeeaa1c31e0001fe16383e7 Merge: 3c079a22db79c c39ba4de6b0a8 Author: David S. Miller Date: Mon Jul 11 11:58:38 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) refcount_inc_not_zero() is not semantically equivalent to atomic_int_not_zero(), from Florian Westphal. My understanding was that refcount_*() API provides a wrapper to easier debugging of reference count leaks, however, there are semantic differences between these two APIs, where refcount_inc_not_zero() needs a barrier. Reason for this subtle difference to me is unknown. 2) packet logging is not correct for ARP and IP packets, from the ARP family and netdev/egress respectively. Use skb_network_offset() to reach the headers accordingly. 3) set element extension length have been growing over time, replace a BUG_ON by EINVAL which might be triggerable from userspace. ==================== Signed-off-by: David S. Miller commit 3c079a22db79cf2cdd1b13b41a5447790e08069a Merge: 72a0b329114b1 3ddabc4336702 Author: David S. Miller Date: Mon Jul 11 11:31:38 2022 +0100 Merge branch 'mptcp-fixes' Mat Martineau says: ==================== mptcp: Disconnect and selftest fixes Patch 1 switches to a safe list iterator in the MPTCP disconnect code. Patch 2 adds the userspace_pm.sh selftest script to the MPTCP selftest Makefile, resolving the netdev/check_selftest CI failure. ==================== Signed-off-by: David S. Miller commit 3ddabc433670292492d217e0f3b5ce017c42da2c Author: Matthieu Baerts Date: Fri Jul 8 16:36:10 2022 -0700 selftests: mptcp: validate userspace PM tests by default The new script was not listed in the programs to test. By consequence, some CIs running MPTCP selftests were not validating these new tests. Note that MPTCP CI was validating it as it executes all .sh scripts from 'tools/testing/selftests/net/mptcp' directory. Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Reported-by: Jakub Kicinski Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 5c835bb142d4013c2ab24bff5ae9f6709a39cbcf Author: Paolo Abeni Date: Fri Jul 8 16:36:09 2022 -0700 mptcp: fix subflow traversal at disconnect time At disconnect time the MPTCP protocol traverse the subflows list closing each of them. In some circumstances - MPJ subflow, passive MPTCP socket, the latter operation can remove the subflow from the list, invalidating the current iterator. Address the issue using the safe list traversing helper variant. Reported-by: van fantasy Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Tested-by: Matthieu Baerts Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 166d3863231667c4f64dee72b77d1102cdfad11f Author: Demi Marie Obenour Date: Sun Jul 10 19:05:22 2022 -0400 xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE The error paths of gntdev_mmap() can call unmap_grant_pages() even though not all of the pages have been successfully mapped. This will trigger the WARN_ON()s in __unmap_grant_pages_done(). The number of warnings can be very large; I have observed thousands of lines of warnings in the systemd journal. Avoid this problem by only warning on unmapping failure if the handle being unmapped is not INVALID_GRANT_HANDLE. The handle field of any page that was not successfully mapped will be INVALID_GRANT_HANDLE, so this catches all cases where unmapping can legitimately fail. Fixes: dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") Cc: stable@vger.kernel.org Suggested-by: Juergen Gross Signed-off-by: Demi Marie Obenour Reviewed-by: Oleksandr Tyshchenko Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220710230522.1563-1-demi@invisiblethingslab.com Signed-off-by: Juergen Gross commit 50e2ab39291947b6c6c7025cf01707c270fcde59 Author: Felix Fietkau Date: Sat Jul 2 16:52:27 2022 +0200 wifi: mac80211: fix queue selection for mesh/OCB interfaces When using iTXQ, the code assumes that there is only one vif queue for broadcast packets, using the BE queue. Allowing non-BE queue marking violates that assumption and txq->ac == skb_queue_mapping is no longer guaranteed. This can cause issues with queue handling in the driver and also causes issues with the recent ATF change, resulting in an AQL underflow warning. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20220702145227.39356-1-nbd@nbd.name Signed-off-by: Johannes Berg commit cc0315564d6eec91c716d314b743321be24c70b3 Author: Mustafa Ismail Date: Tue Jul 5 18:08:37 2022 -0500 RDMA/irdma: Fix sleep from invalid context BUG Taking the qos_mutex to process RoCEv2 QP's on netdev events causes a kernel splat. Fix this by removing the handling for RoCEv2 in irdma_cm_teardown_connections that uses the mutex. This handling is only needed for iWARP to avoid having connections established while the link is down or having connections remain functional after the IP address is removed. BUG: sleeping function called from invalid context at kernel/locking/mutex. Call Trace: kernel: dump_stack+0x66/0x90 kernel: ___might_sleep.cold.92+0x8d/0x9a kernel: mutex_lock+0x1c/0x40 kernel: irdma_cm_teardown_connections+0x28e/0x4d0 [irdma] kernel: ? check_preempt_curr+0x7a/0x90 kernel: ? select_idle_sibling+0x22/0x3c0 kernel: ? select_task_rq_fair+0x94c/0xc90 kernel: ? irdma_exec_cqp_cmd+0xc27/0x17c0 [irdma] kernel: ? __wake_up_common+0x7a/0x190 kernel: irdma_if_notify+0x3cc/0x450 [irdma] kernel: ? sched_clock_cpu+0xc/0xb0 kernel: irdma_inet6addr_event+0xc6/0x150 [irdma] Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit 5e8afb8792f3b6ae7ccf700f8c19225382636401 Author: Mustafa Ismail Date: Tue Jul 5 18:08:36 2022 -0500 RDMA/irdma: Do not advertise 1GB page size for x722 x722 does not support 1GB page size but the irdma driver incorrectly advertises 1GB page size support for x722 device to ib_core to compute the best page size to use on this MR. This could lead to incorrect start offsets computed by hardware on the MR. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit e87197fbd137c888fd6c871c72fe7e89445dd015 Author: Dan Carpenter Date: Fri Jul 8 11:41:06 2022 +0300 drm/i915/gvt: IS_ERR() vs NULL bug in intel_gvt_update_reg_whitelist() The shmem_pin_map() function returns NULL, it doesn't return error pointers. Fixes: 97ea656521c8 ("drm/i915/gvt: Parse default state to update reg whitelist") Reviewed-by: Andrzej Hajda Signed-off-by: Dan Carpenter Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/Ysftoia2BPUyqVcD@kili Acked-by: Zhenyu Wang commit be82abe6a76ba8e76f25312566182b0f13c4fbf9 Author: Anup Patel Date: Mon Jul 11 09:36:32 2022 +0530 RISC-V: KVM: Fix SRCU deadlock caused by kvm_riscv_check_vcpu_requests() The kvm_riscv_check_vcpu_requests() is called with SRCU read lock held and for KVM_REQ_SLEEP request it will block the VCPU without releasing SRCU read lock. This causes KVM ioctls (such as KVM_IOEVENTFD) from other VCPUs of the same Guest/VM to hang/deadlock if there is any synchronize_srcu() or synchronize_srcu_expedited() in the path. To fix the above in kvm_riscv_check_vcpu_requests(), we should do SRCU read unlock before blocking the VCPU and do SRCU read lock after VCPU wakeup. Fixes: cce69aff689e ("RISC-V: KVM: Implement VCPU interrupts and requests handling") Reported-by: Bin Meng Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Heinrich Schuchardt Tested-by: Bin Meng Signed-off-by: Anup Patel commit 88573389aaa34640b9ecde15622c68e8737d8f8c Author: Alexandre Ghiti Date: Mon Jul 11 09:29:51 2022 +0530 riscv: Fix missing PAGE_PFN_MASK There are a bunch of functions that use the PFN from a page table entry that end up with the svpbmt upper-bits because they are missing the newly introduced PAGE_PFN_MASK which leads to wrong addresses conversions and then crash: fix this by adding this mask. Fixes: 100631b48ded ("riscv: Fix accessing pfn bits in PTEs for non-32bit variants") Signed-off-by: Alexandre Ghiti Signed-off-by: Anup Patel commit 32346491ddf24599decca06190ebca03ff9de7f8 Author: Linus Torvalds Date: Sun Jul 10 14:40:51 2022 -0700 Linux 5.19-rc6 commit 24f4b40ec2184f3698faed3082895fcc1f6be282 Merge: 952c53cd357c7 fc82bbf4dede7 Author: Linus Torvalds Date: Sun Jul 10 14:26:49 2022 -0700 Merge branch 'hot-fixes' (fixes for rc6) This is a collection of three fixes for small annoyances. Two of these are already pending in other trees, but I really don't want to release another -rc with these issues pending, so I picked up the patches for these things directly. We'll end up with duplicate commits eventually, I prefer that over having these issues pending. The third one is just me getting rid of another BUG_ON() just because it was reported and I dislike those things so much. * merge 'hot-fixes' branch: ida: don't use BUG_ON() for debugging drm/aperture: Run fbdev removal before internal helpers ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() commit fc82bbf4dede758007763867d0282353c06d1121 Author: Linus Torvalds Date: Sun Jul 10 13:55:49 2022 -0700 ida: don't use BUG_ON() for debugging This is another old BUG_ON() that just shouldn't exist (see also commit a382f8fee42c: "signal handling: don't use BUG_ON() for debugging"). In fact, as Matthew Wilcox points out, this condition shouldn't really even result in a warning, since a negative id allocation result is just a normal allocation failure: "I wonder if we should even warn here -- sure, the caller is trying to free something that wasn't allocated, but we don't warn for kfree(NULL)" and goes on to point out how that current error check is only causing people to unnecessarily do their own index range checking before freeing it. This was noted by Itay Iellin, because the bluetooth HCI socket cookie code does *not* do that range checking, and ends up just freeing the error case too, triggering the BUG_ON(). The HCI code requires CAP_NET_RAW, and seems to just result in an ugly splat, but there really is no reason to BUG_ON() here, and we have generally striven for allocation models where it's always ok to just do free(alloc()); even if the allocation were to fail for some random reason (usually obviously that "random" reason being some resource limit). Fixes: 88eca0207cf1 ("ida: simplified functions for id allocation") Reported-by: Itay Iellin Suggested-by: Matthew Wilcox Signed-off-by: Linus Torvalds commit 952c53cd357c71338a59d444933ed48a879229e1 Merge: 5867f3b88bb54 607a48c78e6b4 Author: Linus Torvalds Date: Sun Jul 10 11:23:01 2022 -0700 Merge tag 'dmaengine-fix-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "One core fix for DMA_INTERRUPT and rest driver fixes. Core: - Revert verification of DMA_INTERRUPT capability as that was incorrect Bunch of driver fixes for: - ti: refcount and put_device leak - qcom_bam: runtime pm overflow - idxd: force wq context cleanup and call idxd_enable_system_pasid() on success - dw-axi-dmac: RMW on channel suspend register - imx-sdma: restart cyclic channel when enabled - at_xdma: error handling for at_xdmac_alloc_desc - pl330: lockdep warning - lgm: error handling path in probe - allwinner: Fix min/max typo in binding" * tag 'dmaengine-fix-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo dmaengine: lgm: Fix an error handling path in intel_ldma_probe() dmaengine: pl330: Fix lockdep warning about non-static key dmaengine: idxd: Only call idxd_enable_system_pasid() if succeeded in enabling SVA feature dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly dmaengine: imx-sdma: only restart cyclic channel when enabled dmaengine: dw-axi-dmac: Fix RMW on channel suspend register dmaengine: idxd: force wq context cleanup on device disable path dmaengine: qcom: bam_dma: fix runtime PM underflow dmaengine: imx-sdma: Allow imx8m for imx7 FW revs dmaengine: Revert "dmaengine: add verification of DMA_INTERRUPT capability for dmatest" dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate commit b0d55983b2b885f6f96d6d6898d27a60bd9dc9a2 Author: Hans de Goede Date: Sun Jul 10 19:36:58 2022 +0200 platform/x86: intel_atomisp2_led: Also turn off the always-on camera LED on the Asus T100TAF Like the Asus T100TA the Asus T100TAF has a camera LED which is always on by default and both also use the same GPIO for the LED. Relax the DMI match for the Asus T100TA so that it also matches the T100TAF. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220710173658.221528-1-hdegoede@redhat.com commit 5867f3b88bb54016c42cdde510c184255488a12b Merge: b41362fdf2671 ee6c6e7342471 Author: Linus Torvalds Date: Sun Jul 10 09:51:56 2022 -0700 Merge tag 'staging-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fix from Greg KH: "Here is a single staging driver fix for a reported problem that showed up in 5.19-rc1 in the wlan-ng driver. It has been in linux-next for a week with no reported problems" * tag 'staging-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging/wlan-ng: get the correct struct hfa384x in work callback commit b41362fdf26710693535fade5e4eeda019c3b410 Merge: d9919d43cbf67 2cd37c2e72449 Author: Linus Torvalds Date: Sun Jul 10 09:45:29 2022 -0700 Merge tag 'char-misc-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are four small char/misc driver fixes for 5.19-rc6 to resolve some reported issues. They only affect two drivers: - rtsx_usb: fix for of-reported DMA warning error, the driver was handling memory buffers in odd ways, it has now been fixed up to be much simpler and correct by Shuah. - at25 eeprom driver bugfix for reported problem All of these have been in linux-next for a week with no reported problems" * tag 'char-misc-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: rtsx_usb: set return value in rsp_buf alloc err path misc: rtsx_usb: use separate command and response buffers misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer eeprom: at25: Rework buggy read splitting commit d9919d43cbf6790d2bc0c0a2743c51fc25f26919 Merge: 2fbd36dfae40c d785a773bed96 Author: Linus Torvalds Date: Sun Jul 10 09:14:54 2022 -0700 Merge tag 'io_uring-5.19-2022-07-09' of git://git.kernel.dk/linux-block Pull io_uring fix from Jens Axboe: "A single fix for an issue that came up yesterday that we should plug for -rc6. This is a regression introduced in this cycle" * tag 'io_uring-5.19-2022-07-09' of git://git.kernel.dk/linux-block: io_uring: check that we have a file table when allocating update slots commit 2fbd36dfae40cc90ba6a4761e0efff62e4d919fe Merge: 2b9b31cedb706 f5a4618587fb5 Author: Linus Torvalds Date: Sun Jul 10 08:59:02 2022 -0700 Merge tag 'kbuild-fixes-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Adjust gen_compile_commands.py to the format change of *.mod files - Remove unused macro in scripts/Makefile.modinst * tag 'kbuild-fixes-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: remove unused cmd_none in scripts/Makefile.modinst gen_compile_commands: handle multiple lines per .mod file commit 2b9b31cedb7064b16510251cf20ed44b05b71456 Merge: 74a0032b8524e 80f2a248a2f92 Author: Linus Torvalds Date: Sun Jul 10 08:52:12 2022 -0700 Merge tag 'irq_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Gracefully handle failure to request MMIO resources in the GICv3 driver - Make a static key static in the Apple AIC driver - Fix the Xilinx intc driver dependency on OF_ADDRESS * tag 'irq_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/apple-aic: Make symbol 'use_fast_ipi' static irqchip/xilinx: Add explicit dependency on OF_ADDRESS irqchip/gicv3: Handle resource request failure consistently commit 74a0032b8524ee2bd4443128c0bf9775928680b0 Merge: b1c428b6c3684 cb8a4beac39b9 Author: Linus Torvalds Date: Sun Jul 10 08:43:52 2022 -0700 Merge tag 'x86_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Prepare for and clear .brk early in order to address XenPV guests failures where the hypervisor verifies page tables and uninitialized data in that range leads to bogus failures in those checks - Add any potential setup_data entries supplied at boot to the identity pagetable mappings to prevent kexec kernel boot failures. Usually, this is not a problem for the normal kernel as those mappings are part of the initially mapped 2M pages but if kexec gets to allocate the second kernel somewhere else, those setup_data entries need to be mapped there too. - Fix objtool not to discard text references from the __tracepoints section so that ENDBR validation still works - Correct the setup_data types limit as it is user-visible, before 5.19 releases * tag 'x86_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Fix the setup data types max limit x86/ibt, objtool: Don't discard text references from tracepoint section x86/compressed/64: Add identity mappings for setup_data entries x86: Fix .brk attribute in linker script x86: Clear .brk area at early boot x86/xen: Use clear_bss() for Xen PV guests commit c483e7ea10fa889f9da5012753a6766be6e11309 Author: Hans de Goede Date: Sun Jul 10 16:07:36 2022 +0200 platform/x86/intel/ifs: Mark as BROKEN A recent suggested change to the IFS code has shown that the userspace API needs a bit more work, see: https://lore.kernel.org/platform-driver-x86/20220708151938.986530-1-jithu.joseph@intel.com/ Mark it as BROKEN before 5.19 ships, to give ourselves one more kernel-devel cycle to get the userspace API right. Link: https://lore.kernel.org/platform-driver-x86/20220708151938.986530-1-jithu.joseph@intel.com/ Cc: Jithu Joseph Cc: Ashok Raj Cc: Tony Luck Suggested-by: Greg KH Signed-off-by: Hans de Goede Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20220710140736.6492-1-hdegoede@redhat.com commit f56e676a7f1ca7de9002526df3d2ee0e47dfd8ce Author: Misaka19465 Date: Sun Jul 10 19:37:27 2022 +0800 platform/x86: asus-wmi: Add key mappings On laptops like ASUS TUF Gaming A15, which have hotkeys to start Armoury Crate or AURA Sync, these hotkeys are unavailable. This patch add mappings for them. Signed-off-by: Misaka19465 Link: https://lore.kernel.org/r/20220710113727.281634-1-misaka19465@olddoctor.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit d40908f2621ea7abc6132ec8c5688a2960eeee3c Author: Hans de Goede Date: Fri Jul 8 15:14:12 2022 +0200 efi: Fix efi_power_off() not being run before acpi_power_off() when necessary Commit 98f30d0ecf79 ("ACPI: power: Switch to sys-off handler API") switched the ACPI sleep code from directly setting the old global pm_power_off handler to using the new register_sys_off_handler() mechanism with a priority of SYS_OFF_PRIO_FIRMWARE. This is a problem when the old global pm_power_off handler would later be overwritten, such as done by the late_initcall(efi_shutdown_init): if (efi_poweroff_required()) pm_power_off = efi_power_off; The old global pm_power_off handler gets run with a priority of SYS_OFF_PRIO_DEFAULT which is lower then SYS_OFF_PRIO_FIRMWARE, causing acpi_power_off() to run first, changing the behavior from before the ACPI sleep code switched to the new register_sys_off_handler(). Switch the registering of efi_power_off over to register_sys_off_handler() with a priority of SYS_OFF_PRIO_FIRMWARE + 1 so that it will run before acpi_power_off() as before. Note since the new sys-off-handler code will try all handlers in priority order, there is no more need for the EFI code to store and call the original pm_power_off handler. Fixes: 98f30d0ecf79 ("ACPI: power: Switch to sys-off handler API") Cc: Dmitry Osipenko Signed-off-by: Hans de Goede Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220708131412.81078-3-hdegoede@redhat.com commit 4ce8f4c2027db46299b450b28e9e116aaf00a757 Author: Hans de Goede Date: Fri Jul 8 15:14:11 2022 +0200 platform/x86: x86-android-tablets: Fix Lenovo Yoga Tablet 2 830/1050 poweroff again Commit 98f30d0ecf79 ("ACPI: power: Switch to sys-off handler API") switched the ACPI sleep code from directly setting the old global pm_power_off handler to using the new register_sys_off_handler() mechanism with a priority of SYS_OFF_PRIO_FIRMWARE. This is a problem in special cases where the old global pm_power_off handler later gets overwritten, such as the Lenovo Tab2 poweroff bugfix in x86-android-tablets. The old global pm_power_off handler gets run with a priority of SYS_OFF_PRIO_DEFAULT which is lower then SYS_OFF_PRIO_FIRMWARE, causing the troublesome ACPI poweroff (which freezes the system) to run first. Switch the registering of lenovo_yoga_tab2_830_1050_power_off over to register_sys_off_handler() with a priority of SYS_OFF_PRIO_FIRMWARE + 1 so that it will run before acpi_power_off() to fix this. Fixes: 98f30d0ecf79 ("ACPI: power: Switch to sys-off handler API") Cc: Dmitry Osipenko Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220708131412.81078-2-hdegoede@redhat.com commit 5d62261a65698c1ee4e71f00963b269282015b1e Author: Pär Eriksson Date: Tue Jul 5 20:44:07 2022 +0200 platform/x86: gigabyte-wmi: add support for B660I AORUS PRO DDR4 Add support for the B660I AORUS PRO DDR4. Signed-off-by: Pär Eriksson Link: https://lore.kernel.org/r/20220705184407.14181-1-parherman@gmail.com Signed-off-by: Hans de Goede commit 4ddef52f26cfaf330240c93d7685a00628c66b04 Author: Shyam Sundar S K Date: Thu Jun 30 10:33:24 2022 +0530 platform/x86/amd/pmc: Add new platform support PMC driver can be supported on a new upcoming platform. Add this information to the support list. Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20220630050324.3780654-2-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 1968f2be5c03073c3f90d49226723eac4d431282 Author: Shyam Sundar S K Date: Thu Jun 30 10:33:23 2022 +0530 platform/x86/amd/pmc: Add new acpi id for PMC controller New version of PMC controller will have a separate ACPI id, add that to the support list. Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20220630050324.3780654-1-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit f5a4618587fb5c5eb5fec3dcce165ca8fd7d7f91 Author: Masahiro Yamada Date: Thu Jun 30 17:09:35 2022 +0900 kbuild: remove unused cmd_none in scripts/Makefile.modinst Commit 65ce9c38326e ("kbuild: move module strip/compression code into scripts/Makefile.modinst") added this unused code. Perhaps, I thought cmd_none was useful for CONFIG_MODULE_COMPRESS_NONE, but I did not use it after all. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit cb8a4beac39b90cd60abbf9fd639a3357274e469 Author: Borislav Petkov Date: Sun Jul 10 11:15:47 2022 +0200 x86/boot: Fix the setup data types max limit Commit in Fixes forgot to change the SETUP_TYPE_MAX definition which contains the highest valid setup data type. Correct that. Fixes: 5ea98e01ab52 ("x86/boot: Add Confidential Computing type to setup_data") Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/ddba81dd-cc92-699c-5274-785396a17fb5@zytor.com commit b1c428b6c3684ee8ddf4137d68b3e8d51d2a700f Merge: d9cdc3b12525c 3501f0c663063 Author: Linus Torvalds Date: Sat Jul 9 11:20:15 2022 -0700 Merge tag 'i2c-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two I2C driver bugfixes preventing resource leaks" * tag 'i2c-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: cadence: Unregister the clk notifier in error path i2c: piix4: Fix a memory leak in the EFCH MMIO support commit 84499c5d220a4f8fb0a35fa4673148525c81ea83 Author: Thomas Zimmermann Date: Fri Jun 17 14:10:27 2022 +0200 drm/aperture: Run fbdev removal before internal helpers Always run fbdev removal first to remove simpledrm via sysfb_disable(). This clears the internal state. The later call to drm_aperture_detach_drivers() then does nothing. Otherwise, with drm_aperture_detach_drivers() running first, the call to sysfb_disable() uses inconsistent state. Example backtrace show below: BUG: KASAN: use-after-free in device_del+0x79/0x5f0 Read of size 8 at addr ffff888108185050 by task systemd-udevd/311 CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G E 5.19.0-rc2-1-default+ #1689 Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011 Call Trace: device_del+0x79/0x5f0 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x30 sysfb_disable+0x2d/0x70 remove_conflicting_framebuffers+0x1c/0xf0 remove_conflicting_pci_framebuffers+0x130/0x1a0 drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0 mgag200_pci_probe+0x2d/0x140 [mgag200] Signed-off-by: Thomas Zimmermann Fixes: 873eb3b11860 ("fbdev: Disable sysfb device registration when removing conflicting FBs") Cc: Javier Martinez Canillas Cc: Daniel Vetter Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Helge Deller Cc: Thomas Zimmermann Cc: Alex Deucher Cc: Zhen Lei Cc: Changcheng Deng Reviewed-by: Zack Rusin Reviewed-by: Javier Martinez Canillas Signed-off-by: Linus Torvalds commit de2a34771f5123270bc3842535ac91673116dd03 Author: Sven Schnelle Date: Wed Jul 6 12:16:25 2022 +0200 ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() CI reported the following splat while running the strace testsuite: WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178 CPU: 1 PID: 3570031 Comm: strace Tainted: G OE 5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1 Hardware name: IBM 3906 M04 704 (z/VM 7.1.0) Call Trace: [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178 ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178) [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160 [<00000000ac03fcec>] __do_syscall+0x1d4/0x200 [<00000000ac04e312>] system_call+0x82/0xb0 Last Breaking-Event-Address: [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190 This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED state. Caused by ptrace_unfreeze_traced() which does: task->jobctl &= ~TASK_TRACED but it should be: task->jobctl &= ~JOBCTL_TRACED Fixes: 31cae1eaae4f ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state") Signed-off-by: Sven Schnelle Tested-by: Alexander Gordeev Acked-by: Oleg Nesterov Acked-by: Peter Zijlstra Cc: Eric Biederman Cc: Steven Rostedt Cc: Kees Cook Signed-off-by: Linus Torvalds commit d9cdc3b12525c85b4a2a8b6f3f8f61d9f467ab9a Merge: e5524c2a1fc40 887502826549c Author: Linus Torvalds Date: Sat Jul 9 10:34:08 2022 -0700 Merge tag 'powerpc-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - On Power8 bare metal, fix creation of RNG platform devices, which are needed for the /dev/hwrng driver to probe correctly. Thanks to Jason A. Donenfeld, and Sachin Sant. * tag 'powerpc-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/powernv: delay rng platform device creation until later in boot commit a4bd9358d5539516c19daa1b35b36bbc0c0637df Merge: c5e58c4545a69 fc976f5629afb Author: Takashi Iwai Date: Sat Jul 9 18:23:54 2022 +0200 Merge tag 'asoc-fix-v5.19-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 Quite a large batch due to things building up for a couple of weeks but all driver specific apart from Marek's documentation fix. commit c39ba4de6b0a843bec5d46c2b6f2064428dada5e Author: Pablo Neira Ayuso Date: Tue Jul 5 11:41:59 2022 +0200 netfilter: nf_tables: replace BUG_ON by element length check BUG_ON can be triggered from userspace with an element with a large userdata area. Replace it by length check and return EINVAL instead. Over time extensions have been growing in size. Pick a sufficiently old Fixes: tag to propagate this fix. Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") Signed-off-by: Pablo Neira Ayuso commit d785a773bed966a75ca1f11d108ae1897189975b Author: Jens Axboe Date: Sat Jul 9 07:02:10 2022 -0600 io_uring: check that we have a file table when allocating update slots If IORING_FILE_INDEX_ALLOC is set asking for an allocated slot, the helper doesn't check if we actually have a file table or not. The non alloc path does do that correctly, and returns -ENXIO if we haven't set one up. Do the same for the allocated path, avoiding a NULL pointer dereference when trying to find a free bit. Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots") Signed-off-by: Jens Axboe commit 72a0b329114b1caa8e69dfa7cdad1dd3c69b8602 Author: Eric Dumazet Date: Fri Jul 8 15:11:53 2022 +0000 vlan: fix memory leak in vlan_newlink() Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority") If a memory allocation fails in vlan_changelink() after other allocations succeeded, we need to call vlan_dev_free_egress_priority() to free all allocated memory because after a failed ->newlink() we do not call any methods like ndo_uninit() or dev->priv_destructor(). In following example, if the allocation for last element 2000:2001 fails, we need to free eight prior allocations: ip link add link dummy0 dummy0.100 type vlan id 100 \ egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001 syzbot report was: BUG: memory leak unreferenced object 0xffff888117bd1060 (size 32): comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s) hex dump (first 32 bytes): 09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:600 [inline] [] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193 [] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128 [] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185 [] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] [] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580 [] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593 [] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089 [] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501 [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [] sock_sendmsg_nosec net/socket.c:714 [inline] [] sock_sendmsg+0x56/0x80 net/socket.c:734 [] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488 [] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542 [] __sys_sendmsg net/socket.c:2571 [inline] [] __do_sys_sendmsg net/socket.c:2580 [inline] [] __se_sys_sendmsg net/socket.c:2578 [inline] [] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 37aa50c539bc ("vlan: introduce vlan_dev_free_egress_priority") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Xin Long Reviewed-by: Xin Long Signed-off-by: David S. Miller commit 9c840d5f9aaef87e65db900bae21c70b059aba5f Author: Baowen Zheng Date: Fri Jul 8 11:07:18 2022 +0100 nfp: fix issue of skb segments exceeds descriptor limitation TCP packets will be dropped if the segments number in the tx skb exceeds limitation when sending iperf3 traffic with --zerocopy option. we make the following changes: Get nr_frags in nfp_nfdk_tx_maybe_close_block instead of passing from outside because it will be changed after skb_linearize operation. Fill maximum dma_len in first tx descriptor to make sure the whole head is included in the first descriptor. Fixes: c10d12e3dce8 ("nfp: add support for NFDK data path") Signed-off-by: Baowen Zheng Reviewed-by: Louis Peens Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 4ad3278df6fe2b0852b00d5757fc2ccd8e92c26e Author: Pawan Gupta Date: Fri Jul 8 13:36:09 2022 -0700 x86/speculation: Disable RRSBA behavior Some Intel processors may use alternate predictors for RETs on RSB-underflow. This condition may be vulnerable to Branch History Injection (BHI) and intramode-BTI. Kernel earlier added spectre_v2 mitigation modes (eIBRS+Retpolines, eIBRS+LFENCE, Retpolines) which protect indirect CALLs and JMPs against such attacks. However, on RSB-underflow, RET target prediction may fallback to alternate predictors. As a result, RET's predicted target may get influenced by branch history. A new MSR_IA32_SPEC_CTRL bit (RRSBA_DIS_S) controls this fallback behavior when in kernel mode. When set, RETs will not take predictions from alternate predictors, hence mitigating RETs as well. Support for this is enumerated by CPUID.7.2.EDX[RRSBA_CTRL] (bit2). For spectre v2 mitigation, when a user selects a mitigation that protects indirect CALLs and JMPs against BHI and intramode-BTI, set RRSBA_DIS_S also to protect RETs for RSB-underflow case. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 697977d8415d61f3acbc4ee6d564c9dcf0309507 Author: Konrad Rzeszutek Wilk Date: Fri Jul 8 19:10:11 2022 +0200 x86/kexec: Disable RET on kexec All the invocations unroll to __x86_return_thunk and this file must be PIC independent. This fixes kexec on 64-bit AMD boxes. [ bp: Fix 32-bit build. ] Reported-by: Edward Tran Reported-by: Awais Tanveer Suggested-by: Ankur Arora Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Alexandre Chartre Signed-off-by: Borislav Petkov commit 7a847c00eeba9744353ecdfad253143b9115678a Author: Pablo Neira Ayuso Date: Tue Jul 5 10:26:15 2022 +0200 netfilter: nf_log: incorrect offset to network header NFPROTO_ARP is expecting to find the ARP header at the network offset. In the particular case of ARP, HTYPE= field shows the initial bytes of the ethernet header destination MAC address. netdev out: IN= OUT=bridge0 MACSRC=c2:76:e5:71:e1:de MACDST=36:b0:4a:e2:72:ea MACPROTO=0806 ARP HTYPE=14000 PTYPE=0x4ae2 OPCODE=49782 NFPROTO_NETDEV egress hook is also expecting to find the IP headers at the network offset. Fixes: 35b9395104d5 ("netfilter: add generic ARP packet logger") Reported-by: Tom Yan Signed-off-by: Pablo Neira Ayuso commit 2a96271fb66c499e4a89d76a89d3d01170c10bef Author: Siarhei Vishniakou Date: Fri Jul 8 21:59:23 2022 -0700 Input: document the units for resolution of size axes Today, the resolution of size axes is not documented. As a result, it's not clear what the canonical interpretation of this value should be. On Android, there is a need to calculate the size of the touch ellipse in physical units (millimeters). After reviewing linux source, it turned out that most of the existing usages are already interpreting this value as "units/mm". This documentation will make it explicit. This will help device implementations with correctly following the linux specs, and will ensure that the devices will work on Android without needing further customized parameters for scaling of major/minor values. Signed-off-by: Siarhei Vishniakou Reviewed-by: Jeff LaBundy Link: https://lore.kernel.org/r/20220520084514.3451193-1-svv@google.com Signed-off-by: Dmitry Torokhov commit 3de93e6ed2df6521e3f68fb45eec0bb4fe1bb218 Author: Hans de Goede Date: Fri Jul 8 21:42:12 2022 -0700 Input: goodix - call acpi_device_fix_up_power() in some cases On ACPI boards, when we cannot get the GPIOs to do a reset ourselves if necessary, call acpi_device_fix_up_power() to force the ACPI _PS0 method to run. On some devices without proper GPIO descriptions this will reset the touchscreen for us and this may be necessary for us to be able to communicate to the touchscreen at all. Specifically on an Aya Neo Next this change will cause the _PS0() ACPI function to call INIT() which does: Method (INIT, 0, Serialized) { TP_I = 0x00A50000 TP_R = 0x00A50000 Sleep (0x0A) TP_I = 0x00E50000 Sleep (One) TP_R = 0x00E50000 Sleep (0x06) TP_I = 0x00A50000 Sleep (0x3C) TP_I = 0x00041800 } On older kernels the ACPI core assumed a power-on was necessary by itself and would run _PS0 before our probe function runs, which can be seen from the GPIO pin ctrl registers in /sys/kernel/debug/gpio which match the above hex values with older kernels. With newer kernels before this change the GPIO pin ctrl registers do not match, indicating INIT() has not run and probing the touchscreen fails. This change makes Linux run _PS0() again fixing the touchscreen not working on the Aya Neo Next. Reported-and-tested-by: Maya Matuszczyk Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220618210233.208027-1-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov commit 6676d7270ce254596ab1d4ae0de27b8e19705d44 Merge: 7c895ef88403b cfbba7b46aef6 Author: Jakub Kicinski Date: Fri Jul 8 20:31:02 2022 -0700 Merge branch 'selftests-forwarding-install-two-missing-tests' Martin Blumenstingl says: ==================== selftests: forwarding: Install two missing tests For some distributions (e.g. OpenWrt) we don't want to rely on rsync to copy the tests to the target as some extra dependencies need to be installed. The Makefile in tools/testing/selftests/net/forwarding already installs most of the tests. This series adds the two missing tests to the list of installed tests. That way a downstream distribution can build a package using this Makefile (and add dependencies there as needed). ==================== Link: https://lore.kernel.org/r/20220707135532.1783925-1-martin.blumenstingl@googlemail.com Signed-off-by: Jakub Kicinski commit cfbba7b46aef631445909ab4c35b98c16e36074b Author: Martin Blumenstingl Date: Thu Jul 7 15:55:32 2022 +0200 selftests: forwarding: Install no_forwarding.sh When using the Makefile from tools/testing/selftests/net/forwarding/ all tests should be installed. Add no_forwarding.sh to the list of "to be installed tests" where it has been missing so far. Fixes: 476a4f05d9b83f ("selftests: forwarding: add a no_forwarding.sh test") Signed-off-by: Martin Blumenstingl Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 437ac2592c09fcf27430db3ac878d2a566a58692 Author: Martin Blumenstingl Date: Thu Jul 7 15:55:31 2022 +0200 selftests: forwarding: Install local_termination.sh When using the Makefile from tools/testing/selftests/net/forwarding/ all tests should be installed. Add local_termination.sh to the list of "to be installed tests" where it has been missing so far. Fixes: 90b9566aa5cd3f ("selftests: forwarding: add a test for local_termination.sh") Signed-off-by: Martin Blumenstingl Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit e5524c2a1fc4002a52e16236659e779767617a4f Merge: 525496a030de4 85e4ea1049c70 Author: Linus Torvalds Date: Fri Jul 8 16:08:48 2022 -0700 Merge tag 'fscache-fixes-20220708' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache fixes from David Howells: - Fix a check in fscache_wait_on_volume_collision() in which the polarity is reversed. It should complain if a volume is still marked acquisition-pending after 20s, but instead complains if the mark has been cleared (ie. the condition has cleared). Also switch an open-coded test of the ACQUIRE_PENDING volume flag to use the helper function for consistency. - Not a fix per se, but neaten the code by using a helper to check for the DROPPED state. - Fix cachefiles's support for erofs to only flush requests associated with a released control file, not all requests. - Fix a race between one process invalidating an object in the cache and another process trying to look it up. * tag 'fscache-fixes-20220708' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: Fix invalidation/lookup race cachefiles: narrow the scope of flushed requests when releasing fd fscache: Introduce fscache_cookie_is_dropped() fscache: Fix if condition in fscache_wait_on_volume_collision() commit 7c895ef88403bf970843c443a29e0385f65c3f39 Merge: 32b3ad1418ea5 f8d3da4ef8faf Author: Jakub Kicinski Date: Fri Jul 8 15:24:16 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== bpf 2022-07-08 We've added 3 non-merge commits during the last 2 day(s) which contain a total of 7 files changed, 40 insertions(+), 24 deletions(-). The main changes are: 1) Fix cBPF splat triggered by skb not having a mac header, from Eric Dumazet. 2) Fix spurious packet loss in generic XDP when pushing packets out (note that native XDP is not affected by the issue), from Johan Almbladh. 3) Fix bpf_dynptr_{read,write}() helper signatures with flag argument before its set in stone as UAPI, from Joanne Koong. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Add flags arg to bpf_dynptr_read and bpf_dynptr_write APIs bpf: Make sure mac_header was set before using it xdp: Fix spurious packet loss in generic XDP TX path ==================== Link: https://lore.kernel.org/r/20220708213418.19626-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 3418357a32db6c8ce5e4417964bac1edcc3f281a Author: Sven Schnelle Date: Wed Jul 6 12:16:25 2022 +0200 ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() CI reported the following splat while running the strace testsuite: [ 3976.640309] WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178 [ 3976.640391] CPU: 1 PID: 3570031 Comm: strace Tainted: G OE 5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1 [ 3976.640410] Hardware name: IBM 3906 M04 704 (z/VM 7.1.0) [ 3976.640452] Call Trace: [ 3976.640454] [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178 [ 3976.640457] ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178) [ 3976.640460] [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160 [ 3976.640463] [<00000000ac03fcec>] __do_syscall+0x1d4/0x200 [ 3976.640468] [<00000000ac04e312>] system_call+0x82/0xb0 [ 3976.640470] Last Breaking-Event-Address: [ 3976.640471] [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190 This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED state. Caused by ptrace_unfreeze_traced() which does: task->jobctl &= ~TASK_TRACED but it should be: task->jobctl &= ~JOBCTL_TRACED Fixes: 31cae1eaae4f ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state") Signed-off-by: Sven Schnelle Link: https://lkml.kernel.org/r/20220706101625.2100298-1-svens@linux.ibm.com Link: https://lkml.kernel.org/r/YrHA5UkJLornOdCz@li-4a3a4a4c-28e5-11b2-a85c-a8d192c6f089.ibm.com Link: https://bugzilla.redhat.com/show_bug.cgi?id=2101641 Acked-by: Peter Zijlstra (Intel) Tested-by: Alexander Gordeev Tested-by: Linus Torvalds Signed-off-by: Eric W. Biederman commit 3f231ccb38835121034a8fe09c798e57801ff4fd Merge: 5b7925988de46 884b66976a727 Author: Arnd Bergmann Date: Fri Jul 8 22:47:33 2022 +0200 Merge tag 'sunxi-fixes-for-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes - Fix SPI NOR compatible on Orange Pi Zero * tag 'sunxi-fixes-for-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero Link: https://lore.kernel.org/r/Ysh44qUmdmF6TWS6@kista.localdomain Signed-off-by: Arnd Bergmann commit 5b7925988de4653f70831857c269af083806177a Merge: 5e7230a4daf97 79471f29ec487 Author: Arnd Bergmann Date: Fri Jul 8 22:45:00 2022 +0200 Merge tag 'sunxi-fixes-for-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes - fix binding for D1 display pipeline * tag 'sunxi-fixes-for-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: dt-bindings: display: sun4i: Fix D1 pipeline count Link: https://lore.kernel.org/r/YshiPKZRq6NHxPzO@kista.localdomain Signed-off-by: Arnd Bergmann commit 5e7230a4daf97d2fb4c764395f1c79fc420dd96f Merge: 2dc94f06127f3 2fdf15b50a46e Author: Arnd Bergmann Date: Fri Jul 8 22:43:59 2022 +0200 Merge tag 'at91-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 5.19 #2 It contains 2 DT fixes: - one for SAMA5D2 to fix the i2s1 assigned-clock-parents property - one for kswitch-d10 (LAN966 based) enforcing proper settings on GPIO pins * tag 'at91-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama5d2: Fix typo in i2s1 node ARM: dts: kswitch-d10: use open drain mode for coma-mode pins Link: https://lore.kernel.org/r/20220708151621.860339-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 12dc6adc49c9c491d830504e1e01b688ef789093 Author: Uwe Kleine-König Date: Fri Jul 8 13:19:19 2022 -0700 Input: wm97xx - make .remove() obviously always return 0 wm97xx_remove() returns zero unconditionally. To prepare changing the prototype for platform remove callbacks to return void, make it explicit that wm97xx_mfd_remove() always returns zero. The prototype for wm97xx_remove cannot be changed, as it's also used as a plain device remove callback. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220708062718.240013-1-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov commit 525496a030de4ae64bb9e1d6bfc88eec6f5fe6e2 Merge: 3784fad934c5b 8b356e536e69f Author: Linus Torvalds Date: Fri Jul 8 13:05:56 2022 -0700 Merge tag 'acpi-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix two recent regressions related to CPPC support. Specifics: - Prevent _CPC from being used if the platform firmware does not confirm CPPC v2 support via _OSC (Mario Limonciello) - Allow systems with X86_FEATURE_CPPC set to use _CPC even if CPPC support cannot be agreed on via _OSC (Mario Limonciello)" * tag 'acpi-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked commit 3784fad934c5bd68551f0af4252821697957a72a Merge: 483e4a1d83db1 fe7c758c07c47 Author: Linus Torvalds Date: Fri Jul 8 13:01:04 2022 -0700 Merge tag 'pm-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a NULL pointer dereference in a devfreq driver and a runtime PM framework issue that may cause a supplier device to be suspended before its consumer. Specifics: - Fix NULL pointer dereference related to printing a diagnostic message in the exynos-bus devfreq driver (Christian Marangi) - Fix race condition in the runtime PM framework which in some cases may cause a supplier device to be suspended when its consumer is still active (Rafael Wysocki)" * tag 'pm-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / devfreq: exynos-bus: Fix NULL pointer dereference PM: runtime: Fix supplier device management during consumer probe PM: runtime: Redefine pm_runtime_release_supplier() commit 483e4a1d83db1a6d339cd76f7966bf9e1748f752 Merge: f5645edf6cffb e35f5718903b0 Author: Linus Torvalds Date: Fri Jul 8 12:55:25 2022 -0700 Merge tag 'cxl-fixes-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Vishal Verma: - Update MAINTAINERS for Ben's email - Fix cleanup of port devices on failure to probe driver - Fix endianness in get/set LSA mailbox command structures - Fix memregion_free() fallback definition - Fix missing variable payload checks in CXL cmd size validation * tag 'cxl-fixes-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/mbox: Fix missing variable payload checks in cmd size validation memregion: Fix memregion_free() fallback definition cxl/mbox: Use __le32 in get,set_lsa mailbox structures cxl/core: Use is_endpoint_decoder cxl: Fix cleanup of port devices on failure to probe driver. MAINTAINERS: Update Ben's email address commit f5645edf6cffb97d976c6eef31fb536a09f114fd Merge: 2b93fe647c0a9 c51b8f85c4157 Author: Linus Torvalds Date: Fri Jul 8 12:49:00 2022 -0700 Merge tag 'iommu-fixes-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - fix device setup failures in the Intel VT-d driver when the PASID table is shared - fix Intel VT-d device hot-add failure due to wrong device notifier order - remove the old IOMMU mailing list from the MAINTAINERS file now that it has been retired * tag 'iommu-fixes-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: MAINTAINERS: Remove iommu@lists.linux-foundation.org iommu/vt-d: Fix RID2PASID setup/teardown failure iommu/vt-d: Fix PCI bus rescan device hot add commit 8bd582ae9a71d7f14c4e0c735b2eacaf7516d626 Author: William Zhang Date: Fri Jul 8 11:25:07 2022 -0700 arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot Add spin-table enable-method and cpu-release-addr properties for cpu0 node. This is required by all ARMv8 SoC. Otherwise some bootloader like u-boot can not update cpu-release-addr and linux fails to start up secondary cpus. Fixes: 2961f69f151c ("arm64: dts: broadcom: add BCM4908 and Asus GT-AC5300 early DTS files") Signed-off-by: William Zhang Signed-off-by: Florian Fainelli commit b4a544e415e9be33b37d9bfa9d9f9f4d13f553d6 Author: William Zhang Date: Fri Jul 8 11:25:06 2022 -0700 arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC The cpu mask value in interrupt property inherits from bcm4908.dtsi which sets to four cpus. Correct the value to two cpus for dual core BCM4906 SoC. Fixes: c8b404fb05dc ("arm64: dts: broadcom: bcm4908: add BCM4906 Netgear R8000P DTS files") Signed-off-by: William Zhang Signed-off-by: Florian Fainelli commit 2b93fe647c0a901e00eba0adab84a6ecba3f25c4 Merge: a471da3100ef2 c8e27a4a5136e Author: Linus Torvalds Date: Fri Jul 8 12:39:52 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a build error in gpio-vf610 - fix a null-pointer dereference in the GPIO character device code * tag 'gpio-fixes-for-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: cdev: fix null pointer dereference in linereq_free() gpio: vf610: fix compilation error commit fe7c758c07c4729a16f940eb1d77027ad032ab29 Merge: ba7c3507087aa 8873710660390 Author: Rafael J. Wysocki Date: Fri Jul 8 20:38:51 2022 +0200 Merge branch 'pm-core' Merge a runtime PM framework cleanup and fix related to device links. * pm-core: PM: runtime: Fix supplier device management during consumer probe PM: runtime: Redefine pm_runtime_release_supplier() commit a471da3100ef2e8feb8449d378a52e29dd1e9ae1 Merge: 29837019d5ebb 6b0de7d0f3285 Author: Linus Torvalds Date: Fri Jul 8 11:32:23 2022 -0700 Merge tag 'block-5.19-2022-07-08' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "NVMe pull request with another id quirk addition, and a tracing fix" * tag 'block-5.19-2022-07-08' of git://git.kernel.dk/linux-block: nvme: use struct group for generic command dwords nvme-pci: phison e16 has bogus namespace ids commit 884b66976a7279ee889ba885fe364244d50b79e7 Author: Michal Suchanek Date: Fri Jul 8 19:45:29 2022 +0200 ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero The device tree should include generic "jedec,spi-nor" compatible, and a manufacturer-specific one. The macronix part is what is shipped on the boards that come with a flash chip. Fixes: 45857ae95478 ("ARM: dts: orange-pi-zero: add node for SPI NOR") Signed-off-by: Michal Suchanek Acked-by: Jernej Skrabec Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220708174529.3360-1-msuchanek@suse.de commit 29837019d5ebb80a5f180af3107a0645c731a770 Merge: 086ff84617185 bdb2c48e4b38e Author: Linus Torvalds Date: Fri Jul 8 11:25:01 2022 -0700 Merge tag 'io_uring-5.19-2022-07-08' of git://git.kernel.dk/linux-block Pull io_uring tweak from Jens Axboe: "Just a minor tweak to an addition made in this release cycle: padding a 32-bit value that's in a 64-bit union to avoid any potential funkiness from that" * tag 'io_uring-5.19-2022-07-08' of git://git.kernel.dk/linux-block: io_uring: explicit sqe padding for ioctl commands commit 086ff84617185393a0bbf25830c4f36412a7d3f4 Merge: e8a4e1c1bb697 53a6e66b1b4fe Author: Linus Torvalds Date: Fri Jul 8 11:03:26 2022 -0700 Merge tag 'for-5.19/fbdev-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - fbcon now prevents switching to screen resolutions which are smaller than the font size, and prevents enabling a font which is bigger than the current screen resolution. This fixes vmalloc-out-of-bounds accesses found by KASAN. - Guiling Deng fixed a bug where the centered fbdev logo wasn't displayed correctly if the screen size matched the logo size. - Hsin-Yi Wang provided a patch to include errno.h to fix build when CONFIG_OF isn't enabled. * tag 'for-5.19/fbdev-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbcon: Use fbcon_info_from_console() in fbcon_modechange_possible() fbmem: Check virtual screen sizes in fb_set_var() fbcon: Prevent that screen size is smaller than font size fbcon: Disallow setting font bigger than screen size video: of_display_timing.h: include errno.h fbdev: fbmem: Fix logo center image dx issue commit b3a3b0255797e1d395253366ba24a4cc6c8bdf9c Author: Naohiro Aota Date: Wed Jun 29 11:00:38 2022 +0900 btrfs: zoned: drop optimization of zone finish We have an optimization in do_zone_finish() to send REQ_OP_ZONE_FINISH only when necessary, i.e. we don't send REQ_OP_ZONE_FINISH when we assume we wrote fully into the zone. The assumption is determined by "alloc_offset == capacity". This condition won't work if the last ordered extent is canceled due to some errors. In that case, we consider the zone is deactivated without sending the finish command while it's still active. This inconstancy results in activating another block group while we cannot really activate the underlying zone, which causes the active zone exceeds errors like below. BTRFS error (device nvme3n2): allocation failed flags 1, wanted 520192 tree-log 0, relocation: 0 nvme3n2: I/O Cmd(0x7d) @ LBA 160432128, 127 blocks, I/O Error (sct 0x1 / sc 0xbd) MORE DNR active zones exceeded error, dev nvme3n2, sector 0 op 0xd:(ZONE_APPEND) flags 0x4800 phys_seg 1 prio class 0 nvme3n2: I/O Cmd(0x7d) @ LBA 160432128, 127 blocks, I/O Error (sct 0x1 / sc 0xbd) MORE DNR active zones exceeded error, dev nvme3n2, sector 0 op 0xd:(ZONE_APPEND) flags 0x4800 phys_seg 1 prio class 0 Fix the issue by removing the optimization for now. Fixes: 8376d9e1ed8f ("btrfs: zoned: finish superblock zone once no space left for new SB") Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 2963457829decf0c824a443238d251151ed18ff5 Author: Christoph Hellwig Date: Thu Jun 30 18:03:19 2022 +0200 btrfs: zoned: fix a leaked bioc in read_zone_info The bioc would leak on the normal completion path and also on the RAID56 check (but that one won't happen in practice due to the invalid combination with zoned mode). Fixes: 7db1c5d14dcd ("btrfs: zoned: support dev-replace in zoned filesystems") CC: stable@vger.kernel.org # 5.16+ Reviewed-by: Anand Jain Signed-off-by: Christoph Hellwig [ update changelog ] Reviewed-by: David Sterba Signed-off-by: David Sterba commit a4527e1853f8ff6e0b7c2dadad6268bd38427a31 Author: Filipe Manana Date: Mon Jul 4 12:42:03 2022 +0100 btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents When doing a direct IO read or write, we always return -ENOTBLK when we find a compressed extent (or an inline extent) so that we fallback to buffered IO. This however is not ideal in case we are in a NOWAIT context (io_uring for example), because buffered IO can block and we currently have no support for NOWAIT semantics for buffered IO, so if we need to fallback to buffered IO we should first signal the caller that we may need to block by returning -EAGAIN instead. This behaviour can also result in short reads being returned to user space, which although it's not incorrect and user space should be able to deal with partial reads, it's somewhat surprising and even some popular applications like QEMU (Link tag #1) and MariaDB (Link tag #2) don't deal with short reads properly (or at all). The short read case happens when we try to read from a range that has a non-compressed and non-inline extent followed by a compressed extent. After having read the first extent, when we find the compressed extent we return -ENOTBLK from btrfs_dio_iomap_begin(), which results in iomap to treat the request as a short read, returning 0 (success) and waiting for previously submitted bios to complete (this happens at fs/iomap/direct-io.c:__iomap_dio_rw()). After that, and while at btrfs_file_read_iter(), we call filemap_read() to use buffered IO to read the remaining data, and pass it the number of bytes we were able to read with direct IO. Than at filemap_read() if we get a page fault error when accessing the read buffer, we return a partial read instead of an -EFAULT error, because the number of bytes previously read is greater than zero. So fix this by returning -EAGAIN for NOWAIT direct IO when we find a compressed or an inline extent. Reported-by: Dominique MARTINET Link: https://lore.kernel.org/linux-btrfs/YrrFGO4A1jS0GI0G@atmark-techno.com/ Link: https://jira.mariadb.org/browse/MDEV-27900?focusedCommentId=216582&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-216582 Tested-by: Dominique MARTINET CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Christoph Hellwig Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 2fdf15b50a46e366740df4cccbe2343269b4ff55 Author: Ryan Wanner Date: Thu Jul 7 14:58:12 2022 -0700 ARM: dts: at91: sama5d2: Fix typo in i2s1 node Fix typo in i2s1 causing errors in dt binding validation. Change assigned-parrents to assigned-clock-parents to match i2s0 node formatting. Fixes: 1ca81883c557 ("ARM: dts: at91: sama5d2: add nodes for I2S controllers") Signed-off-by: Ryan Wanner [claudiu.beznea: use imperative addressing in commit description, remove blank line after fixes tag, fix typo in commit message] Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220707215812.193008-1-Ryan.Wanner@microchip.com commit 2dc94f06127f306201b10617df54ea7f265bcce9 Merge: a902fa8eccaf9 e5ce073c8a1e0 Author: Arnd Bergmann Date: Fri Jul 8 15:59:42 2022 +0200 Merge tag 'tee-fixes-for-v5.19' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fixes for TEE subsystem A fix for the recently merged commit ed8faf6c8f8c ("optee: add OPTEE_SMC_CALL_WITH_RPC_ARG and OPTEE_SMC_CALL_WITH_REGD_ARG"). Two small fixes in comment, repeated words etc. * tag 'tee-fixes-for-v5.19' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: tee_get_drvdata(): fix description of return value optee: Remove duplicate 'of' in two places. optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR() Link: https://lore.kernel.org/r/20220708134607.GA901814@jade Signed-off-by: Arnd Bergmann commit 4a47c6385bb4e0786826e75bd4555aba32953653 Author: Christian Brauner Date: Wed Jul 6 15:56:11 2022 +0200 ovl: turn of SB_POSIXACL with idmapped layers temporarily This cycle we added support for mounting overlayfs on top of idmapped mounts. Recently I've started looking into potential corner cases when trying to add additional tests and I noticed that reporting for POSIX ACLs is currently wrong when using idmapped layers with overlayfs mounted on top of it. I have sent out an patch that fixes this and makes POSIX ACLs work correctly but the patch is a bit bigger and we're already at -rc5 so I recommend we simply don't raise SB_POSIXACL when idmapped layers are used. Then we can fix the VFS part described below for the next merge window so we can have good exposure in -next. I'm going to give a rather detailed explanation to both the origin of the problem and mention the solution so people know what's going on. Let's assume the user creates the following directory layout and they have a rootfs /var/lib/lxc/c1/rootfs. The files in this rootfs are owned as you would expect files on your host system to be owned. For example, ~/.bashrc for your regular user would be owned by 1000:1000 and /root/.bashrc would be owned by 0:0. IOW, this is just regular boring filesystem tree on an ext4 or xfs filesystem. The user chooses to set POSIX ACLs using the setfacl binary granting the user with uid 4 read, write, and execute permissions for their .bashrc file: setfacl -m u:4:rwx /var/lib/lxc/c2/rootfs/home/ubuntu/.bashrc Now they to expose the whole rootfs to a container using an idmapped mount. So they first create: mkdir -pv /vol/contpool/{ctrover,merge,lowermap,overmap} mkdir -pv /vol/contpool/ctrover/{over,work} chown 10000000:10000000 /vol/contpool/ctrover/{over,work} The user now creates an idmapped mount for the rootfs: mount-idmapped/mount-idmapped --map-mount=b:0:10000000:65536 \ /var/lib/lxc/c2/rootfs \ /vol/contpool/lowermap This for example makes it so that /var/lib/lxc/c2/rootfs/home/ubuntu/.bashrc which is owned by uid and gid 1000 as being owned by uid and gid 10001000 at /vol/contpool/lowermap/home/ubuntu/.bashrc. Assume the user wants to expose these idmapped mounts through an overlayfs mount to a container. mount -t overlay overlay \ -o lowerdir=/vol/contpool/lowermap, \ upperdir=/vol/contpool/overmap/over, \ workdir=/vol/contpool/overmap/work \ /vol/contpool/merge The user can do this in two ways: (1) Mount overlayfs in the initial user namespace and expose it to the container. (2) Mount overlayfs on top of the idmapped mounts inside of the container's user namespace. Let's assume the user chooses the (1) option and mounts overlayfs on the host and then changes into a container which uses the idmapping 0:10000000:65536 which is the same used for the two idmapped mounts. Now the user tries to retrieve the POSIX ACLs using the getfacl command getfacl -n /vol/contpool/lowermap/home/ubuntu/.bashrc and to their surprise they see: # file: vol/contpool/merge/home/ubuntu/.bashrc # owner: 1000 # group: 1000 user::rw- user:4294967295:rwx group::r-- mask::rwx other::r-- indicating the uid wasn't correctly translated according to the idmapped mount. The problem is how we currently translate POSIX ACLs. Let's inspect the callchain in this example: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:0:4k /* initial idmapping */ sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() |> vfs_getxattr() | -> __vfs_getxattr() | -> handler->get == ovl_posix_acl_xattr_get() | -> ovl_xattr_get() | -> vfs_getxattr() | -> __vfs_getxattr() | -> handler->get() /* lower filesystem callback */ |> posix_acl_fix_xattr_to_user() { 4 = make_kuid(&init_user_ns, 4); 4 = mapped_kuid_fs(&init_user_ns /* no idmapped mount */, 4); /* FAILURE */ -1 = from_kuid(0:10000000:65536 /* caller's idmapping */, 4); } If the user chooses to use option (2) and mounts overlayfs on top of idmapped mounts inside the container things don't look that much better: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:10000000:65536 sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() |> vfs_getxattr() | -> __vfs_getxattr() | -> handler->get == ovl_posix_acl_xattr_get() | -> ovl_xattr_get() | -> vfs_getxattr() | -> __vfs_getxattr() | -> handler->get() /* lower filesystem callback */ |> posix_acl_fix_xattr_to_user() { 4 = make_kuid(&init_user_ns, 4); 4 = mapped_kuid_fs(&init_user_ns, 4); /* FAILURE */ -1 = from_kuid(0:10000000:65536 /* caller's idmapping */, 4); } As is easily seen the problem arises because the idmapping of the lower mount isn't taken into account as all of this happens in do_gexattr(). But do_getxattr() is always called on an overlayfs mount and inode and thus cannot possible take the idmapping of the lower layers into account. This problem is similar for fscaps but there the translation happens as part of vfs_getxattr() already. Let's walk through an fscaps overlayfs callchain: setcap 'cap_net_raw+ep' /var/lib/lxc/c2/rootfs/home/ubuntu/.bashrc The expected outcome here is that we'll receive the cap_net_raw capability as we are able to map the uid associated with the fscap to 0 within our container. IOW, we want to see 0 as the result of the idmapping translations. If the user chooses option (1) we get the following callchain for fscaps: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:0:4k /* initial idmapping */ sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() -> vfs_getxattr() -> xattr_getsecurity() -> security_inode_getsecurity() ________________________________ -> cap_inode_getsecurity() | | { V | 10000000 = make_kuid(0:0:4k /* overlayfs idmapping */, 10000000); | 10000000 = mapped_kuid_fs(0:0:4k /* no idmapped mount */, 10000000); | /* Expected result is 0 and thus that we own the fscap. */ | 0 = from_kuid(0:10000000:65536 /* caller's idmapping */, 10000000); | } | -> vfs_getxattr_alloc() | -> handler->get == ovl_other_xattr_get() | -> vfs_getxattr() | -> xattr_getsecurity() | -> security_inode_getsecurity() | -> cap_inode_getsecurity() | { | 0 = make_kuid(0:0:4k /* lower s_user_ns */, 0); | 10000000 = mapped_kuid_fs(0:10000000:65536 /* idmapped mount */, 0); | 10000000 = from_kuid(0:0:4k /* overlayfs idmapping */, 10000000); | |____________________________________________________________________| } -> vfs_getxattr_alloc() -> handler->get == /* lower filesystem callback */ And if the user chooses option (2) we get: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:10000000:65536 sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() -> vfs_getxattr() -> xattr_getsecurity() -> security_inode_getsecurity() _______________________________ -> cap_inode_getsecurity() | | { V | 10000000 = make_kuid(0:10000000:65536 /* overlayfs idmapping */, 0); | 10000000 = mapped_kuid_fs(0:0:4k /* no idmapped mount */, 10000000); | /* Expected result is 0 and thus that we own the fscap. */ | 0 = from_kuid(0:10000000:65536 /* caller's idmapping */, 10000000); | } | -> vfs_getxattr_alloc() | -> handler->get == ovl_other_xattr_get() | |-> vfs_getxattr() | -> xattr_getsecurity() | -> security_inode_getsecurity() | -> cap_inode_getsecurity() | { | 0 = make_kuid(0:0:4k /* lower s_user_ns */, 0); | 10000000 = mapped_kuid_fs(0:10000000:65536 /* idmapped mount */, 0); | 0 = from_kuid(0:10000000:65536 /* overlayfs idmapping */, 10000000); | |____________________________________________________________________| } -> vfs_getxattr_alloc() -> handler->get == /* lower filesystem callback */ We can see how the translation happens correctly in those cases as the conversion happens within the vfs_getxattr() helper. For POSIX ACLs we need to do something similar. However, in contrast to fscaps we cannot apply the fix directly to the kernel internal posix acl data structure as this would alter the cached values and would also require a rework of how we currently deal with POSIX ACLs in general which almost never take the filesystem idmapping into account (the noteable exception being FUSE but even there the implementation is special) and instead retrieve the raw values based on the initial idmapping. The correct values are then generated right before returning to userspace. The fix for this is to move taking the mount's idmapping into account directly in vfs_getxattr() instead of having it be part of posix_acl_fix_xattr_to_user(). To this end we simply move the idmapped mount translation into a separate step performed in vfs_{g,s}etxattr() instead of in posix_acl_fix_xattr_{from,to}_user(). To see how this fixes things let's go back to the original example. Assume the user chose option (1) and mounted overlayfs on top of idmapped mounts on the host: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:0:4k /* initial idmapping */ sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() |> vfs_getxattr() | |> __vfs_getxattr() | | -> handler->get == ovl_posix_acl_xattr_get() | | -> ovl_xattr_get() | | -> vfs_getxattr() | | |> __vfs_getxattr() | | | -> handler->get() /* lower filesystem callback */ | | |> posix_acl_getxattr_idmapped_mnt() | | { | | 4 = make_kuid(&init_user_ns, 4); | | 10000004 = mapped_kuid_fs(0:10000000:65536 /* lower idmapped mount */, 4); | | 10000004 = from_kuid(&init_user_ns, 10000004); | | |_______________________ | | } | | | | | |> posix_acl_getxattr_idmapped_mnt() | | { | | V | 10000004 = make_kuid(&init_user_ns, 10000004); | 10000004 = mapped_kuid_fs(&init_user_ns /* no idmapped mount */, 10000004); | 10000004 = from_kuid(&init_user_ns, 10000004); | } |_________________________________________________ | | | | |> posix_acl_fix_xattr_to_user() | { V 10000004 = make_kuid(0:0:4k /* init_user_ns */, 10000004); /* SUCCESS */ 4 = from_kuid(0:10000000:65536 /* caller's idmapping */, 10000004); } And similarly if the user chooses option (1) and mounted overayfs on top of idmapped mounts inside the container: idmapped mount /vol/contpool/merge: 0:10000000:65536 caller's idmapping: 0:10000000:65536 overlayfs idmapping (ofs->creator_cred): 0:10000000:65536 sys_getxattr() -> path_getxattr() -> getxattr() -> do_getxattr() |> vfs_getxattr() | |> __vfs_getxattr() | | -> handler->get == ovl_posix_acl_xattr_get() | | -> ovl_xattr_get() | | -> vfs_getxattr() | | |> __vfs_getxattr() | | | -> handler->get() /* lower filesystem callback */ | | |> posix_acl_getxattr_idmapped_mnt() | | { | | 4 = make_kuid(&init_user_ns, 4); | | 10000004 = mapped_kuid_fs(0:10000000:65536 /* lower idmapped mount */, 4); | | 10000004 = from_kuid(&init_user_ns, 10000004); | | |_______________________ | | } | | | | | |> posix_acl_getxattr_idmapped_mnt() | | { V | 10000004 = make_kuid(&init_user_ns, 10000004); | 10000004 = mapped_kuid_fs(&init_user_ns /* no idmapped mount */, 10000004); | 10000004 = from_kuid(0(&init_user_ns, 10000004); | |_________________________________________________ | } | | | |> posix_acl_fix_xattr_to_user() | { V 10000004 = make_kuid(0:0:4k /* init_user_ns */, 10000004); /* SUCCESS */ 4 = from_kuid(0:10000000:65536 /* caller's idmappings */, 10000004); } The last remaining problem we need to fix here is ovl_get_acl(). During ovl_permission() overlayfs will call: ovl_permission() -> generic_permission() -> acl_permission_check() -> check_acl() -> get_acl() -> inode->i_op->get_acl() == ovl_get_acl() > get_acl() /* on the underlying filesystem) ->inode->i_op->get_acl() == /*lower filesystem callback */ -> posix_acl_permission() passing through the get_acl request to the underlying filesystem. This will retrieve the acls stored in the lower filesystem without taking the idmapping of the underlying mount into account as this would mean altering the cached values for the lower filesystem. The simple solution is to have ovl_get_acl() simply duplicate the ACLs, update the values according to the idmapped mount and return it to acl_permission_check() so it can be used in posix_acl_permission(). Since overlayfs doesn't cache ACLs they'll be released right after. Link: https://github.com/brauner/mount-idmapped/issues/9 Cc: Seth Forshee Cc: Amir Goldstein Cc: Vivek Goyal Cc: Christoph Hellwig Cc: Aleksa Sarai Cc: linux-unionfs@vger.kernel.org Signed-off-by: Christian Brauner (Microsoft) Fixes: bc70682a497c ("ovl: support idmapped layers") Signed-off-by: Miklos Szeredi commit a501ab75e7624d133a5a3c7ec010687c8b961d23 Author: Jiri Slaby Date: Thu Jul 7 10:25:58 2022 +0200 tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() There is a race in pty_write(). pty_write() can be called in parallel with e.g. ioctl(TIOCSTI) or ioctl(TCXONC) which also inserts chars to the buffer. Provided, tty_flip_buffer_push() in pty_write() is called outside the lock, it can commit inconsistent tail. This can lead to out of bounds writes and other issues. See the Link below. To fix this, we have to introduce a new helper called tty_insert_flip_string_and_push_buffer(). It does both tty_insert_flip_string() and tty_flip_buffer_commit() under the port lock. It also calls queue_work(), but outside the lock. See 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty_write) for the reasons. Keep the helper internal-only (in drivers' tty.h). It is not intended to be used widely. Link: https://seclists.org/oss-sec/2022/q2/155 Fixes: 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty_write) Cc: 一只狗 Cc: Dan Carpenter Suggested-by: Hillf Danton Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220707082558.9250-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 716b10580283fda66f2b88140e3964f8a7f9da89 Author: Jiri Slaby Date: Thu Jul 7 10:25:57 2022 +0200 tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() We will need this new helper in the next patch. Cc: Hillf Danton Cc: 一只狗 Cc: Dan Carpenter Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220707082558.9250-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit bb160ee61c04fe96f3cc0088ef1907214861dccc Author: Darren Stevens Date: Sat Jul 2 22:03:55 2022 +0100 drivers/usb/host/ehci-fsl: Fix interrupt setup in host mode. In patch a1a2b7125e10 (Drop static setup of IRQ resource from DT core) we stopped platform_get_resource() from returning the IRQ, as all drivers were supposed to have switched to platform_get_irq() Unfortunately the Freescale EHCI driver in host mode got missed. Fix it. Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") Reported-by: Christian Zigotzky Suggested-by: Rob Herring Tested-by: Christian Zigotzky Acked-by: Rob Herring Acked-by: Alan Stern Signed-off-by: Darren Stevens Link: https://lore.kernel.org/r/20220702220355.63b36fb8@Cyrus.lan Signed-off-by: Greg Kroah-Hartman commit 3d0dc539029b09fbd125444c16b11a8ed10b9d0f Author: Michael Grzeschik Date: Thu Jul 7 13:56:12 2022 +0200 usb: gadget: uvc: fix changing interface name via configfs When setting the function name, it is always truncated by one char since snprintf is always including the null-termination in the len parameter. We use strscpy and fix the size setting to use len + 1 instead. Fixes: 324e4f85070f ("usb: gadget: uvc: allow changing interface name via configfs") Signed-off-by: Michael Grzeschik Link: https://lore.kernel.org/r/20220707115612.2760569-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 6fb9e1d94789e8ee5a258a23bc588693f743fd6c Author: Linyu Yuan Date: Fri Jul 1 16:08:54 2022 +0800 usb: typec: add missing uevent when partner support PD System like Android allow user control power role from UI, it is possible to implement application base on typec uevent to refresh UI, but found there is chance that UI show different state from typec attribute file. In typec_set_pwr_opmode(), when partner support PD, there is no uevent send to user space which cause the problem. Fix it by sending uevent notification when change power mode to PD. Fixes: bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers") Cc: stable@vger.kernel.org Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1656662934-10226-1-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 925b6e59138cefa47275c67891c65d48d3266d57 Author: Arunpravin Paneer Selvam Date: Fri Jul 8 02:30:47 2022 -0700 Revert "drm/amdgpu: add drm buddy support to amdgpu" This reverts commit c9cad937c0c58618fe5b0310fd539a854dc1ae95. This is part of a revert of the following commits: commit 708d19d9f362 ("drm/amdgpu: move internal vram_mgr function into the C file") commit 5e3f1e7729ec ("drm/amdgpu: fix start calculation in amdgpu_vram_mgr_new") commit c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu") [WHY] Few users reported garbaged graphics as soon as x starts, reverting until this can be resolved. Signed-off-by: Arunpravin Paneer Selvam Link: https://patchwork.freedesktop.org/patch/msgid/20220708093047.492662-3-Arunpravin.PaneerSelvam@amd.com Reviewed-by: Christian König Signed-off-by: Christian König commit 32b3ad1418ea53184ab7d652f13b5d66414d1bba Merge: 820b8963adaea 73318c4b7dbd0 Author: David S. Miller Date: Fri Jul 8 12:10:34 2022 +0100 Merge branch 'sysctl-data-races' Kuniyuki Iwashima says: ==================== sysctl: Fix data-races around ipv4_table. A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. The first half of this series changes some proc handlers used in ipv4_table to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. Then, the second half adds READ_ONCE() to the other readers of ipv4_table. Changes: v2: * Drop some changes that makes backporting difficult * First cleanup patch * Lockless helpers and .proc_handler changes * Drop the tracing part for .sysctl_mem * Steve already posted a fix * Drop int-to-bool change for cipso * Should be posted to net-next later * Drop proc_dobool() change * Can be included in another series v1: https://lore.kernel.org/netdev/20220706052130.16368-1-kuniyu@amazon.com/ ==================== Signed-off-by: David S. Miller commit 73318c4b7dbd0e781aaababff17376b2894745c0 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:40:03 2022 -0700 ipv4: Fix a data-race around sysctl_fib_sync_mem. While reading sysctl_fib_sync_mem, it can be changed concurrently. So, we need to add READ_ONCE() to avoid a data-race. Fixes: 9ab948a91b2c ("ipv4: Allow amount of dirty memory from fib resizing to be controllable") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 48d7ee321ea5182c6a70782aa186422a70e67e22 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:40:02 2022 -0700 icmp: Fix data-races around sysctl. While reading icmp sysctl variables, they can be changed concurrently. So, we need to add READ_ONCE() to avoid data-races. Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit dd44f04b9214adb68ef5684ae87a81ba03632250 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:40:01 2022 -0700 cipso: Fix data-races around sysctl. While reading cipso sysctl variables, they can be changed concurrently. So, we need to add READ_ONCE() to avoid data-races. Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine") Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Signed-off-by: David S. Miller commit 310731e2f1611d1d13aae237abcf8e66d33345d5 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:40:00 2022 -0700 net: Fix data-races around sysctl_mem. While reading .sysctl_mem, it can be changed concurrently. So, we need to add READ_ONCE() to avoid data-races. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 3d32edf1f3c38d3301f6434e56316f293466d7fb Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:59 2022 -0700 inetpeer: Fix data-races around sysctl. While reading inetpeer sysctl variables, they can be changed concurrently. So, we need to add READ_ONCE() to avoid data-races. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 47e6ab24e8c6e3ca10ceb5835413f401f90de4bf Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:58 2022 -0700 tcp: Fix a data-race around sysctl_tcp_max_orphans. While reading sysctl_tcp_max_orphans, it can be changed concurrently. So, we need to add READ_ONCE() to avoid a data-race. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit e877820877663fbae8cb9582ea597a7230b94df3 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:57 2022 -0700 sysctl: Fix data races in proc_dointvec_jiffies(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dointvec_jiffies() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dointvec_jiffies() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit c31bcc8fb89fc2812663900589c6325ba35d9a65 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:56 2022 -0700 sysctl: Fix data races in proc_doulongvec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_doulongvec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_doulongvec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2d3b559df3ed39258737789aae2ae7973d205bc1 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:55 2022 -0700 sysctl: Fix data races in proc_douintvec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_douintvec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_douintvec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 61d9b56a8920 ("sysctl: add unsigned int range support") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit f613d86d014b6375a4085901de39406598121e35 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:54 2022 -0700 sysctl: Fix data races in proc_dointvec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dointvec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dointvec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4762b532ec9539755aab61445d5da6e1926ccb99 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:53 2022 -0700 sysctl: Fix data races in proc_douintvec(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_douintvec() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_douintvec() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: e7d316a02f68 ("sysctl: handle error writing UINT_MAX to u32 fields") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1f1be04b4d48a2475ea1aab46a99221bfc5c0968 Author: Kuniyuki Iwashima Date: Wed Jul 6 16:39:52 2022 -0700 sysctl: Fix data races in proc_dointvec(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dointvec() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dointvec() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 820b8963adaea34a87abbecb906d1f54c0aabfb7 Author: Steven Rostedt (Google) Date: Wed Jul 6 10:50:40 2022 -0400 net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer The trace event sock_exceed_buf_limit saves the prot->sysctl_mem pointer and then dereferences it in the TP_printk() portion. This is unsafe as the TP_printk() portion is executed at the time the buffer is read. That is, it can be seconds, minutes, days, months, even years later. If the proto is freed, then this dereference will can also lead to a kernel crash. Instead, save the sysctl_mem array into the ring buffer and have the TP_printk() reference that instead. This is the proper and safe way to read pointers in trace events. Link: https://lore.kernel.org/all/20220706052130.16368-12-kuniyu@amazon.com/ Cc: stable@vger.kernel.org Fixes: 3847ce32aea9f ("core: add tracepoints for queueing skb to rcvbuf") Signed-off-by: Steven Rostedt (Google) Acked-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2259da159fbe5dba8ac00b560cf00b6a6537fa18 Author: Thadeu Lima de Souza Cascardo Date: Thu Jul 7 13:41:52 2022 -0300 x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported There are some VM configurations which have Skylake model but do not support IBPB. In those cases, when using retbleed=ibpb, userspace is going to be killed and kernel is going to panic. If the CPU does not support IBPB, warn and proceed with the auto option. Also, do not fallback to IBPB on AMD/Hygon systems if it is not supported. Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb") Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Borislav Petkov commit f8d3da4ef8faf027261e06b7864583930dd7c7b9 Author: Joanne Koong Date: Wed Jul 6 16:25:47 2022 -0700 bpf: Add flags arg to bpf_dynptr_read and bpf_dynptr_write APIs Commit 13bbbfbea759 ("bpf: Add bpf_dynptr_read and bpf_dynptr_write") added the bpf_dynptr_write() and bpf_dynptr_read() APIs. However, it will be needed for some dynptr types to pass in flags as well (e.g. when writing to a skb, the user may like to invalidate the hash or recompute the checksum). This patch adds a "u64 flags" arg to the bpf_dynptr_read() and bpf_dynptr_write() APIs before their UAPI signature freezes where we then cannot change them anymore with a 5.19.x released kernel. Fixes: 13bbbfbea759 ("bpf: Add bpf_dynptr_read and bpf_dynptr_write") Signed-off-by: Joanne Koong Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20220706232547.4016651-1-joannelkoong@gmail.com commit e5ce073c8a1e01b215a5eb32ba48f8d17ded3bd5 Author: Marc Kleine-Budde Date: Mon Jun 6 13:43:53 2022 +0200 tee: tee_get_drvdata(): fix description of return value This patch fixes the description of tee_get_drvdata()'s return value. It actually returns the driver_data pointer supplied to tee_device_alloc() since the TEE subsystem was added to the kernel. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Cc: Jens Wiklander Signed-off-by: Marc Kleine-Budde Signed-off-by: Jens Wiklander commit b66527ee98d0e12fbf570d394fbea2be4ef1229e Author: Jiang Jian Date: Wed Jun 22 00:16:48 2022 +0800 optee: Remove duplicate 'of' in two places. file: ./drivers/tee/optee/optee_smc.h line: 192 * a2 Size of of SHM chanegd to * a2 Size of SHM Signed-off-by: Jiang Jian Signed-off-by: Jens Wiklander commit 86c43ea071ae9988b52fd0f654de439da4b5c20a Author: Michael Walle Date: Mon Jul 4 17:08:08 2022 +0200 ARM: dts: kswitch-d10: use open drain mode for coma-mode pins The driver use the coma-mode pins as open-drain. Flag them in the device tree accordingly. This avoids the following error: [ 14.114180] gpio-2007 (coma-mode): enforced open drain please flag it properly in DT/ACPI DSDT/board file Fixes: 46a9556d977e ("ARM: dts: kswitch-d10: enable networking") Signed-off-by: Michael Walle Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220704150808.1104295-1-michael@walle.cc commit 6177a50fd32c6fd956c7265bc5297e725d221bfc Author: Max Krummenacher Date: Tue Jul 5 10:58:24 2022 +0200 ARM: dts: colibri-imx6ull: fix snvs pinmux group A pin controlled by the iomuxc-snvs pin controller must be specified under the dtb's iomuxc-snvs node. Move the one and only pin of that category from the iomuxc node and set the pinctrl-0 using it accordingly. Fixes: 2aa9d6201949 ("ARM: dts: imx6ull-colibri: add touchscreen device nodes") Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit d4fac258d971bead9a6b5c5ebe2f0e415d05d110 Author: Yang Yingliang Date: Tue Jun 28 14:52:16 2022 +0800 optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR() In optee_smc_do_call_with_arg() there is a code path when the argument struct for RPC is passed appended to the primary argument struct. When the address of the RPC struct is retrieved there's an invalid check for success. It should be 'rpc_arg' pass to IS_ERR/PTR_ERR(). Fixes: ed8faf6c8f8c ("optee: add OPTEE_SMC_CALL_WITH_RPC_ARG and OPTEE_SMC_CALL_WITH_REGD_ARG") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang [jw: added background to the problem] Signed-off-by: Jens Wiklander commit c51b8f85c4157eb91c2f4ab34b0c52fea642e77c Author: Joerg Roedel Date: Wed Jul 6 12:33:31 2022 +0200 MAINTAINERS: Remove iommu@lists.linux-foundation.org The IOMMU mailing list has moved to iommu@lists.linux.dev and the old list should bounce by now. Remove it from the MAINTAINERS file. Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel Link: https://lore.kernel.org/r/20220706103331.10215-1-joro@8bytes.org commit a902fa8eccaf9ace2886e02aaf75d550996d077b Merge: 2058dc831ff82 a57f68ddc8865 Author: Arnd Bergmann Date: Fri Jul 8 09:10:26 2022 +0200 Merge tag 'reset-fixes-for-v5.19' of git://git.pengutronix.de/pza/linux into arm/fixes Reset controller fixes for v5.19 Fix the MAINTAINERS entry for the Synopsys AXS10x reset controller driver, which still points to a nonexistent .txt file after the device tree binding .yaml conversion. Also, fix the devm_reset_control_bulk_get_optional_exclusive() call, which was defective since its introduction due to a copy & paste error. * tag 'reset-fixes-for-v5.19' of git://git.pengutronix.de/pza/linux: reset: Fix devm bulk optional exclusive control getter MAINTAINERS: rectify entry for SYNOPSYS AXS10x RESET CONTROLLER DRIVER Link: https://lore.kernel.org/r/20220707101344.3329314-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 2058dc831ff82eb8e93e882efd1ca964bd8a74c8 Author: Conor Dooley Date: Thu Jul 7 15:20:42 2022 +0100 MAINTAINERS: add polarfire rng, pci and clock drivers Hardware random, PCI and clock drivers for the PolarFire SoC have been upstreamed but are not covered by the MAINTAINERS entry, so add them. Daire is the author of the clock & PCI drivers, so add him as a maintainer in place of Lewis. Signed-off-by: Conor Dooley Acked-by: Bjorn Helgaas Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20220707142041.4096246-1-conor.dooley@microchip.com' Signed-off-by: Arnd Bergmann commit dc5cb7a833e83a0d51373ba7d96e2ed8e1890944 Author: Heiko Stuebner Date: Wed Jun 8 14:08:49 2022 +0200 riscv: don't warn for sifive erratas in modules The SiFive errata code contains code checking applicable erratas vs. actually applied erratas to suggest missing erratas to the user when their Kconfig options are not enabled. In the main kernel image one can be quite sure that all available erratas appear at least once, so that check will succeed. On the other hand modules can very well not use any errata-relevant code, so the newly added module-alternative support may also patch the module code, but not touch SiFive-specific erratas at all. So to restore the original behaviour don't warn when patching modules. This will keep the warning if necessary for the main kernel image but prevent spurious warnings for modules. Of course having such a vendor-specific warning may not be needed at all, as CONFIG_ERRATA_SIFIVE is selected by CONFIG_SOC_SIFIVE and the individual erratas are default-y so disabling them requires deliberate action anyway. But for now just restore the old behaviour. Fixes: a8e910168bba ("riscv: implement module alternatives") Reported-by: Ron Economos Signed-off-by: Heiko Stuebner Tested-by: Ron Economos Link: https://lore.kernel.org/r/20220608120849.1695191-1-heiko@sntech.de Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit f46fd3d7c3bd5d7bd5bb664135cf32ca9e97190b Author: Pavel Skripkin Date: Wed Jul 6 16:28:45 2022 +0300 net: ocelot: fix wrong time_after usage Accidentally noticed, that this driver is the only user of while (time_after(jiffies...)). It looks like typo, because likely this while loop will finish after 1st iteration, because time_after() returns true when 1st argument _is after_ 2nd one. There is one possible problem with this poll loop: the scheduler could put the thread to sleep, and it does not get woken up for OCELOT_FDMA_CH_SAFE_TIMEOUT_US. During that time, the hardware has done its thing, but you exit the while loop and return -ETIMEDOUT. Fix it by using sane poll API that avoids all problems described above Fixes: 753a026cfec1 ("net: ocelot: add FDMA support") Suggested-by: Andrew Lunn Signed-off-by: Pavel Skripkin Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220706132845.27968-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski commit fe5235aef8558573c1d225199be3aaa7bcd22943 Merge: 0680e20af5fbf 5b759bf2f9d73 Author: Jakub Kicinski Date: Thu Jul 7 17:44:45 2022 -0700 Merge tag 'mlx5-fixes-2022-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2022-07-06 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2022-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Ring the TX doorbell on DMA errors net/mlx5e: Fix capability check for updating vnic env counters net/mlx5e: CT: Use own workqueue instead of mlx5e priv net/mlx5: Lag, correct get the port select mode str net/mlx5e: Fix enabling sriov while tc nic rules are offloaded net/mlx5e: kTLS, Fix build time constant test in RX net/mlx5e: kTLS, Fix build time constant test in TX net/mlx5: Lag, decouple FDB selection and shared FDB net/mlx5: TC, allow offload from uplink to other PF's VF ==================== Link: https://lore.kernel.org/r/20220706231309.38579-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 0680e20af5fbf41df8a11b11bd9a7c25b2ca0746 Author: Siddharth Vadapalli Date: Wed Jul 6 12:32:08 2022 +0530 net: ethernet: ti: am65-cpsw: Fix devlink port register sequence Renaming interfaces using udevd depends on the interface being registered before its netdev is registered. Otherwise, udevd reads an empty phys_port_name value, resulting in the interface not being renamed. Fix this by registering the interface before registering its netdev by invoking am65_cpsw_nuss_register_devlink() before invoking register_netdev() for the interface. Move the function call to devlink_port_type_eth_set(), invoking it after register_netdev() is invoked, to ensure that netlink notification for the port state change is generated after the netdev is completely initialized. Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support") Signed-off-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20220706070208.12207-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski commit 029c1c2059e9c4b38f97a06204cdecd10cfbeb8a Author: Jon Hunter Date: Wed Jul 6 09:39:13 2022 +0100 net: stmmac: dwc-qos: Disable split header for Tegra194 There is a long-standing issue with the Synopsys DWC Ethernet driver for Tegra194 where random system crashes have been observed [0]. The problem occurs when the split header feature is enabled in the stmmac driver. In the bad case, a larger than expected buffer length is received and causes the calculation of the total buffer length to overflow. This results in a very large buffer length that causes the kernel to crash. Why this larger buffer length is received is not clear, however, the feedback from the NVIDIA design team is that the split header feature is not supported for Tegra194. Therefore, disable split header support for Tegra194 to prevent these random crashes from occurring. [0] https://lore.kernel.org/linux-tegra/b0b17697-f23e-8fa5-3757-604a86f3a095@nvidia.com/ Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores") Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20220706083913.13750-1-jonathanh@nvidia.com Signed-off-by: Jakub Kicinski commit 6b0de7d0f3285df849be2b3cc94fc3a0a31987bf Merge: f3163d8567adb 5c629dc9609dc Author: Jens Axboe Date: Thu Jul 7 17:38:19 2022 -0600 Merge tag 'nvme-5.19-2022-07-07' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - another bogus identifier quirk (Keith Busch) - use struct group in the tracer to avoid a gcc warning (Keith Busch)" * tag 'nvme-5.19-2022-07-07' of git://git.infradead.org/nvme: nvme: use struct group for generic command dwords nvme-pci: phison e16 has bogus namespace ids commit bdb2c48e4b38e6dbe82533b437468999ba3ae498 Author: Pavel Begunkov Date: Thu Jul 7 15:00:38 2022 +0100 io_uring: explicit sqe padding for ioctl commands 32 bit sqe->cmd_op is an union with 64 bit values. It's always a good idea to do padding explicitly. Also zero check it in prep, so it can be used in the future if needed without compatibility concerns. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e6b95a05e970af79000435166185e85b196b2ba2.1657202417.git.asml.silence@gmail.com [axboe: turn bitwise OR into logical variant] Signed-off-by: Jens Axboe commit 3501f0c663063513ad604fb1b3f06af637d3396d Author: Satish Nagireddy Date: Tue Jun 28 12:12:16 2022 -0700 i2c: cadence: Unregister the clk notifier in error path This patch ensures that the clock notifier is unregistered when driver probe is returning error. Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") Signed-off-by: Satish Nagireddy Tested-by: Lars-Peter Clausen Reviewed-by: Michal Simek Signed-off-by: Wolfram Sang commit ccd3f449052449a917a3e577d8ba0368f43b8f29 Author: Mike Christie Date: Mon Jun 27 21:23:25 2022 -0500 scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer. Link: https://lore.kernel.org/r/20220628022325.14627-2-michael.christie@oracle.com Reviewed-by: Christoph Hellwig Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen commit ba7c3507087aaf98bbeab04a62251bf63c6348c1 Merge: 88084a3df1672 c8934e4e34891 Author: Rafael J. Wysocki Date: Thu Jul 7 21:46:05 2022 +0200 Merge tag 'devfreq-fixes-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull a devfreq fix for 5.19-rc6 from Chanwoo Choi: "- Fix exynos-bus NULL pointer dereference by correctly using the local generated freq_table to output the debug values instead of using the profile freq_table that is not used in the driver." * tag 'devfreq-fixes-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: exynos-bus: Fix NULL pointer dereference commit c8934e4e348915caac54085c01fd9d04fa16134a Author: Christian Marangi Date: Fri Jul 1 15:31:26 2022 +0200 PM / devfreq: exynos-bus: Fix NULL pointer dereference Fix exynos-bus NULL pointer dereference by correctly using the local generated freq_table to output the debug values instead of using the profile freq_table that is not used in the driver. Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Fixes: b5d281f6c16d ("PM / devfreq: Rework freq_table to be local to devfreq struct") Cc: stable@vger.kernel.org Signed-off-by: Christian Marangi Acked-by: Chanwoo Choi Signed-off-by: Chanwoo Choi commit 0ed8f619b412b52360ccdfaf997223ccd9319569 Author: Florian Westphal Date: Wed Jul 6 16:50:04 2022 +0200 netfilter: conntrack: fix crash due to confirmed bit load reordering Kajetan Puchalski reports crash on ARM, with backtrace of: __nf_ct_delete_from_lists nf_ct_delete early_drop __nf_conntrack_alloc Unlike atomic_inc_not_zero, refcount_inc_not_zero is not a full barrier. conntrack uses SLAB_TYPESAFE_BY_RCU, i.e. it is possible that a 'newly' allocated object is still in use on another CPU: CPU1 CPU2 encounter 'ct' during hlist walk delete_from_lists refcount drops to 0 kmem_cache_free(ct); __nf_conntrack_alloc() // returns same object refcount_inc_not_zero(ct); /* might fail */ /* If set, ct is public/in the hash table */ test_bit(IPS_CONFIRMED_BIT, &ct->status); In case CPU1 already set refcount back to 1, refcount_inc_not_zero() will succeed. The expected possibilities for a CPU that obtained the object 'ct' (but no reference so far) are: 1. refcount_inc_not_zero() fails. CPU2 ignores the object and moves to the next entry in the list. This happens for objects that are about to be free'd, that have been free'd, or that have been reallocated by __nf_conntrack_alloc(), but where the refcount has not been increased back to 1 yet. 2. refcount_inc_not_zero() succeeds. CPU2 checks the CONFIRMED bit in ct->status. If set, the object is public/in the table. If not, the object must be skipped; CPU2 calls nf_ct_put() to un-do the refcount increment and moves to the next object. Parallel deletion from the hlists is prevented by a 'test_and_set_bit(IPS_DYING_BIT, &ct->status);' check, i.e. only one cpu will do the unlink, the other one will only drop its reference count. Because refcount_inc_not_zero is not a full barrier, CPU2 may try to delete an object that is not on any list: 1. refcount_inc_not_zero() successful (refcount inited to 1 on other CPU) 2. CONFIRMED test also successful (load was reordered or zeroing of ct->status not yet visible) 3. delete_from_lists unlinks entry not on the hlist, because IPS_DYING_BIT is 0 (already cleared). 2) is already wrong: CPU2 will handle a partially initited object that is supposed to be private to CPU1. Add needed barriers when refcount_inc_not_zero() is successful. It also inserts a smp_wmb() before the refcount is set to 1 during allocation. Because other CPU might still see the object, refcount_set(1) "resurrects" it, so we need to make sure that other CPUs will also observe the right content. In particular, the CONFIRMED bit test must only pass once the object is fully initialised and either in the hash or about to be inserted (with locks held to delay possible unlink from early_drop or gc worker). I did not change flow_offload_alloc(), as far as I can see it should call refcount_inc(), not refcount_inc_not_zero(): the ct object is attached to the skb so its refcount should be >= 1 in all cases. v2: prefer smp_acquire__after_ctrl_dep to smp_rmb (Will Deacon). v3: keep smp_acquire__after_ctrl_dep close to refcount_inc_not_zero call add comment in nf_conntrack_netlink, no control dependency there due to locks. Cc: Peter Zijlstra Link: https://lore.kernel.org/all/Yr7WTfd6AVTQkLjI@e126311.manchester.arm.com/ Reported-by: Kajetan Puchalski Diagnosed-by: Will Deacon Fixes: 719774377622 ("netfilter: conntrack: convert to refcount_t api") Signed-off-by: Florian Westphal Acked-by: Will Deacon commit 0326195f523a549e0a9d7fd44c70b26fd7265090 Author: Eric Dumazet Date: Thu Jul 7 12:39:00 2022 +0000 bpf: Make sure mac_header was set before using it Classic BPF has a way to load bytes starting from the mac header. Some skbs do not have a mac header, and skb_mac_header() in this case is returning a pointer that 65535 bytes after skb->head. Existing range check in bpf_internal_load_pointer_neg_helper() was properly kicking and no illegal access was happening. New sanity check in skb_mac_header() is firing, so we need to avoid it. WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 skb_mac_header include/linux/skbuff.h:2785 [inline] WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.c:74 Modules linked in: CPU: 1 PID: 28990 Comm: syz-executor.0 Not tainted 5.19.0-rc4-syzkaller-00865-g4874fb9484be #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:skb_mac_header include/linux/skbuff.h:2785 [inline] RIP: 0010:bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.c:74 Code: ff ff 45 31 f6 e9 5a ff ff ff e8 aa 27 40 00 e9 3b ff ff ff e8 90 27 40 00 e9 df fe ff ff e8 86 27 40 00 eb 9e e8 2f 2c f3 ff <0f> 0b eb b1 e8 96 27 40 00 e9 79 fe ff ff 90 41 57 41 56 41 55 41 RSP: 0018:ffffc9000309f668 EFLAGS: 00010216 RAX: 0000000000000118 RBX: ffffffffffeff00c RCX: ffffc9000e417000 RDX: 0000000000040000 RSI: ffffffff81873f21 RDI: 0000000000000003 RBP: ffff8880842878c0 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000001 R12: 0000000000000004 R13: ffff88803ac56c00 R14: 000000000000ffff R15: dffffc0000000000 FS: 00007f5c88a16700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdaa9f6c058 CR3: 000000003a82c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ____bpf_skb_load_helper_32 net/core/filter.c:276 [inline] bpf_skb_load_helper_32+0x191/0x220 net/core/filter.c:264 Fixes: f9aefd6b2aa3 ("net: warn if mac header was not set") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220707123900.945305-1-edumazet@google.com commit e8a4e1c1bb697b1d9fc48f0e56dc0f50bc024bee Merge: ef4ab3ba4e4f9 f0fbe652e8529 Author: Linus Torvalds Date: Thu Jul 7 10:41:27 2022 -0700 Merge tag 'loongarch-fixes-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "A fix for tinyconfig build error, a fix for section mismatch warning, and two cleanups of obsolete code" * tag 'loongarch-fixes-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Fix section mismatch warning LoongArch: Fix build errors for tinyconfig LoongArch: Remove obsolete mentions of vcsr LoongArch: Drop these obsolete selects in Kconfig commit ef4ab3ba4e4f99b1f3af3a7b74815f59394d822e Merge: 651a8536572ae 07266d066301b Author: Linus Torvalds Date: Thu Jul 7 10:08:20 2022 -0700 Merge tag 'net-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bpf, netfilter, can, and bluetooth. Current release - regressions: - bluetooth: fix deadlock on hci_power_on_sync Previous releases - regressions: - sched: act_police: allow 'continue' action offload - eth: usbnet: fix memory leak in error case - eth: ibmvnic: properly dispose of all skbs during a failover Previous releases - always broken: - bpf: - fix insufficient bounds propagation from adjust_scalar_min_max_vals - clear page contiguity bit when unmapping pool - netfilter: nft_set_pipapo: release elements in clone from abort path - mptcp: netlink: issue MP_PRIO signals from userspace PMs - can: - rcar_canfd: fix data transmission failed on R-Car V3U - gs_usb: gs_usb_open/close(): fix memory leak Misc: - add Wenjia as SMC maintainer" * tag 'net-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (57 commits) wireguard: Kconfig: select CRYPTO_CHACHA_S390 crypto: s390 - do not depend on CRYPTO_HW for SIMD implementations wireguard: selftests: use microvm on x86 wireguard: selftests: always call kernel makefile wireguard: selftests: use virt machine on m68k wireguard: selftests: set fake real time in init r8169: fix accessing unset transport header net: rose: fix UAF bug caused by rose_t0timer_expiry usbnet: fix memory leak in error case Revert "tls: rx: move counting TlsDecryptErrors for sync" mptcp: update MIB_RMSUBFLOW in cmd_sf_destroy mptcp: fix local endpoint accounting selftests: mptcp: userspace PM support for MP_PRIO signals mptcp: netlink: issue MP_PRIO signals from userspace PMs mptcp: Acquire the subflow socket lock before modifying MP_PRIO flags mptcp: Avoid acquiring PM lock for subflow priority changes mptcp: fix locking in mptcp_nl_cmd_sf_destroy() net/mlx5e: Fix matchall police parameters validation net/sched: act_police: allow 'continue' action offload net: lan966x: hardcode the number of external ports ... commit 651a8536572ae0dcce608b3e6720ae844155a787 Merge: a382f8fee42ca a1d4ef1adf8bb Author: Linus Torvalds Date: Thu Jul 7 10:02:38 2022 -0700 Merge tag 'pinctrl-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Tag Intel pin control as supported in MAINTAINERS - Fix a NULL pointer exception in the Aspeed driver - Correct some NAND functions in the Sunxi A83T driver - Use the right offset for some Sunxi pins - Fix a zero base offset in the Freescale (NXP) i.MX93 - Fix the IRQ support in the STM32 driver * tag 'pinctrl-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: stm32: fix optional IRQ support to gpios pinctrl: imx: Add the zero base flag for imx93 pinctrl: sunxi: sunxi_pconf_set: use correct offset pinctrl: sunxi: a83t: Fix NAND function name for some pins pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() MAINTAINERS: Update Intel pin control to Supported commit a382f8fee42ca10c9bfce0d2352d4153f931f5dc Author: Linus Torvalds Date: Wed Jul 6 12:20:59 2022 -0700 signal handling: don't use BUG_ON() for debugging These are indeed "should not happen" situations, but it turns out recent changes made the 'task_is_stopped_or_trace()' case trigger (fix for that exists, is pending more testing), and the BUG_ON() makes it unnecessarily hard to actually debug for no good reason. It's been that way for a long time, but let's make it clear: BUG_ON() is not good for debugging, and should never be used in situations where you could just say "this shouldn't happen, but we can continue". Use WARN_ON_ONCE() instead to make sure it gets logged, and then just continue running. Instead of making the system basically unusuable because you crashed the machine while potentially holding some very core locks (eg this function is commonly called while holding 'tasklist_lock' for writing). Signed-off-by: Linus Torvalds commit fc976f5629afb4160ee77798b14a693eac903ffd Author: Peter Ujfalusi Date: Thu Jun 30 09:56:38 2022 +0300 ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array The struct nhlt_format's fmt_config is a flexible array, it must not be used as normal array. When moving to the next nhlt_fmt_cfg we need to take into account the data behind the ->config.caps (indicated by ->config.size). The logic of the code also changed: it is no longer saves the _last_ fmt_cfg for all found rates. Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") Signed-off-by: Peter Ujfalusi Reviewed-by: Cezary Rojewski Link: https://lore.kernel.org/r/20220630065638.11183-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 219af251bd1694bce1f627d238347d2eaf13de61 Author: Peter Ujfalusi Date: Thu Jun 30 09:56:37 2022 +0300 ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() The present flag is only set once when one rate has been found to be saved. This will effectively going to ignore any rate discovered at later time and based on the code, this is not the intention. Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") Signed-off-by: Peter Ujfalusi Reviewed-by: Cezary Rojewski Link: https://lore.kernel.org/r/20220630065638.11183-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 051dade346957d5b68ad986f497835805fa7a9dd Author: Oder Chiou Date: Tue Jul 5 18:11:33 2022 +0800 ASoC: rt5640: Fix the wrong state of JD1 and JD2 The patch fixes the wrong state of JD1 and JD2 while the bst1 or bst2 is power on in the HDA JD using. Signed-off-by: Oder Chiou Reported-by: Sameer Pujar Link: https://lore.kernel.org/r/20220705101134.16792-1-oder_chiou@realtek.com Signed-off-by: Mark Brown commit c7dab6745f4288af1e45d3809bf86a3778301616 Author: Brent Lu Date: Fri Jul 1 22:15:17 2022 +0800 ASoC: Intel: sof_rt5682: fix out-of-bounds array access Starting from ADL platform we have four HDMI PCM devices which exceeds the size of sof_hdmi array. Since each sof_hdmi_pcm structure represents one HDMI PCM device, we remove the sof_hdmi array and add a new member hdmi_jack to the sof_hdmi_pcm structure to fix the out-of-bounds problem. Signed-off-by: Brent Lu Reviewed-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20220701141517.264070-1-brent.lu@intel.com Signed-off-by: Mark Brown commit df5b4aca7248dc5a5cae93f162eae0decf972e48 Author: Jianglei Nie Date: Thu Jun 30 02:25:20 2022 +0800 ASoC: qdsp6: fix potential memory leak in q6apm_get_audioreach_graph() q6apm_get_audioreach_graph() allocates a memory chunk for graph->graph with audioreach_alloc_graph_pkt(). When idr_alloc() fails, graph->graph is not released, which will lead to a memory leak. We can release the graph->graph with kfree() when idr_alloc() fails to fix the memory leak. Signed-off-by: Jianglei Nie Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220629182520.2164409-1-niejianglei2021@163.com Signed-off-by: Mark Brown commit 1c4f29ec878bbf1cc0a1eb54ae7da5ff98e19641 Author: Hector Martin Date: Thu Jun 30 09:51:35 2022 +0200 ASoC: tas2764: Fix amp gain register offset & default The register default is 0x28 per the datasheet, and the amp gain field is supposed to be shifted left by one. With the wrong default, the ALSA controls lie about the power-up state. With the wrong shift, we get only half the gain we expect. Signed-off-by: Hector Martin Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220630075135.2221-4-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 3e99e5697e1f7120b5abc755e8a560b22612d6ed Author: Hector Martin Date: Thu Jun 30 09:51:34 2022 +0200 ASoC: tas2764: Correct playback volume range DVC value 0xc8 is -100dB and 0xc9 is mute; this needs to map to -100.5dB as far as the dB scale is concerned. Fix that and enable the mute flag, so alsamixer correctly shows the control as <0 dB .. -100 dB, mute>. Signed-off-by: Hector Martin Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220630075135.2221-3-povik+lin@cutebit.org Signed-off-by: Mark Brown commit d1a10f1b48202e2d183cce144c218a211e98d906 Author: Martin Povišer Date: Thu Jun 30 09:51:33 2022 +0200 ASoC: tas2764: Fix and extend FSYNC polarity handling Fix setting of FSYNC polarity in case of LEFT_J and DSP_A/B formats. Do NOT set the SCFG field as was previously done, because that is not correct and is also in conflict with the "ASI1 Source" control which sets the same SCFG field! Also add support for explicit polarity inversion. Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220630075135.2221-2-povik+lin@cutebit.org Signed-off-by: Mark Brown commit cd10bb89b0d57bca98eb75e0444854a1c129a14e Author: Martin Povišer Date: Thu Jun 30 09:51:32 2022 +0200 ASoC: tas2764: Add post reset delays Make sure there is at least 1 ms delay from reset to first command as is specified in the datasheet. This is a fix similar to commit 307f31452078 ("ASoC: tas2770: Insert post reset delay"). Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220630075135.2221-1-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 94c65dffd4c4af052b3ea8934fbcb2fa8da276a8 Author: Bryan O'Donoghue Date: Wed Jun 29 12:40:12 2022 +0100 ASoC: dt-bindings: Fix description for msm8916 For the existing msm8916 bindings the minimum reg/reg-names is 1 not 2. Similarly the minimum interrupt/interrupt-names is 1 not 2. Fixes: f3fc4fbfa2d2 ("ASoC: dt-bindings: Add SC7280 lpass cpu bindings") Signed-off-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220629114012.3282945-1-bryan.odonoghue@linaro.org Signed-off-by: Mark Brown commit 0735e400fa07a3687797f241f5b74d77a6d383c7 Author: Marek Vasut Date: Tue Jun 28 18:58:40 2022 +0200 ASoC: doc: Capitalize RESET line name Make sure all AC97 interface lines are spelled in capitals, to avoid confusing readers about where the 5th line is. Signed-off-by: Marek Vasut Cc: Mark Brown Cc: Takashi Iwai Link: https://lore.kernel.org/r/20220628165840.152235-1-marex@denx.de Signed-off-by: Mark Brown commit f99e930655f411453170a5f332e12c2d2748822e Author: Charles Keepax Date: Tue Jun 28 16:34:09 2022 +0100 ASoC: arizona: Update arizona_aif_cfg_changed to use RX_BCLK_RATE Currently the function arizona_aif_cfg_changed uses the TX_BCLK_RATE, however this register is not used on wm8998. This was not noticed as previously snd_soc_component_read did not print an error message. However, now the log gets filled with error messages, further more the test for if the LRCLK changed will return spurious results. Update the code to use the RX_BCLK_RATE register, the LRCLK parameters are written to both registers and the RX_BCLK_RATE register is used across all Arizona devices. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220628153409.3266932-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 870d72ab9228575b2f005c9a23ea08787e0f63e6 Author: Charles Keepax Date: Tue Jun 28 16:34:08 2022 +0100 ASoC: cs47l92: Fix event generation for OUT1 demux cs47l92_put_demux returns the value of snd_soc_dapm_mux_update_power, which returns a 1 if a path was found for the kcontrol. This is obviously different to the expected return a 1 if the control was updated value. This results in spurious notifications to user-space. Update the handling to only return a 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220628153409.3266932-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 15b2e5d10ccf32a1a1ae7c636511e2f51320fdb5 Author: Charles Keepax Date: Tue Jun 28 16:34:07 2022 +0100 ASoC: wm8998: Fix event generation for input mux wm8998_inmux_put returns the value of snd_soc_dapm_mux_update_power, which returns a 1 if a path was found for the kcontrol. This is obviously different to the expected return a 1 if the control was updated value. This results in spurious notifications to user-space. Update the handling to only return a 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220628153409.3266932-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 71b5ab96ffe6589abe7a2e302b83f7a426ebe099 Author: Charles Keepax Date: Tue Jun 28 16:34:06 2022 +0100 ASoC: wm5102: Fix event generation for output compensation The output compensation controls always returns zero regardless of if the control value was updated. This results in missing notifications to user-space of the control change. Update the handling to return 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220628153409.3266932-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit a5d6d28e2ea38dff017cb562dfbe0259d093a851 Author: Yassine Oudjana Date: Wed Jun 22 10:17:45 2022 +0400 ASoC: wcd9335: Use int array instead of bitmask for TX mixers Currently slim_tx_mixer_get reports all TX mixers as enabled when at least one is, due to it reading the entire tx_port_value bitmask without testing the specific bit corresponding to a TX port. Furthermore, using the same bitmask for all capture DAIs makes setting one mixer affect them all. To prevent this, and since the SLIM TX muxes effectively only connect to one of the mixers at a time, turn tx_port_value into an int array storing the DAI index each of the ports is connected to. Signed-off-by: Yassine Oudjana Link: https://lore.kernel.org/r/20220622061745.35399-1-y.oudjana@protonmail.com Signed-off-by: Mark Brown commit 7d90c8e6396ba245da16bedd789df6d669375408 Author: Sascha Hauer Date: Fri Jun 24 12:57:16 2022 +0200 ASoC: tlv320adcx140: Fix tx_mask check The tx_mask check doesn't reflect what the driver and the chip support. The check currently checks for exactly two slots being enabled. The tlv320adcx140 supports anything between one and eight channels, so relax the check accordingly. The tlv320adcx140 supports arbitrary tx_mask settings, but the driver currently only supports adjacent slots beginning with the first slot, so extend the check to check that the first slot is being used and that there are no holes in the tx_mask. Leave a comment to make it's the driver that limits the tx_mask settings, not the chip itself. While at it remove the set-but-unused struct adcx140p_priv::tdm_delay field. Signed-off-by: Sascha Hauer Link: https://lore.kernel.org/r/20220624105716.2579539-1-s.hauer@pengutronix.de Signed-off-by: Mark Brown commit 9e51ac6ea6041641f64fb761ccf9de271e6576cb Author: Daniel Mack Date: Fri Jun 24 12:47:10 2022 +0200 ASoC: max98396: Fix register access for PCM format settings max98396_dai_set_fmt() modifes register 2041 and touches bits in the mask 0x3a. Make sure to use the right mask for that operation. Signed-off-by: Daniel Mack Link: https://lore.kernel.org/r/20220624104712.1934484-7-daniel@zonque.org Signed-off-by: Mark Brown commit f0d96937d31c4615a6418e4bed5cee50a952040e Author: David Owens Date: Mon Jun 20 13:37:43 2022 -0500 ASoC: ti: omap-mcbsp: duplicate sysfs error Convert to managed versions of sysfs and clk allocation to simplify unbinding and error handling in probe. Managed sysfs node creation specifically addresses the following error seen the second time probe is attempted after sdma_pcm_platform_register() previously requsted probe deferral: sysfs: cannot create duplicate filename '/devices/platform/68000000.ocp/49022000.mcbsp/max_tx_thres' Signed-off-by: David Owens Link: https://lore.kernel.org/r/20220620183744.3176557-1-dowens@precisionplanting.com Signed-off-by: Mark Brown commit 242a88ff27b23cbf626f9764955d91200f12b53a Author: Sascha Hauer Date: Fri Jun 24 11:26:01 2022 +0200 ASoC: audio_graph_card2: Fix port numbers in example The example in audio-graph-card2.c has multiple nodes with the same name in it. Change the port numbers to get different names. Signed-off-by: Sascha Hauer Link: https://lore.kernel.org/r/20220624092601.2445224-1-s.hauer@pengutronix.de Signed-off-by: Mark Brown commit 040e3360af3736348112d29425bf5d0be5b93115 Author: Francesco Dolcini Date: Fri Jun 24 12:13:01 2022 +0200 ASoC: sgtl5000: Fix noise on shutdown/remove Put the SGTL5000 in a silent/safe state on shutdown/remove, this is required since the SGTL5000 produces a constant noise on its output after it is configured and its clock is removed. Without this change this is happening every time the module is unbound/removed or from reboot till the clock is enabled again. The issue was experienced on both a Toradex Colibri/Apalis iMX6, but can be easily reproduced everywhere just playing something on the codec and after that removing/unbinding the driver. Fixes: 9b34e6cc3bc2 ("ASoC: Add Freescale SGTL5000 codec support") Signed-off-by: Francesco Dolcini Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/20220624101301.441314-1-francesco.dolcini@toradex.com Signed-off-by: Mark Brown commit d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999 Author: Huaxin Lu Date: Tue Jul 5 13:14:17 2022 +0800 ima: Fix a potential integer overflow in ima_appraise_measurement When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow problem. Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") Signed-off-by: Huaxin Lu Signed-off-by: Mimi Zohar commit fa293fb960ab8350c92e2327a08fc141f228b044 Author: Lukas Bulwahn Date: Thu Jul 7 13:26:45 2022 +0200 MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan The email address sleep_walker@suse.com and the url http://hackndev.com/, provided in the ARM/PALM TREO SUPPORT section, are not reachable anymore. Make this machine support orphan, and give somebody the chance to step up. Move the maintainer into CREDITS to keep the attribution to his work. Signed-off-by: Lukas Bulwahn Signed-off-by: Arnd Bergmann commit 2c08b9b38f5b0f4a6c2d29be22b695e4ec4a556b Author: Peter Zijlstra Date: Wed Jul 6 15:33:30 2022 +0200 x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry Commit ee774dac0da1 ("x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()") moved PUSH_AND_CLEAR_REGS out of error_entry, into its own function, in part to avoid calling error_entry() for XenPV. However, commit 7c81c0c9210c ("x86/entry: Avoid very early RET") had to change that because the 'ret' was too early and moved it into idtentry, bloating the text size, since idtentry is expanded for every exception vector. However, with the advent of xen_error_entry() in commit d147553b64bad ("x86/xen: Add UNTRAIN_RET") it became possible to remove PUSH_AND_CLEAR_REGS from idtentry, back into *error_entry(). Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 38e0e4d04d4187c63d6b511396faae7db6a3cd9e Author: Peter Zijlstra Date: Tue Jun 28 12:57:42 2022 +0200 x86/ibt, objtool: Don't discard text references from tracepoint section On Tue, Jun 28, 2022 at 04:28:58PM +0800, Pengfei Xu wrote: > # ./ftracetest > === Ftrace unit tests === > [1] Basic trace file check [PASS] > [2] Basic test for tracers [PASS] > [3] Basic trace clock test [PASS] > [4] Basic event tracing check [PASS] > [5] Change the ringbuffer size [PASS] > [6] Snapshot and tracing setting [PASS] > [7] trace_pipe and trace_marker [PASS] > [8] Test ftrace direct functions against tracers [UNRESOLVED] > [9] Test ftrace direct functions against kprobes [UNRESOLVED] > [10] Generic dynamic event - add/remove eprobe events [FAIL] > [11] Generic dynamic event - add/remove kprobe events > > It 100% reproduced in step 11 and then missing ENDBR BUG generated: > " > [ 9332.752836] mmiotrace: enabled CPU7. > [ 9332.788612] mmiotrace: disabled. > [ 9337.103426] traps: Missing ENDBR: syscall_regfunc+0x0/0xb0 It turns out that while syscall_regfunc() does have an ENDBR when generated, it gets sealed by objtool's .ibt_endbr_seal list. Since the only text references to this function: $ git grep syscall_regfunc include/linux/tracepoint.h:extern int syscall_regfunc(void); include/trace/events/syscalls.h: syscall_regfunc, syscall_unregfunc include/trace/events/syscalls.h: syscall_regfunc, syscall_unregfunc kernel/tracepoint.c:int syscall_regfunc(void) appear in the __tracepoint section which is excluded by objtool. Fixes: 3c6f9f77e618 ("objtool: Rework ibt and extricate from stack validation") Reported-by: Pengfei Xu Link: https://lkml.kernel.org/r/Yrrepdaow4F5kqG0@hirez.programming.kicks-ass.net commit f54d45372c6ac9c993451de5e51312485f7d10bc Author: Pawan Gupta Date: Wed Jul 6 15:01:15 2022 -0700 x86/bugs: Add Cannon lake to RETBleed affected CPU list Cannon lake is also affected by RETBleed, add it to the list. Fixes: 6ad0ad2bf8a6 ("x86/bugs: Report Intel retbleed vulnerability") Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit c8e27a4a5136e7230f9e4ffcf132705bf56864cc Author: Kent Gibson Date: Wed Jul 6 16:45:07 2022 +0800 gpiolib: cdev: fix null pointer dereference in linereq_free() Fix a kernel NULL pointer dereference reported by gpio kselftests. linereq_free() can be called as part of the cleanup of a failed request, at which time the desc for a line may not have been determined, so it is unsafe to dereference without a check. Add a check prior to dereferencing the line desc. Fixes: 2068339a6c35 ("gpiolib: cdev: Add hardware timestamp clock type") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit f0fbe652e8529a180630617a17cd5922298c4f13 Author: Tiezhu Yang Date: Mon Jun 27 14:57:35 2022 +0800 LoongArch: Fix section mismatch warning init_numa_memory() is annotated __init and not used by any module, thus don't export it. Remove not needed EXPORT_SYMBOL for init_numa_memory() to fix the following section mismatch warning: MODPOST vmlinux.symvers WARNING: modpost: vmlinux.o(___ksymtab+init_numa_memory+0x0): Section mismatch in reference from the variable __ksymtab_init_numa_memory to the function .init.text:init_numa_memory() The symbol init_numa_memory is exported and annotated __init Fix this by removing the __init annotation of init_numa_memory or drop the export. This is build on Linux 5.19-rc4. Fixes: d4b6f1562a3c ("LoongArch: Add Non-Uniform Memory Access (NUMA) support") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit e6ee90233eb155991e469d2047855fc466b831b6 Author: Huacai Chen Date: Wed Jul 6 11:03:09 2022 +0800 LoongArch: Fix build errors for tinyconfig Building loongarch:tinyconfig fails with the following error. ./arch/loongarch/include/asm/page.h: In function 'pfn_valid': ./arch/loongarch/include/asm/page.h:42:32: error: 'PHYS_OFFSET' undeclared Add the missing include file and fix succeeding vdso errors. Fixes: 09cfefb7fa70 ("LoongArch: Add memory management") Signed-off-by: Guenter Roeck Signed-off-by: Huacai Chen commit 112380996ac22e428264cd7186722e784db887e4 Author: Qi Hu Date: Wed Jul 6 19:29:37 2022 +0800 LoongArch: Remove obsolete mentions of vcsr The `vcsr` only exists in the old hardware design, it isn't used in any shipped hardware from Loongson-3A5000 on. Both scalar FP and LSX/LASX instructions use the `fcsr` as their control and status registers now. For example, the RM control bit in fcsr0 is shared by FP, LSX and LASX instructions. Particularly, fcsr16 to fcsr31 are reserved for LSX/LASX now, access to these registers has no visible effect if LSX/LASX is enabled, and will cause SXD/ASXD exceptions if LSX/LASX is not enabled. So, mentions of vcsr are obsolete in the first place (it was just used for debugging), let's remove them. Reviewed-by: WANG Xuerui Signed-off-by: Qi Hu Signed-off-by: Huacai Chen commit 7fd6ef61a5d610b4f74c0ac59450237b40130319 Author: Lukas Bulwahn Date: Tue Jul 5 09:34:05 2022 +0200 LoongArch: Drop these obsolete selects in Kconfig Commit fa96b57c1490 ("LoongArch: Add build infrastructure") adds the new file arch/loongarch/Kconfig. As the work on LoongArch was probably quite some time under development, various config symbols have changed and disappeared from the time of initial writing of the Kconfig file and its inclusion in the repository. The following four commits: commit c126a53c2760 ("arch: remove GENERIC_FIND_FIRST_BIT entirely") commit 140c8180eb7c ("arch: remove HAVE_COPY_THREAD_TLS") commit aca52c398389 ("mm: remove CONFIG_HAVE_MEMBLOCK") commit 3f08a302f533 ("mm: remove CONFIG_HAVE_MEMBLOCK_NODE_MAP option") remove the mentioned config symbol, and enable the intended setup by default without configuration. Drop these obsolete selects in loongarch's Kconfig. Reviewed-by: WANG Xuerui Signed-off-by: Lukas Bulwahn Signed-off-by: Huacai Chen commit 53a6e66b1b4fea4b52f8bc62e5f9530af9061027 Author: Helge Deller Date: Sat Jun 25 13:00:34 2022 +0200 fbcon: Use fbcon_info_from_console() in fbcon_modechange_possible() Use the fbcon_info_from_console() wrapper which was added to kernel v5.19 with commit 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup"). Signed-off-by: Helge Deller Reviewed-by: Geert Uytterhoeven commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 Author: Helge Deller Date: Wed Jun 29 15:53:55 2022 +0200 fbmem: Check virtual screen sizes in fb_set_var() Verify that the fbdev or drm driver correctly adjusted the virtual screen sizes. On failure report the failing driver and reject the screen size change. Signed-off-by: Helge Deller Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org # v5.4+ commit b68277f19e31a25312c4acccadb5cf1502e52e84 Author: Ezequiel Garcia Date: Wed Jul 6 15:41:33 2022 -0300 drm/ssd130x: Fix pre-charge period setting Fix small typo which causes the mask for the 'precharge1' setting to be used with the 'precharge2' value. Signed-off-by: Ezequiel Garcia Acked-by: Javier Martinez Canillas Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220706184133.210888-1-ezequiel@vanguardiasur.com.ar commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 Author: Helge Deller Date: Sat Jun 25 13:00:34 2022 +0200 fbcon: Prevent that screen size is smaller than font size We need to prevent that users configure a screen size which is smaller than the currently selected font size. Otherwise rendering chars on the screen will access memory outside the graphics memory region. This patch adds a new function fbcon_modechange_possible() which implements this check and which later may be extended with other checks if necessary. The new function is called from the FBIOPUT_VSCREENINFO ioctl handler in fbmem.c, which will return -EINVAL if userspace asked for a too small screen size. Signed-off-by: Helge Deller Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org # v5.4+ commit 65a01e601dbba8b7a51a2677811f70f783766682 Author: Helge Deller Date: Sat Jun 25 12:56:49 2022 +0200 fbcon: Disallow setting font bigger than screen size Prevent that users set a font size which is bigger than the physical screen. It's unlikely this may happen (because screens are usually much larger than the fonts and each font char is limited to 32x32 pixels), but it may happen on smaller screens/LCD displays. Signed-off-by: Helge Deller Reviewed-by: Daniel Vetter Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org # v4.14+ commit 7c1aeba7bb977fe327fbc9682e9ccb36134cbf77 Author: xinhui pan Date: Thu Jul 7 16:02:41 2022 +0800 dma-buf: Fix one use-after-free of fence Need get the new fence when we replace the old one. Fixes: 047a1b877ed48 ("dma-buf & drm/amdgpu: remove dma_resv workaround") Signed-off-by: xinhui pan Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20220707080241.20060-1-xinhui.pan@amd.com Signed-off-by: Christian König commit 12058077b2e963d16d2d673d46233a7f46add7c9 Author: Thomas Hellström Date: Mon Jun 20 14:36:59 2022 +0200 drm/i915: Fix vm use-after-free in vma destruction In vma destruction, the following race may occur: Thread 1: Thread 2: i915_vma_destroy(); ... list_del_init(vma->vm_link); ... mutex_unlock(vma->vm->mutex); __i915_vm_release(); release_references(); And in release_reference() we dereference vma->vm to get to the vm gt pointer, leading to a use-after free. However, __i915_vm_release() grabs the vm->mutex so the vm won't be destroyed before vma->vm->mutex is released, so extract the gt pointer under the vm->mutex to avoid the vma->vm dereference in release_references(). v2: Fix a typo in the commit message (Andi Shyti) Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5944 Fixes: e1a7ab4fca0c ("drm/i915: Remove the vm open count") Cc: Niranjana Vishwanathapura Cc: Matthew Auld Signed-off-by: Thomas Hellström Acked-by: Nirmoy Das Reviewed-by: Andrzej Hajda Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220620123659.381772-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 1926a6b75954fc1a8b44d10bd0c67db957b78cf7) Signed-off-by: Rodrigo Vivi commit 25c95bf494067f7bd1dfa8064ef964abe88cafc2 Author: Daniele Ceraolo Spurio Date: Tue Jun 21 16:30:05 2022 -0700 drm/i915/guc: ADL-N should use the same GuC FW as ADL-S The only difference between the ADL S and P GuC FWs is the HWConfig support. ADL-N does not support HWConfig, so we should use the same binary as ADL-S, otherwise the GuC might attempt to fetch a config table that does not exist. ADL-N is internally identified as an ADL-P, so we need to special-case it in the FW selection code. Fixes: 7e28d0b26759 ("drm/i915/adl-n: Enable ADL-N platform") Cc: John Harrison Cc: Tejas Upadhyay Cc: Anusha Srivatsa Cc: Jani Nikula Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20220621233005.3952293-1-daniele.ceraolospurio@intel.com (cherry picked from commit 971e4a9781742aaad1587e25fd5582b2dd595ef8) Signed-off-by: Rodrigo Vivi commit 85144df9ff4652816448369de76897c57cbb1b93 Author: Hangyu Hua Date: Fri Jun 24 06:04:06 2022 -0700 drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() If drm_connector_init fails, intel_connector_free will be called to take care of proper free. So it is necessary to drop the refcount of port before intel_connector_free. Fixes: 091a4f91942a ("drm/i915: Handle drm-layer errors in intel_dp_add_mst_connector") Signed-off-by: Hangyu Hua Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20220624130406.17996-1-jose.souza@intel.com Signed-off-by: José Roberto de Souza (cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2) Signed-off-by: Rodrigo Vivi commit 07266d066301b97ad56a693f81b29b7ced429b27 Merge: faa4e04e5e140 0d1f700807d84 Author: Jakub Kicinski Date: Wed Jul 6 20:04:09 2022 -0700 Merge branch 'wireguard-patches-for-5-19-rc6' Jason A. Donenfeld says: ==================== wireguard patches for 5.19-rc6 1) A few small fixups to the selftests, per usual. Of particular note is a fix for a test flake that occurred on especially fast systems that boot in less than a second. 2) An addition during this cycle of some s390 crypto interacted with the way wireguard selects dependencies, resulting in linker errors reported by the kernel test robot. So Vladis sent in a patch for that, which also required a small preparatory fix moving some Kconfig symbols around. ==================== Link: https://lore.kernel.org/r/20220707003157.526645-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 0d1f700807d846b00e33cc87d90f404bbc904a97 Author: Vladis Dronov Date: Thu Jul 7 02:31:57 2022 +0200 wireguard: Kconfig: select CRYPTO_CHACHA_S390 Select the new implementation of CHACHA20 for S390 when available. It is faster than the generic software implementation, but also prevents some linker errors in certain situations. Reported-by: kernel test robot Link: https://lore.kernel.org/linux-kernel/202207030630.6SZVkrWf-lkp@intel.com/ Signed-off-by: Vladis Dronov Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit b7133757da4c4c17d625970f6da3d76af12a8867 Author: Jason A. Donenfeld Date: Thu Jul 7 02:31:56 2022 +0200 crypto: s390 - do not depend on CRYPTO_HW for SIMD implementations Various accelerated software implementation Kconfig values for S390 were mistakenly placed into drivers/crypto/Kconfig, even though they're mainly just SIMD code and live in arch/s390/crypto/ like usual. This gives them the very unusual dependency on CRYPTO_HW, which leads to problems elsewhere. This patch fixes the issue by moving the Kconfig values for non-hardware drivers into the usual place in crypto/Kconfig. Acked-by: Herbert Xu Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit b83fdcd9fb8ad7e59f4188ba9ec221917f463a17 Author: Jason A. Donenfeld Date: Thu Jul 7 02:31:55 2022 +0200 wireguard: selftests: use microvm on x86 This makes for faster tests, faster compile time, and allows us to ditch ACPI finally. Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 1a087eec257154e26a81a7a0a15380d7a2431765 Author: Jason A. Donenfeld Date: Thu Jul 7 02:31:54 2022 +0200 wireguard: selftests: always call kernel makefile These selftests are used for much more extensive changes than just the wireguard source files. So always call the kernel's build file, which will do something or nothing after checking the whole tree, per usual. Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 1f2f341a62639c7066ee4c76b7d9ebe867e0a1d5 Author: Jason A. Donenfeld Date: Thu Jul 7 02:31:53 2022 +0200 wireguard: selftests: use virt machine on m68k This should be a bit more stable hopefully. Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 829be057dbc1e71383b8d7de8edb31dcf07b4aa0 Author: Jason A. Donenfeld Date: Thu Jul 7 02:31:52 2022 +0200 wireguard: selftests: set fake real time in init Not all platforms have an RTC, and rather than trying to force one into each, it's much easier to just set a fixed time. This is necessary because WireGuard's latest handshakes parameter is returned in wallclock time, and if the system time isn't set, and the system is really fast, then this returns 0, which trips the test. Turning this on requires setting CONFIG_COMPAT_32BIT_TIME=y, as musl doesn't support settimeofday without it. Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit faa4e04e5e140a6d02260289a8fba8fd8d7a3003 Author: Heiner Kallweit Date: Tue Jul 5 21:15:22 2022 +0200 r8169: fix accessing unset transport header 66e4c8d95008 ("net: warn if transport header was not set") added a check that triggers a warning in r8169, see [0]. The commit referenced in the Fixes tag refers to the change from which the patch applies cleanly, there's nothing wrong with this commit. It seems the actual issue (not bug, because the warning is harmless here) was introduced with bdfa4ed68187 ("r8169: use Giant Send"). [0] https://bugzilla.kernel.org/show_bug.cgi?id=216157 Fixes: 8d520b4de3ed ("r8169: work around RTL8125 UDP hw bug") Reported-by: Erhard F. Tested-by: Erhard F. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/1b2c2b29-3dc0-f7b6-5694-97ec526d51a0@gmail.com Signed-off-by: Jakub Kicinski commit 148ca04518070910739dfc4eeda765057856403d Author: Duoming Zhou Date: Tue Jul 5 20:56:10 2022 +0800 net: rose: fix UAF bug caused by rose_t0timer_expiry There are UAF bugs caused by rose_t0timer_expiry(). The root cause is that del_timer() could not stop the timer handler that is running and there is no synchronization. One of the race conditions is shown below: (thread 1) | (thread 2) | rose_device_event | rose_rt_device_down | rose_remove_neigh rose_t0timer_expiry | rose_stop_t0timer(rose_neigh) ... | del_timer(&neigh->t0timer) | kfree(rose_neigh) //[1]FREE neigh->dce_mode //[2]USE | The rose_neigh is deallocated in position [1] and use in position [2]. The crash trace triggered by POC is like below: BUG: KASAN: use-after-free in expire_timers+0x144/0x320 Write of size 8 at addr ffff888009b19658 by task swapper/0/0 ... Call Trace: dump_stack_lvl+0xbf/0xee print_address_description+0x7b/0x440 print_report+0x101/0x230 ? expire_timers+0x144/0x320 kasan_report+0xed/0x120 ? expire_timers+0x144/0x320 expire_timers+0x144/0x320 __run_timers+0x3ff/0x4d0 run_timer_softirq+0x41/0x80 __do_softirq+0x233/0x544 ... This patch changes rose_stop_ftimer() and rose_stop_t0timer() in rose_remove_neigh() to del_timer_sync() in order that the timer handler could be finished before the resources such as rose_neigh and so on are deallocated. As a result, the UAF bugs could be mitigated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220705125610.77971-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit 9fab303a2cb3d323ca3a32a8b4ab60b451141901 Author: Mimi Zohar Date: Thu Jun 30 11:23:38 2022 -0400 ima: fix violation measurement list record Although the violation digest in the IMA measurement list is always zeroes, the size of the digest should be based on the hash algorithm. Until recently the hash algorithm was hard coded to sha1. Fix the violation digest size included in the IMA measurement list. This is just a cosmetic change which should not affect attestation. Reported-by: Stefan Berger Fixes: 09091c44cb73 ("ima: use IMA default hash algorithm for integrity violations") Tested-by: Stefan Berger Signed-off-by: Mimi Zohar commit 3a4b1cc28fbdc2325b3e3ed7d8024995a75f9216 Author: Alex Deucher Date: Tue Jun 21 10:10:37 2022 -0400 drm/amdgpu/display: disable prefer_shadow for generic fb helpers Seems to break hibernation. Disable for now until we can root cause it. Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=216119 Acked-by: Evan Quan Signed-off-by: Alex Deucher commit f9a89117fbdc63c0d4ab63a8f3596a72c245bcfe Author: Alex Deucher Date: Tue Jun 21 10:04:55 2022 -0400 drm/amdgpu: keep fbdev buffers pinned during suspend Was dropped when we converted to the generic helpers. Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") Acked-by: Evan Quan Signed-off-by: Alex Deucher commit b55a21b764c1e182014630fa5486d717484ac58f Author: Oliver Neukum Date: Tue Jul 5 14:53:51 2022 +0200 usbnet: fix memory leak in error case usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220705125351.17309-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit 5b759bf2f9d73db05369aef2344502095c4e5e73 Author: Maxim Mikityanskiy Date: Mon May 30 14:01:37 2022 +0300 net/mlx5e: Ring the TX doorbell on DMA errors TX doorbells may be postponed, because sometimes the driver knows that another packet follows (for example, when xmit_more is true, or when a MPWQE session is closed before transmitting a packet). However, the DMA mapping may fail for the next packet, in which case a new WQE is not posted, the doorbell isn't updated either, and the transmission of the previous packet will be delayed indefinitely. This commit fixes the described rare error flow by posting a NOP and ringing the doorbell on errors to flush all the previous packets. The MPWQE session is closed before that. DMA mapping in the MPWQE flow is moved to the beginning of mlx5e_sq_xmit_mpwqe, because empty sessions are not allowed. Stop room always has enough space for a NOP, because the actual TX WQE is not posted. Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 452133dd580811f184e76b1402983182ee425298 Author: Gal Pressman Date: Mon Jun 27 15:05:53 2022 +0300 net/mlx5e: Fix capability check for updating vnic env counters The existing capability check for vnic env counters only checks for receive steering discards, although we need the counters update for the exposed internal queue oob counter as well. This could result in the latter counter not being updated correctly when the receive steering discards counter is not supported. Fix that by checking whether any counter is supported instead of only the steering counter capability. Fixes: 0cfafd4b4ddf ("net/mlx5e: Add device out of buffer counter") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 6c4e8fa03fde7e5b304594294e397a9ba92feaf6 Author: Roi Dayan Date: Tue Jun 21 10:43:55 2022 +0300 net/mlx5e: CT: Use own workqueue instead of mlx5e priv Allocate a ct priv workqueue instead of using mlx5e priv one so flushing will only be of related CT entries. Also move flushing of the workqueue before rhashtable destroy otherwise entries won't be valid. Fixes: b069e14fff46 ("net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release") Signed-off-by: Roi Dayan Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit 1afbd1e283d6a5449d8c24ce8ccae8ccb15ee943 Author: Liu, Changcheng Date: Fri May 27 16:49:14 2022 +0800 net/mlx5: Lag, correct get the port select mode str mode & mode_flags is updated at the end of mlx5_activate_lag which may not reflect the actual mode as shown in below logic: mlx5_activate_lag(struct mlx5_lag *ldev, |-- unsigned long flags = 0; |-- err = mlx5_lag_set_flags(ldev, mode, tracker, shared_fdb, &flags); |-- err = mlx5_create_lag(ldev, tracker, mode, flags); |-- mlx5_get_str_port_sel_mode(ldev); |-- ldev->mode = mode; |-- ldev->mode_flags = flags; Use mode & flag as parameters to get port select mode info. Fixes: 94db33177819 ("net/mlx5: Support multiport eswitch mode") Signed-off-by: Liu, Changcheng Reviewed-by: Eli Cohen Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 0c9d876545a56aebed30fa306d0460a4d28d271a Author: Paul Blakey Date: Wed Jun 22 13:11:18 2022 +0300 net/mlx5e: Fix enabling sriov while tc nic rules are offloaded There is a total of four 4M entries flow tables. In sriov disabled mode, ct, ct_nat and post_act take three of them. When adding the first tc nic rule in this mode, it will take another 4M table for the tc table. If user then enables sriov, the legacy flow table tries to take another 4M and fails, and so enablement fails. To fix that, have legacy fdb take the next available maximum size from the fs ft pool. Fixes: 4a98544d1827 ("net/mlx5: Move chains ft pool to be used by all firmware steering") Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 2ec6cf9b742a5c18982861322fa5de6510f8f57e Author: Tariq Toukan Date: Mon Jun 6 21:21:10 2022 +0300 net/mlx5e: kTLS, Fix build time constant test in RX Use the correct constant (TLS_DRIVER_STATE_SIZE_RX) in the comparison against the size of the private RX TLS driver context. Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit 6cc2714e85754a621219693ea8aa3077d6fca0cb Author: Tariq Toukan Date: Mon Jun 6 21:20:29 2022 +0300 net/mlx5e: kTLS, Fix build time constant test in TX Use the correct constant (TLS_DRIVER_STATE_SIZE_TX) in the comparison against the size of the private TX TLS driver context. Fixes: df8d866770f9 ("net/mlx5e: kTLS, Use kernel API to extract private offload context") Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit 4892bd9830c363420f00d90186630e7acbed5c9e Author: Mark Bloch Date: Tue May 24 12:08:10 2022 +0300 net/mlx5: Lag, decouple FDB selection and shared FDB Multiport eswitch is required to use native FDB selection instead of affinity, This was achieved by passing the shared_fdb flag down the HW lag creation path. While it did accomplish the goal of setting FDB selection mode to native, it had the side effect of also creating a shared FDB configuration. This created a few issues: - TC rules are inserted into a non active FDB, which means traffic isn't offloaded as all traffic will reach only a single FDB. - All wire traffic is treated as if a single physical port received it; while this is true for a bond configuration, this shouldn't be the case for multiport eswitch. Create a new flag MLX5_LAG_MODE_FLAG_FDB_SEL_MODE_NATIVE to indicate what FDB selection mode should be used. Fixes: 94db33177819 ("net/mlx5: Support multiport eswitch mode") Signed-off-by: Mark Bloch Reviewed-by: Eli Cohen Signed-off-by: Saeed Mahameed commit d6c13d74b5c06bef75febf1f351de3c4c255f149 Author: Eli Cohen Date: Wed Jun 8 17:34:16 2022 +0300 net/mlx5: TC, allow offload from uplink to other PF's VF Redirecting traffic from uplink to a VF is a legal operation of mulitport eswitch mode. Remove the limitation. Fixes: 94db33177819 ("net/mlx5: Support multiport eswitch mode") Signed-off-by: Eli Cohen Reviewed-by: Maor Dickman Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit e5c46fde75e43c15a29b40e5fc5641727f97ae47 Author: Ard Biesheuvel Date: Thu Jun 30 16:46:54 2022 +0100 ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction After emulating a misaligned load or store issued in Thumb mode, we have to advance the IT state by hand, or it will get out of sync with the actual instruction stream, which means we'll end up applying the wrong condition code to subsequent instructions. This might corrupt the program state rather catastrophically. So borrow the it_advance() helper from the probing code, and use it on CPSR if the emulated instruction is Thumb. Cc: Reviewed-by: Linus Walleij Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit e4ced82deb5fb17222fb82e092c3f8311955b585 Author: Dmitry Osipenko Date: Tue Jun 28 08:55:45 2022 +0100 ARM: 9213/1: Print message about disabled Spectre workarounds only once Print the message about disabled Spectre workarounds only once. The message is printed each time CPU goes out from idling state on NVIDIA Tegra boards, causing storm in KMSG that makes system unusable. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko Signed-off-by: Russell King (Oracle) commit 2bf6204240fddb22cc4940b9e3f40c538390212e Author: Linus Walleij Date: Sun Jun 19 20:40:16 2022 +0100 ARM: 9212/1: domain: Modify Kconfig help text After the removal of set_fs() the reference to set_fs() is stale. Alter the helptext to reflect what the config option really does. Fixes: 8ac6f5d7f84b ("ARM: 9113/1: uaccess: remove set_fs() implementation") Acked-by: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit cc45b836388f0ccc6831288a08f77a33845f10b0 Author: Linus Walleij Date: Sun Jun 19 20:39:29 2022 +0100 ARM: 9211/1: domain: drop modify_domain() This function/macro isn't used anywhere in the kernel. The only user was set_fs() and was deleted in the set_fs() removal patch set. Fixes: 8ac6f5d7f84b ("ARM: 9113/1: uaccess: remove set_fs() implementation") Acked-by: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 598f0a99fa8a35be44b27106b43ddc66417af3b1 Author: Zhen Lei Date: Mon Jun 13 15:05:41 2022 +0100 ARM: 9210/1: Mark the FDT_FIXED sections as shareable commit 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear region") use FDT_FIXED_BASE to map the whole FDT_FIXED_SIZE memory area which contains fdt. But it only reserves the exact physical memory that fdt occupied. Unfortunately, this mapping is non-shareable. An illegal or speculative read access can bring the RAM content from non-fdt zone into cache, PIPT makes it to be hit by subsequently read access through shareable mapping(such as linear mapping), and the cache consistency between cores is lost due to non-shareable property. |<---------FDT_FIXED_SIZE------>| | | ------------------------------- | | | | ------------------------------- 1. CoreA read through MT_ROM mapping, the old data is loaded into the cache. 2. CoreB write to update data through linear mapping. CoreA received the notification to invalid the corresponding cachelines, but the property non-shareable makes it to be ignored. 3. CoreA read through linear mapping, cache hit, the old data is read. To eliminate this risk, add a new memory type MT_MEMORY_RO. Compared to MT_ROM, it is shareable and non-executable. Here's an example: list_del corruption. prev->next should be c0ecbf74, but was c08410dc kernel BUG at lib/list_debug.c:53! ... ... PC is at __list_del_entry_valid+0x58/0x98 LR is at __list_del_entry_valid+0x58/0x98 psr: 60000093 sp : c0ecbf30 ip : 00000000 fp : 00000001 r10: c08410d0 r9 : 00000001 r8 : c0825e0c r7 : 20000013 r6 : c08410d0 r5 : c0ecbf74 r4 : c0ecbf74 r3 : c0825d08 r2 : 00000000 r1 : df7ce6f4 r0 : 00000044 ... ... Stack: (0xc0ecbf30 to 0xc0ecc000) bf20: c0ecbf74 c0164fd0 c0ecbf70 c0165170 bf40: c0eca000 c0840c00 c0840c00 c0824500 c0825e0c c0189bbc c088f404 60000013 bf60: 60000013 c0e85100 000004ec 00000000 c0ebcdc0 c0ecbf74 c0ecbf74 c0825d08 ... ... < next prev > (__list_del_entry_valid) from (__list_del_entry+0xc/0x20) (__list_del_entry) from (finish_swait+0x60/0x7c) (finish_swait) from (rcu_gp_kthread+0x560/0xa20) (rcu_gp_kthread) from (kthread+0x14c/0x15c) (kthread) from (ret_from_fork+0x14/0x24) The faulty list node to be deleted is a local variable, its address is c0ecbf74. The dumped stack shows that 'prev' = c0ecbf74, but its value before lib/list_debug.c:53 is c08410dc. A large amount of printing results in swapping out the cacheline containing the old data(MT_ROM mapping is read only, so the cacheline cannot be dirty), and the subsequent dump operation obtains new data from the DDR. Fixes: 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear region") Suggested-by: Ard Biesheuvel Signed-off-by: Zhen Lei Reviewed-by: Ard Biesheuvel Reviewed-by: Kefeng Wang Signed-off-by: Russell King (Oracle) commit 0609e200246bfd3b7516091c491bec4308349055 Author: Ard Biesheuvel Date: Tue May 31 09:53:42 2022 +0100 ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle Jon reports that the Spectre-BHB init code is filling up the kernel log with spurious notifications about which mitigation has been enabled, every time any CPU comes out of a low power state. Given that Spectre-BHB mitigations are system wide, only a single mitigation can be enabled, and we already print an error if two types of CPUs coexist in a single system that require different Spectre-BHB mitigations. This means that the pr_info() that describes the selected mitigation does not need to be emitted for each CPU anyway, and so we can simply emit it only once. In order to clarify the above in the log message, update it to describe that the selected mitigation will be enabled on all CPUs, including ones that are unaffected. If another CPU comes up later that is affected and requires a different mitigation, we report an error as before. Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") Tested-by: Jon Hunter Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit 5b1a01c16292208be9a1ccc170c99c747df0c4c4 Merge: 30554a1f0fd6a 6ece49c569655 Author: Mark Brown Date: Wed Jul 6 20:37:43 2022 +0100 spi: Merge AMD fix Work around problems with large transfers. commit 5c629dc9609dc43492a7bc8060cc6120875bf096 Author: Keith Busch Date: Wed Jul 6 10:05:05 2022 -0700 nvme: use struct group for generic command dwords This will allow the trace event to know the full size of the data intended to be copied and silence read overflow checks. Reported-by: John Garry Suggested-by: Christoph Hellwig Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 9f09069cde34dcd86f5ecf3a3139fd752020812f Merge: c3850b3f975f9 48bddb89d59ee Author: Linus Torvalds Date: Wed Jul 6 10:10:26 2022 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC fixes from Stafford Horne: "Fixups for OpenRISC found during recent testing: - An OpenRISC irqchip fix to stop acking level interrupts which was causing issues on SMP platforms - A comment typo fix in our unwinder code" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: unwinder: Fix grammar issue in comment irqchip: or1k-pic: Undefine mask_ack for level triggered hardware commit c3850b3f975f94317011421bb55325f828ae72ea Merge: e35e5b6f695d2 c5e58c4545a69 Author: Linus Torvalds Date: Wed Jul 6 10:01:00 2022 -0700 Merge tag 'sound-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became largish as it includes the pending ASoC fixes. Almost all changes are device-specific small fixes, while many of them are coverage for mixer issues that were detected by selftest. In addition, usual suspects for HD/USB-audio are there" * tag 'sound-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (43 commits) ALSA: cs46xx: Fix missing snd_card_free() call at probe error ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) ALSA: usb-audio: Add quirk for Fiero SC-01 ALSA: hda/realtek: Add quirk for Clevo L140PU ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices ASoC: madera: Fix event generation for rate controls ASoC: madera: Fix event generation for OUT1 demux ASoC: cs47l15: Fix event generation for low power mux control ASoC: cs35l41: Add ASP TX3/4 source to register patch ASoC: dapm: Initialise kcontrol data for mux/demux controls ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error ASoC: cs35l41: Correct some control names ASoC: wm5110: Fix DRE control ASoC: wm_adsp: Fix event for preloader MAINTAINERS: update ASoC Qualcomm maintainer email-id ASoC: rockchip: i2s: switch BCLK to GPIO ASoC: SOF: Intel: disable IMR boot when resuming from ACPI S4 and S5 states ASoC: SOF: pm: add definitions for S4 and S5 states ASoC: SOF: pm: add explicit behavior for ACPI S1 and S2 ASoC: SOF: Intel: hda: Fix compressed stream position tracking ... commit 80f2a248a2f92c07873128808359756f72a0438b Merge: e35e5b6f695d2 1357d2a65601b Author: Thomas Gleixner Date: Wed Jul 6 18:31:59 2022 +0200 Merge tag 'irqchip-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zygnier: - Gracefully handle failure to request MMIO resources in the GICv3 driver - Make a static key static in the Apple AIC driver - Fix the Xilinx intc driver dependency on OF_ADDRESS Link: https://lore.kernel.org/all/20220701133531.1545319-1-maz@kernel.org commit 607a48c78e6b427b0b684d24e61c19e846ad65d6 Author: Samuel Holland Date: Fri Jul 1 22:19:02 2022 -0500 dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo The conditional block for variants with a second clock should have set minItems, not maxItems, which was already 2. Since clock-names requires two items, this typo should not have caused any problems. Fixes: edd14218bd66 ("dt-bindings: dmaengine: Convert Allwinner A31 and A64 DMA to a schema") Signed-off-by: Samuel Holland Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220702031903.21703-1-samuel@sholland.org Signed-off-by: Vinod Koul commit 73029c9b23cf1213e5f54c2b59efce08665199e7 Author: Keith Busch Date: Tue Jul 5 10:21:02 2022 -0700 nvme-pci: phison e16 has bogus namespace ids Add the quirk. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216049 Reported-by: Chris Egolf Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 3663a2fb325b8782524f3edb0ae32d6faa615109 Author: Hsin-Yi Wang Date: Fri Jul 1 01:33:29 2022 +0800 video: of_display_timing.h: include errno.h If CONFIG_OF is not enabled, default of_get_display_timing() returns an errno, so include the header. Fixes: 422b67e0b31a ("videomode: provide dummy inline functions for !CONFIG_OF") Suggested-by: Stephen Boyd Signed-off-by: Hsin-Yi Wang Reviewed-by: Stephen Boyd Signed-off-by: Helge Deller commit 955f04766d4e6eb94bf3baa539e096808c74ebfb Author: Guiling Deng Date: Tue Jun 28 09:36:41 2022 -0700 fbdev: fbmem: Fix logo center image dx issue Image.dx gets wrong value because of missing '()'. If xres == logo->width and n == 1, image.dx = -16. Signed-off-by: Guiling Deng Fixes: 3d8b1933eb1c ("fbdev: fbmem: add config option to center the bootup logo") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Helge Deller commit 1fd6e5675336daf4747940b4285e84b0c114ae32 Author: Johan Almbladh Date: Tue Jul 5 10:23:45 2022 +0200 xdp: Fix spurious packet loss in generic XDP TX path The byte queue limits (BQL) mechanism is intended to move queuing from the driver to the network stack in order to reduce latency caused by excessive queuing in hardware. However, when transmitting or redirecting a packet using generic XDP, the qdisc layer is bypassed and there are no additional queues. Since netif_xmit_stopped() also takes BQL limits into account, but without having any alternative queuing, packets are silently dropped. This patch modifies the drop condition to only consider cases when the driver itself cannot accept any more packets. This is analogous to the condition in __dev_direct_xmit(). Dropped packets are also counted on the device. Bypassing the qdisc layer in the generic XDP TX path means that XDP packets are able to starve other packets going through a qdisc, and DDOS attacks will be more effective. In-driver-XDP use dedicated TX queues, so they do not have this starvation issue. Signed-off-by: Johan Almbladh Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220705082345.2494312-1-johan.almbladh@anyfinetworks.com commit 6ece49c56965544262523dae4a071ace3db63507 Author: Cristian Ciocaltea Date: Wed Jul 6 13:06:22 2022 +0300 spi: amd: Limit max transfer and message size Enabling the SPI CS35L41 audio codec driver for Steam Deck [1] revealed a problem with the current AMD SPI controller driver implementation, consisting of an unrecoverable system hang. The issue can be prevented if we ensure the max transfer size and the max message size do not exceed the FIFO buffer size. According to the implementation of the downstream driver, the AMD SPI controller is not able to handle more than 70 bytes per transfer, which corresponds to the size of the FIFO buffer. Hence, let's fix this by setting the SPI limits mentioned above. [1] https://lore.kernel.org/r/20220621213819.262537-1-cristian.ciocaltea@collabora.com Reported-by: Anastasios Vacharakis Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support") Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20220706100626.1234731-2-cristian.ciocaltea@collabora.com Signed-off-by: Mark Brown commit a069a90554168ac4cc81af65f000557d2a8a0745 Author: Gal Pressman Date: Tue Jul 5 14:08:37 2022 +0300 Revert "tls: rx: move counting TlsDecryptErrors for sync" This reverts commit 284b4d93daee56dff3e10029ddf2e03227f50dbf. When using TLS device offload and coming from tls_device_reencrypt() flow, -EBADMSG error in tls_do_decryption() should not be counted towards the TLSTlsDecryptError counter. Move the counter increase back to the decrypt_internal() call site in decrypt_skb_update(). This also fixes an issue where: if (n_sgin < 1) return -EBADMSG; Errors in decrypt_internal() were not counted after the cited patch. Fixes: 284b4d93daee ("tls: rx: move counting TlsDecryptErrors for sync") Cc: Jakub Kicinski Reviewed-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Gal Pressman Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit ae9fdf6cb4da4265bdc3a574d06eaad02a7f669a Merge: 44d632d5dde25 d2d21f175f1f9 Author: David S. Miller Date: Wed Jul 6 12:50:27 2022 +0100 Merge branch 'mptcp-path-manager-fixes' Mat Martineau says: ==================== mptcp: Path manager fixes for 5.19 The MPTCP userspace path manager is new in 5.19, and these patches fix some issues in that new code. Patches 1-3 fix path manager locking issues. Patches 4 and 5 allow userspace path managers to change priority of established subflows using the existing MPTCP_PM_CMD_SET_FLAGS generic netlink command. Includes corresponding self test update. Patches 6 and 7 fix accounting of available endpoint IDs and the MPTCP_MIB_RMSUBFLOW counter. ==================== Signed-off-by: David S. Miller commit d2d21f175f1f9580eb5681f5b476c8d7a0a3c895 Author: Geliang Tang Date: Tue Jul 5 14:32:17 2022 -0700 mptcp: update MIB_RMSUBFLOW in cmd_sf_destroy This patch increases MPTCP_MIB_RMSUBFLOW mib counter in userspace pm destroy subflow function mptcp_nl_cmd_sf_destroy() when removing subflow. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 843b5e75efff04db34fcf9856de53c9e415530a2 Author: Paolo Abeni Date: Tue Jul 5 14:32:16 2022 -0700 mptcp: fix local endpoint accounting In mptcp_pm_nl_rm_addr_or_subflow() we always mark as available the id corresponding to the just removed address. The used bitmap actually tracks only the local IDs: we must restrict the operation when a (local) subflow is removed. Fixes: a88c9e496937 ("mptcp: do not block subflows creation on errors") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit ca188a25d43f85f9c6f1e0a303edad47c9d24989 Author: Kishen Maloor Date: Tue Jul 5 14:32:15 2022 -0700 selftests: mptcp: userspace PM support for MP_PRIO signals This change updates the testing sample (pm_nl_ctl) to exercise the updated MPTCP_PM_CMD_SET_FLAGS command for userspace PMs to issue MP_PRIO signals over the selected subflow. E.g. ./pm_nl_ctl set 10.0.1.2 port 47234 flags backup token 823274047 rip 10.0.1.1 rport 50003 userspace_pm.sh has a new selftest that invokes this command. Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Acked-by: Paolo Abeni Signed-off-by: Kishen Maloor Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 892f396c8e68faab7f76ff49cf39e9fbbeea4097 Author: Kishen Maloor Date: Tue Jul 5 14:32:14 2022 -0700 mptcp: netlink: issue MP_PRIO signals from userspace PMs This change updates MPTCP_PM_CMD_SET_FLAGS to allow userspace PMs to issue MP_PRIO signals over a specific subflow selected by the connection token, local and remote address+port. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/286 Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Acked-by: Paolo Abeni Signed-off-by: Kishen Maloor Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit a657430260e5437df16004c8c317821d946b5ead Author: Mat Martineau Date: Tue Jul 5 14:32:13 2022 -0700 mptcp: Acquire the subflow socket lock before modifying MP_PRIO flags When setting up a subflow's flags for sending MP_PRIO MPTCP options, the subflow socket lock was not held while reading and modifying several struct members that are also read and modified in mptcp_write_options(). Acquire the subflow socket lock earlier and send the MP_PRIO ACK with that lock already acquired. Add a new variant of the mptcp_subflow_send_ack() helper to use with the subflow lock held. Fixes: 067065422fcd ("mptcp: add the outgoing MP_PRIO support") Acked-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit c21b50d5912b68c4414c60ef5b30416c103f9fd8 Author: Mat Martineau Date: Tue Jul 5 14:32:12 2022 -0700 mptcp: Avoid acquiring PM lock for subflow priority changes The in-kernel path manager code for changing subflow flags acquired both the msk socket lock and the PM lock when possibly changing the "backup" and "fullmesh" flags. mptcp_pm_nl_mp_prio_send_ack() does not access anything protected by the PM lock, and it must release and reacquire the PM lock. By pushing the PM lock to where it is needed in mptcp_pm_nl_fullmesh(), the lock is only acquired when the fullmesh flag is changed and the backup flag code no longer has to release and reacquire the PM lock. The change in locking context requires the MIB update to be modified - move that to a better location instead. This change also makes it possible to call mptcp_pm_nl_mp_prio_send_ack() for the userspace PM commands without manipulating the in-kernel PM lock. Fixes: 0f9f696a502e ("mptcp: add set_flags command in PM netlink") Acked-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 5ccecaec5c1e85cabfda848c6f146da0d8d55bd6 Author: Paolo Abeni Date: Tue Jul 5 14:32:11 2022 -0700 mptcp: fix locking in mptcp_nl_cmd_sf_destroy() The user-space PM subflow removal path uses a couple of helpers that must be called under the msk socket lock and the current code lacks such requirement. Change the existing lock scope so that the relevant code is under its protection. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/287 Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 44d632d5dde2514b414bd6344918d68dacd8fe6f Merge: e6fa930f73a15 4d1e07d83ccc8 Author: David S. Miller Date: Wed Jul 6 12:44:39 2022 +0100 Merge branch 'act_police-continue-offload-fix' Vlad Buslov says: ==================== net: Fix police 'continue' action offload TC act_police with 'continue' action had been supported by mlx5 matchall classifier offload implementation for some time. However, 'continue' was assumed implicitly and recently got broken in multiple places. Fix it in both TC hardware offload validation code and mlx5 driver. ==================== Signed-off-by: David S. Miller commit 4d1e07d83ccc87f210e5b852b0a5ea812a2f191c Author: Vlad Buslov Date: Mon Jul 4 22:44:05 2022 +0200 net/mlx5e: Fix matchall police parameters validation Referenced commit prepared the code for upcoming extension that allows mlx5 to offload police action attached to flower classifier. However, with regard to existing matchall classifier offload validation should be reversed as FLOW_ACTION_CONTINUE is the only supported notexceed police action type. Fix the problem by allowing FLOW_ACTION_CONTINUE for police action and extend scan_tc_matchall_fdb_actions() to only allow such actions with matchall classifier. Fixes: d97b4b105ce7 ("flow_offload: reject offload for all drivers with invalid police parameters") Signed-off-by: Vlad Buslov Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit 052f744f44462cc49b88a125b0f7b93a9e47a9dd Author: Vlad Buslov Date: Mon Jul 4 22:44:04 2022 +0200 net/sched: act_police: allow 'continue' action offload Offloading police with action TC_ACT_UNSPEC was erroneously disabled even though it was supported by mlx5 matchall offload implementation, which didn't verify the action type but instead assumed that any single police action attached to matchall classifier is a 'continue' action. Lack of action type check made it non-obvious what mlx5 matchall implementation actually supports and caused implementers and reviewers of referenced commits to disallow it as a part of improved validation code. Fixes: b8cd5831c61c ("net: flow_offload: add tc police action parameters") Fixes: b50e462bc22d ("net/sched: act_police: Add extack messages for offload failure") Signed-off-by: Vlad Buslov Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Signed-off-by: David S. Miller commit aafc013e8297b30c517a6383516bc88a3425856c Merge: 3c5a4e6d833a6 f4470dbfb5ff9 Author: Arnd Bergmann Date: Wed Jul 6 13:36:16 2022 +0200 Merge tag 'v5.19-rockchip-socfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Add a missing of_node_put in suspend code error path. * tag 'v5.19-rockchip-socfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: Add missing of_node_put() in rockchip_suspend_init() Link: https://lore.kernel.org/r/7527945.6fTUFtlzNn@phil Signed-off-by: Arnd Bergmann commit 3c5a4e6d833a6165566d7467a34c82e6e5a987f3 Merge: c0d1a7bd6574c 2d56af33d4df9 Author: Arnd Bergmann Date: Wed Jul 6 13:35:12 2022 +0200 Merge tag 'v5.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes rk3399 vdu clock-rate fix, otg port fix on Quartz64-A and ethernet fix on Quartz64-B (actual production model) * tag 'v5.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Assign RK3399 VDU clock rate arm64: dts: rockchip: Fix Quartz64-A dwc3 otg port behavior arm64: dts: rockchip: Fix ethernet on production Quartz64-B Link: https://lore.kernel.org/r/7723415.29KlJPOoH8@phil Signed-off-by: Arnd Bergmann commit 4140d77a022101376bbfa3ec3e3da5063455c60e Author: Lu Baolu Date: Sat Jun 25 21:34:30 2022 +0800 iommu/vt-d: Fix RID2PASID setup/teardown failure The IOMMU driver shares the pasid table for PCI alias devices. When the RID2PASID entry of the shared pasid table has been filled by the first device, the subsequent device will encounter the "DMAR: Setup RID2PASID failed" failure as the pasid entry has already been marked as present. As the result, the IOMMU probing process will be aborted. On the contrary, when any alias device is hot-removed from the system, for example, by writing to /sys/bus/pci/devices/.../remove, the shared RID2PASID will be cleared without any notifications to other devices. As the result, any DMAs from those rest devices are blocked. Sharing pasid table among PCI alias devices could save two memory pages for devices underneath the PCIe-to-PCI bridges. Anyway, considering that those devices are rare on modern platforms that support VT-d in scalable mode and the saved memory is negligible, it's reasonable to remove this part of immature code to make the driver feasible and stable. Fixes: ef848b7e5a6a0 ("iommu/vt-d: Setup pasid entry for RID2PASID support") Reported-by: Chenyi Qiang Reported-by: Ethan Zhao Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Ethan Zhao Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220623065720.727849-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20220625133430.2200315-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 316f92a705a4c2bf4712135180d56f3cca09243a Author: Yian Chen Date: Fri May 20 17:21:15 2022 -0700 iommu/vt-d: Fix PCI bus rescan device hot add Notifier calling chain uses priority to determine the execution order of the notifiers or listeners registered to the chain. PCI bus device hot add utilizes the notification mechanism. The current code sets low priority (INT_MIN) to Intel dmar_pci_bus_notifier and postpones DMAR decoding after adding new device into IOMMU. The result is that struct device pointer cannot be found in DRHD search for the new device's DMAR/IOMMU. Subsequently, the device is put under the "catch-all" IOMMU instead of the correct one. This could cause system hang when device TLB invalidation is sent to the wrong IOMMU. Invalidation timeout error and hard lockup have been observed and data inconsistency/crush may occur as well. This patch fixes the issue by setting a positive priority(1) for dmar_pci_bus_notifier while the priority of IOMMU bus notifier uses the default value(0), therefore DMAR decoding will be in advance of DRHD search for a new device to find the correct IOMMU. Following is a 2-step example that triggers the bug by simulating PCI device hot add behavior in Intel Sapphire Rapids server. echo 1 > /sys/bus/pci/devices/0000:6a:01.0/remove echo 1 > /sys/bus/pci/rescan Fixes: 59ce0515cdaf ("iommu/vt-d: Update DRHD/RMRR/ATSR device scope") Cc: stable@vger.kernel.org # v3.15+ Reported-by: Zhang, Bernice Signed-off-by: Jacob Pan Signed-off-by: Yian Chen Link: https://lore.kernel.org/r/20220521002115.1624069-1-yian.chen@intel.com Signed-off-by: Joerg Roedel commit b57feed2cc2622ae14b2fa62f19e973e5e0a60cf Author: Michael Roth Date: Tue Jul 5 21:53:15 2022 -0500 x86/compressed/64: Add identity mappings for setup_data entries The decompressed kernel initially relies on the identity map set up by the boot/compressed kernel for accessing things like boot_params. With the recent introduction of SEV-SNP support, the decompressed kernel also needs to access the setup_data entries pointed to by boot_params->hdr.setup_data. This can lead to a crash in the kexec kernel during early boot due to these entries not currently being included in the initial identity map, see thread at Link below. Include mappings for the setup_data entries in the initial identity map. [ bp: Massage commit message and use a helper var for better readability. ] Fixes: b190a043c49a ("x86/sev: Add SEV-SNP feature detection/setup") Reported-by: Jun'ichi Nomura Signed-off-by: Michael Roth Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/TYCPR01MB694815CD815E98945F63C99183B49@TYCPR01MB6948.jpnprd01.prod.outlook.com commit 1dbe67b9faea0bc340cce894018076679c16cb71 Author: Christophe JAILLET Date: Sun May 22 19:41:05 2022 +0200 dmaengine: lgm: Fix an error handling path in intel_ldma_probe() ldma_clk_disable() calls both: clk_disable_unprepare(d->core_clk); reset_control_assert(d->rst); So, should devm_reset_control_get_optional() fail, core_clk should not be prepare_enable'd before it, otherwise it will never be disable_unprepare'd. Reorder the code to handle the error handling path as expected. Fixes: 32d31c79a1a4 ("dmaengine: Add Intel LGM SoC DMA support.") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/18504549bc4d2b62a72a02cb22a2e4d8e6a58720.1653241224.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul commit b64b3b2f1d81f83519582e1feee87d77f51f5f17 Author: Dmitry Osipenko Date: Fri May 20 21:14:32 2022 +0300 dmaengine: pl330: Fix lockdep warning about non-static key The DEFINE_SPINLOCK() macro shouldn't be used for dynamically allocated spinlocks. The lockdep warns about this and disables locking validator. Fix the warning by making lock static. INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. Hardware name: Radxa ROCK Pi 4C (DT) Call trace: dump_backtrace.part.0+0xcc/0xe0 show_stack+0x18/0x6c dump_stack_lvl+0x8c/0xb8 dump_stack+0x18/0x34 register_lock_class+0x4a8/0x4cc __lock_acquire+0x78/0x20cc lock_acquire.part.0+0xe0/0x230 lock_acquire+0x68/0x84 _raw_spin_lock_irqsave+0x84/0xc4 add_desc+0x44/0xc0 pl330_get_desc+0x15c/0x1d0 pl330_prep_dma_cyclic+0x100/0x270 snd_dmaengine_pcm_trigger+0xec/0x1c0 dmaengine_pcm_trigger+0x18/0x24 ... Fixes: e588710311ee ("dmaengine: pl330: fix descriptor allocation fail") Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20220520181432.149904-1-dmitry.osipenko@collabora.com Signed-off-by: Vinod Koul commit e6fa930f73a15238f3cb0c204e2f786c919b815c Author: Michael Walle Date: Mon Jul 4 17:36:54 2022 +0200 net: lan966x: hardcode the number of external ports Instead of counting the child nodes in the device tree, hardcode the number of ports in the driver itself. The counting won't work at all if an ethernet port is marked as disabled, e.g. because it is not connected on the board at all. It turns out that the LAN9662 and LAN9668 use the same switching IP with the same synthesis parameters. The only difference is that the output ports are not connected. Thus, we can just hardcode the number of physical ports to 8. Fixes: db8bcaad5393 ("net: lan966x: add the basic lan966x driver") Signed-off-by: Michael Walle Reviewed-by: Horatiu Vultur Link: https://lore.kernel.org/r/20220704153654.1167886-1-michael@walle.cc Signed-off-by: Jakub Kicinski commit afe4e376ac5d568367b447ca90c12858d0935b86 Author: Jason Gunthorpe Date: Mon Jul 4 22:10:50 2022 -0300 vfio: Move IOMMU_CAP_CACHE_COHERENCY test to after we know we have a group The test isn't going to work if a group doesn't exist. Normally this isn't a problem since VFIO isn't going to create a device if there is no group, but the special CONFIG_VFIO_NOIOMMU behavior allows bypassing this prevention. The new cap test effectively forces a group and breaks this config option. Move the cap test to vfio_group_find_or_alloc() which is the earliest time we know we have a group available and thus are not running in noiommu mode. Fixes: e8ae0e140c05 ("vfio: Require that devices support DMA cache coherence") Reported-by: Xiang Chen Tested-by: Xiang Chen Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/0-v1-e8934b490f36+f4-vfio_cap_fix_jgg@nvidia.com Signed-off-by: Alex Williamson commit 26c12725b462a4d39a8494554c9713d6fb86f6bd Merge: 029cc0963412c e36bea6e78ab2 Author: Jakub Kicinski Date: Tue Jul 5 14:42:09 2022 -0700 Merge tag 'for-net-2022-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix deadlock when powering on. * tag 'for-net-2022-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: core: Fix deadlock on hci_power_on_sync. ==================== Link: https://lore.kernel.org/r/20220705202700.1689796-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit e36bea6e78ab2b6c9c7396972fee231eae551cfc Author: Vasyl Vavrychuk Date: Tue Jul 5 15:59:31 2022 +0300 Bluetooth: core: Fix deadlock on hci_power_on_sync. `cancel_work_sync(&hdev->power_on)` was moved to hci_dev_close_sync in commit [1] to ensure that power_on work is canceled after HCI interface down. But, in certain cases power_on work function may call hci_dev_close_sync itself: hci_power_on -> hci_dev_do_close -> hci_dev_close_sync -> cancel_work_sync(&hdev->power_on), causing deadlock. In particular, this happens when device is rfkilled on boot. To avoid deadlock, move power_on work canceling out of hci_dev_do_close/hci_dev_close_sync. Deadlock introduced by commit [1] was reported in [2,3] as broken suspend. Suspend did not work because `hdev->req_lock` held as result of `power_on` work deadlock. In fact, other BT features were not working. It was not observed when testing [1] since it was verified without rfkill in place. NOTE: It is not needed to cancel power_on work from other places where hci_dev_do_close/hci_dev_close_sync is called in case: * Requests were serialized due to `hdev->req_workqueue`. The power_on work is first in that workqueue. * hci_rfkill_set_block which won't close device anyway until HCI_SETUP is on. * hci_sock_release which runs after hci_sock_bind which ensures HCI_SETUP was cleared. As result, behaviour is the same as in pre-dd06ed7 commit, except power_on work cancel added to hci_dev_close. [1]: commit ff7f2926114d ("Bluetooth: core: Fix missing power_on work cancel on HCI close") [2]: https://lore.kernel.org/lkml/20220614181706.26513-1-max.oss.09@gmail.com/ [2]: https://lore.kernel.org/lkml/1236061d-95dd-c3ad-a38f-2dae7aae51ef@o2.pl/ Fixes: ff7f2926114d ("Bluetooth: core: Fix missing power_on work cancel on HCI close") Signed-off-by: Vasyl Vavrychuk Reported-by: Max Krummenacher Reported-by: Mateusz Jonczyk Tested-by: Max Krummenacher Signed-off-by: Luiz Augusto von Dentz commit 8b356e536e69f3a4d6778ae9f0858a1beadabb1f Author: Mario Limonciello Date: Tue Jul 5 13:29:15 2022 -0500 ACPI: CPPC: Don't require _OSC if X86_FEATURE_CPPC is supported commit 72f2ecb7ece7 ("ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported") added support for claiming to support CPPC in _OSC on non-Intel platforms. This unfortunately caused a regression on a vartiety of AMD platforms in the field because a number of AMD platforms don't set the `_OSC` bit 5 or 6 to indicate CPPC or CPPC v2 support. As these AMD platforms already claim CPPC support via a dedicated MSR from `X86_FEATURE_CPPC`, use this enable this feature rather than requiring the `_OSC` on platforms with a dedicated MSR. If there is additional breakage on the shared memory designs also missing this _OSC, additional follow up changes may be needed. Fixes: 72f2ecb7ece7 ("Set CPPC _OSC bits for all and when CPPC_LIB is supported") Reported-by: Perry Yuan Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit 7feec7430edddb87c24b0a86b08a03d0b496a755 Author: Mario Limonciello Date: Tue Jul 5 13:29:14 2022 -0500 ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked Previously the kernel used to ignore whether the firmware masked CPPC or CPPCv2 and would just pretend that it worked. When support for the USB4 bit in _OSC was introduced from commit 9e1f561afb ("ACPI: Execute platform _OSC also with query bit clear") the kernel began to look at the return when the query bit was clear. This caused regressions that were misdiagnosed and attempted to be solved as part of commit 2ca8e6285250 ("Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query flag""). This caused a different regression where non-Intel systems weren't able to negotiate _OSC properly. This was reverted in commit 2ca8e6285250 ("Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query flag"") and attempted to be fixed by commit c42fa24b4475 ("ACPI: bus: Avoid using CPPC if not supported by firmware") but the regression still returned. These systems with the regression only load support for CPPC from an SSDT dynamically when _OSC reports CPPC v2. Avoid the problem by not letting CPPC satisfy the requirement in `acpi_cppc_processor_probe`. Reported-by: CUI Hao Reported-by: maxim.novozhilov@gmail.com Reported-by: lethe.tree@protonmail.com Reported-by: garystephenwright@gmail.com Reported-by: galaxyking0419@gmail.com Fixes: c42fa24b4475 ("ACPI: bus: Avoid using CPPC if not supported by firmware") Fixes: 2ca8e6285250 ("Revert "ACPI Pass the same capabilities to the _OSC regardless of the query flag"") Link: https://bugzilla.kernel.org/show_bug.cgi?id=213023 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2075387 Reviewed-by: Mika Westerberg Tested-by: CUI Hao Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit e35e5b6f695d241ffb1d223207da58a1fbcdff4b Merge: c1084b6c5620a b75cd218274e0 Author: Linus Torvalds Date: Tue Jul 5 09:18:32 2022 -0700 Merge tag 'xsa-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen security fixes from Juergen Gross: - XSA-403 (4 patches for blkfront and netfront drivers): Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). - XSA-405 (1 patch for netfront driver, only 5.10 and newer): While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed. - XSA-406 (1 patch for Arm specific dom0 code): When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages. * tag 'xsa-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/arm: Fix race in RB-tree based P2M accounting xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() xen/blkfront: force data bouncing when backend is untrusted xen/netfront: force data bouncing when backend is untrusted xen/netfront: fix leaking data in shared pages xen/blkfront: fix leaking data in shared pages commit efa310ba00716d7a872bdc5fa1f5545edc9efd69 Author: Conor Dooley Date: Wed Jun 29 21:07:33 2022 +0100 riscv: dts: microchip: hook up the mpfs' l2cache The initial PolarFire SoC devicetree must have been forked off from the fu540 one prior to the addition of l2cache controller support being added there. When the controller node was added to mpfs.dtsi, it was not hooked up to the CPUs & thus sysfs reports an incorrect cache configuration. Hook it up. Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") Reviewed-by: Sudeep Holla Reviewed-by: Daire McNamara Signed-off-by: Conor Dooley commit c5e58c4545a69677d078b4c813b5d10d3481be9c Author: Takashi Iwai Date: Tue Jul 5 17:23:36 2022 +0200 ALSA: cs46xx: Fix missing snd_card_free() call at probe error The previous cleanup with devres may lead to the incorrect release orders at the probe error handling due to the devres's nature. Until we register the card, snd_card_free() has to be called at first for releasing the stuff properly when the driver tries to manage and release the stuff via card->private_free(). This patch fixes it by calling snd_card_free() manually on the error from the probe callback. Fixes: 5bff69b3645d ("ALSA: cs46xx: Allocate resources with device-managed APIs") Cc: Reported-and-tested-by: Jan Engelhardt Link: https://lore.kernel.org/r/p2p1s96o-746-74p4-s95-61qo1p7782pn@vanv.qr Link: https://lore.kernel.org/r/20220705152336.350-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 85e4ea1049c70fb99de5c6057e835d151fb647da Author: David Howells Date: Wed Apr 20 14:27:17 2022 +0100 fscache: Fix invalidation/lookup race If an NFS file is opened for writing and closed, fscache_invalidate() will be asked to invalidate the file - however, if the cookie is in the LOOKING_UP state (or the CREATING state), then request to invalidate doesn't get recorded for fscache_cookie_state_machine() to do something with. Fix this by making __fscache_invalidate() set a flag if it sees the cookie is in the LOOKING_UP state to indicate that we need to go to invalidation. Note that this requires a count on the n_accesses counter for the state machine, which that will release when it's done. fscache_cookie_state_machine() then shifts to the INVALIDATING state if it sees the flag. Without this, an nfs file can get corrupted if it gets modified locally and then read locally as the cache contents may not get updated. Fixes: d24af13e2e23 ("fscache: Implement cookie invalidation") Reported-by: Max Kellermann Signed-off-by: David Howells Tested-by: Max Kellermann Link: https://lore.kernel.org/r/YlWWbpW5Foynjllo@rabbit.intern.cm-ag [1] commit 65aa5f6fd8a12e0a343aaf1815949a79a49e3f35 Author: Jia Zhu Date: Thu Jun 9 16:54:10 2022 +0800 cachefiles: narrow the scope of flushed requests when releasing fd When an anonymous fd is released, only flush the requests associated with it, rather than all of requests in xarray. Fixes: 9032b6e8589f ("cachefiles: implement on-demand read") Signed-off-by: Jia Zhu Signed-off-by: David Howells Reviewed-by: Jeffle Xu Reviewed-by: Gao Xiang Link: https://listman.redhat.com/archives/linux-cachefs/2022-June/006937.html commit 5c4588aea6675b69e328d468c5b6be5127e19a79 Author: Yue Hu Date: Wed May 25 10:51:50 2022 +0800 fscache: Introduce fscache_cookie_is_dropped() FSCACHE_COOKIE_STATE_DROPPED will be read more than once, so let's add a helper to avoid code duplication. Signed-off-by: Yue Hu Signed-off-by: David Howells Link: https://listman.redhat.com/archives/linux-cachefs/2022-May/006919.html commit bf17455b9cbd4b10bf30d39c047307e1d774fb1a Author: Yue Hu Date: Wed May 25 10:32:22 2022 +0800 fscache: Fix if condition in fscache_wait_on_volume_collision() After waiting for the volume to complete the acquisition with timeout, the if condition under which potential volume collision occurs should be acquire the volume is still pending rather than not pending so that we will continue to wait until the pending flag is cleared. Also, use the existing test pending wrapper directly instead of test_bit(). Fixes: 62ab63352350 ("fscache: Implement volume registration") Signed-off-by: Yue Hu Signed-off-by: David Howells Reviewed-by: Gao Xiang Reviewed-by: Jeffle Xu Reviewed-by: Jeff Layton Link: https://listman.redhat.com/archives/linux-cachefs/2022-May/006918.html commit 8af3a0b23818af59971f538bf258c15e1033ea55 Author: Leon Romanovsky Date: Tue Jul 5 13:21:14 2022 +0300 gpio: vf610: fix compilation error Fix compilation error by explicitly adding the missing include. drivers/gpio/gpio-vf610.c: In function ‘vf610_gpio_direction_input’: drivers/gpio/gpio-vf610.c:120:9: error: implicit declaration of function ‘pinctrl_gpio_direction_input’; did you mean ‘vf610_gpio_direction_input’? [-Werror=implicit-function-declaration] 120 | return pinctrl_gpio_direction_input(chip->base + gpio); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | vf610_gpio_direction_input Fixes: 30a35c07d9e9 ("gpio: vf610: drop the SOC_VF610 dependency for GPIO_VF610") Signed-off-by: Leon Romanovsky Signed-off-by: Tariq Toukan Reviewed-by: Andy Shevchenko Reviewed-by: Peng Fan Signed-off-by: Bartosz Golaszewski commit 8ffccd119a5908b240a26182be44c0ff3d1e3d85 Author: Jerry Snitselaar Date: Sat Jun 25 22:16:48 2022 -0700 dmaengine: idxd: Only call idxd_enable_system_pasid() if succeeded in enabling SVA feature On a Sapphire Rapids system if boot without intel_iommu=on, the IDXD driver will crash during probe in iommu_sva_bind_device(). [ 21.423729] BUG: kernel NULL pointer dereference, address: 0000000000000038 [ 21.445108] #PF: supervisor read access in kernel mode [ 21.450912] #PF: error_code(0x0000) - not-present page [ 21.456706] PGD 0 [ 21.459047] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 21.464004] CPU: 0 PID: 1420 Comm: kworker/0:3 Not tainted 5.19.0-0.rc3.27.eln120.x86_64 #1 [ 21.464011] Hardware name: Intel Corporation EAGLESTREAM/EAGLESTREAM, BIOS EGSDCRB1.SYS.0067.D12.2110190954 10/19/2021 [ 21.464015] Workqueue: events work_for_cpu_fn [ 21.464030] RIP: 0010:iommu_sva_bind_device+0x1d/0xe0 [ 21.464046] Code: c3 cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 41 56 49 89 d6 41 55 41 54 55 53 48 83 ec 08 48 8b 87 d8 02 00 00 <48> 8b 40 38 48 8b 50 10 48 83 7a 70 00 48 89 14 24 0f 84 91 00 00 [ 21.464050] RSP: 0018:ff7245d9096b7db8 EFLAGS: 00010296 [ 21.464054] RAX: 0000000000000000 RBX: ff1eadeec8a51000 RCX: 0000000000000000 [ 21.464058] RDX: ff7245d9096b7e24 RSI: 0000000000000000 RDI: ff1eadeec8a510d0 [ 21.464060] RBP: ff1eadeec8a51000 R08: ffffffffb1a12300 R09: ff1eadffbfce25b4 [ 21.464062] R10: ffffffffffffffff R11: 0000000000000038 R12: ffffffffc09f8000 [ 21.464065] R13: ff1eadeec8a510d0 R14: ff7245d9096b7e24 R15: ff1eaddf54429000 [ 21.464067] FS: 0000000000000000(0000) GS:ff1eadee7f600000(0000) knlGS:0000000000000000 [ 21.464070] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.464072] CR2: 0000000000000038 CR3: 00000008c0e10006 CR4: 0000000000771ef0 [ 21.464074] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.464076] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 21.464078] PKRU: 55555554 [ 21.464079] Call Trace: [ 21.464083] [ 21.464092] idxd_pci_probe+0x259/0x1070 [idxd] [ 21.464121] local_pci_probe+0x3e/0x80 [ 21.464132] work_for_cpu_fn+0x13/0x20 [ 21.464136] process_one_work+0x1c4/0x380 [ 21.464143] worker_thread+0x1ab/0x380 [ 21.464147] ? _raw_spin_lock_irqsave+0x23/0x50 [ 21.464158] ? process_one_work+0x380/0x380 [ 21.464161] kthread+0xe6/0x110 [ 21.464168] ? kthread_complete_and_exit+0x20/0x20 [ 21.464172] ret_from_fork+0x1f/0x30 iommu_sva_bind_device() requires SVA has been enabled successfully on the IDXD device before it's called. Otherwise, iommu_sva_bind_device() will access a NULL pointer. If Intel IOMMU is disabled, SVA cannot be enabled and thus idxd_enable_system_pasid() and iommu_sva_bind_device() should not be called. Fixes: 42a1b73852c4 ("dmaengine: idxd: Separate user and kernel pasid enabling") Cc: Vinod Koul Cc: linux-kernel@vger.kernel.org Cc: Dave Jiang Cc: Fenghua Yu Link: https://lore.kernel.org/dmaengine/20220623170232.6whonfjuh3m5vcoy@cantor/ Signed-off-by: Jerry Snitselaar Acked-by: Fenghua Yu Link: https://lore.kernel.org/r/20220626051648.14249-1-jsnitsel@redhat.com Signed-off-by: Vinod Koul commit 3770d92bd5237d686e49da7b2fb86f53ee6ed259 Author: Michael Walle Date: Thu May 26 15:51:11 2022 +0200 dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly It seems that it is valid to have less than the requested number of descriptors. But what is not valid and leads to subsequent errors is to have zero descriptors. In that case, abort the probing. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20220526135111.1470926-1-michael@walle.cc Signed-off-by: Vinod Koul commit 029cc0963412c4f989d2731759ce4578f7e1a667 Merge: 7e8c182c36e23 83844aacab201 Author: Paolo Abeni Date: Tue Jul 5 11:52:35 2022 +0200 Merge branch 'fix-bridge_vlan_aware-sh-and-bridge_vlan_unaware-sh-with-iff_unicast_flt' Vladimir Oltean says: ==================== Fix bridge_vlan_aware.sh and bridge_vlan_unaware.sh with IFF_UNICAST_FLT Make sure that h1 and h2 don't drop packets with a random MAC DA, which otherwise confuses these selftests. Also, fix an incorrect error message found during those failures. ==================== Link: https://lore.kernel.org/r/20220703073626.937785-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 83844aacab2015da1dba1df0cc61fc4b4c4e8076 Author: Vladimir Oltean Date: Sun Jul 3 10:36:26 2022 +0300 selftests: forwarding: fix error message in learning_test When packets are not received, they aren't received on $host1_if, so the message talking about the second host not receiving them is incorrect. Fix it. Fixes: d4deb01467ec ("selftests: forwarding: Add a test for FDB learning") Signed-off-by: Vladimir Oltean Reviewed-by: Ido Schimmel Signed-off-by: Paolo Abeni commit 1a635d3e1c80626237fdae47a5545b6655d8d81c Author: Vladimir Oltean Date: Sun Jul 3 10:36:25 2022 +0300 selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT The first host interface has by default no interest in receiving packets MAC DA de:ad:be:ef:13:37, so it might drop them before they hit the tc filter and this might confuse the selftest. Enable promiscuous mode such that the filter properly counts received packets. Fixes: d4deb01467ec ("selftests: forwarding: Add a test for FDB learning") Signed-off-by: Vladimir Oltean Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Signed-off-by: Paolo Abeni commit b8e629b05f5d23f9649c901bef09fab8b0c2e4b9 Author: Vladimir Oltean Date: Sun Jul 3 10:36:24 2022 +0300 selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT As mentioned in the blamed commit, flood_unicast_test() works by checking the match count on a tc filter placed on the receiving interface. But the second host interface (host2_if) has no interest in receiving a packet with MAC DA de:ad:be:ef:13:37, so its RX filter drops it even before the ingress tc filter gets to be executed. So we will incorrectly get the message "Packet was not flooded when should", when in fact, the packet was flooded as expected but dropped due to an unrelated reason, at some other layer on the receiving side. Force h2 to accept this packet by temporarily placing it in promiscuous mode. Alternatively we could either deliver to its MAC address or use tcpdump_start, but this has the fewest complications. This fixes the "flooding" test from bridge_vlan_aware.sh and bridge_vlan_unaware.sh, which calls flood_test from the lib. Fixes: 236dd50bf67a ("selftests: forwarding: Add a test for flooded traffic") Signed-off-by: Vladimir Oltean Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Signed-off-by: Paolo Abeni commit 7e8c182c36e2366b7402d3913bf717eac04e458d Merge: 1b18f09d31cfa 1c0e78a287e34 Author: Jakub Kicinski Date: Mon Jul 4 20:21:01 2022 -0700 Merge tag 'linux-can-fixes-for-5.19-20220704' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== can 2022-07-04 The 1st patch is by Oliver Hartkopp, targets the BCM CAN protocol and converts a costly synchronize_rcu() to call_rcu() to fix a performance regression. Srinivas Neeli's patch for the xilinx_can driver drops the brp limit down to 1, as only the pre-production silicon have an issue with a brp of 1. The next patch is by Duy Nguyen and fixes the data transmission on R-Car V3U SoCs in the rcar_canfd driver. Rhett Aultman's patch fixes a DMA memory leak in the gs_usb driver. Liang He's patch removes an extra of_node_get() in the grcan driver. The next 2 patches are by me, target the m_can driver and fix the timestamp handling used for peripheral devices like the tcan4x5x. Jimmy Assarsson contributes 3 patches for the kvaser_usb driver and fixes CAN clock and bit timing related issues. The remaining 5 patches target the mcp251xfd driver. Thomas Kopp contributes 2 patches to improve the workaround for broken CRC when reading the TBC register. 3 patches by me add a missing hrtimer_cancel() during the ndo_stop() callback, and fix the reading of the Device ID register. * tag 'linux-can-fixes-for-5.19-20220704' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix endianness conversion can: mcp251xfd: mcp251xfd_register_get_dev_id(): use correct length to read dev_id can: mcp251xfd: mcp251xfd_stop(): add missing hrtimer_cancel() can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits can: m_can: m_can_chip_config(): actually enable internal timestamping can: grcan: grcan_probe(): remove extra of_node_get() can: gs_usb: gs_usb_open/close(): fix memory leak can: rcar_canfd: Fix data transmission failed on R-Car V3U Revert "can: xilinx_can: Limit CANFD brp to 2" can: bcm: use call_rcu() instead of costly synchronize_rcu() ==================== Link: https://lore.kernel.org/r/20220704122613.1551119-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit e95ea0f687e679fcb0a3a67d0755b81ee7d60db0 Author: Kris Bahnsen Date: Thu Jun 30 14:03:27 2022 -0700 ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count Device-tree incorrectly used "ngpio" which caused the driver to fallback to 32 ngpios. This platform has 62 GPIO registers. Fixes: 9ff8e9fccef9 ("ARM: dts: TS-7970: add basic device tree") Signed-off-by: Kris Bahnsen Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 3c12e9da3098a30fc82dea01768d355c28e3692d Author: Sean Anderson Date: Thu Apr 28 14:16:59 2022 -0400 arm64: dts: ls1028a: Update SFP node to include clock The clocks property is now mandatory. Add it to avoid warning message. Signed-off-by: Sean Anderson Reviewed-by: Michael Walle Fixes: eba5bea8f37f ("arm64: dts: ls1028a: add efuse node") Signed-off-by: Shawn Guo commit 79471f29ec4870bc02b4fea844e86669a8a4f2a5 Author: Samuel Holland Date: Fri Jul 1 22:29:21 2022 -0500 dt-bindings: display: sun4i: Fix D1 pipeline count When adding the bindings for the D1 display engine, I missed the condition for the number of pipelines. D1 has two mixers, so it will have two pipeline references. Fixes: ae5a5d26c15c ("dt-bindings: display: Add D1 display engine compatibles") Signed-off-by: Samuel Holland Reviewed-by: Jernej Skrabec Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220702032921.22433-1-samuel@sholland.org commit c1084b6c5620a743f86947caca66d90f24060f56 Merge: 88084a3df1672 c0d1a7bd6574c Author: Linus Torvalds Date: Mon Jul 4 10:41:59 2022 -0700 Merge tag 'soc-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Another set of minor patches for Arm DTS files and soc specific drivers: - More reference counting bug fixes for DT nodes, and other trivial code fixes - Multiple code fixes for the Arm SCMI firmware driver to improve compatibility with firmware implementations. - A patch series for at91 to address power management issues from using the wrong DT compatible properties. - A series of patches to fix pad settings for NXP imx8mp to leave the configuration untouched from the boot loader - Additional DT fixes for qualcomm and NXP platforms - A boot time fix for stm32mp15 DT - Konrad Dybcio becomes an additional reviewer for the Qualcomm platforms" * tag 'soc-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (42 commits) soc: qcom: smem: use correct format characters ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 ARM: dts: stm32: delete fixed clock node on STM32MP15-SCMI ARM: dts: stm32: DSI should use LSE SCMI clock on DK1/ED1 STM32 board ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 ARM: dts: stm32: fix pwr regulators references to use scmi soc: ixp4xx/npe: Fix unused match warning ARM: at91: pm: Mark at91_pm_secure_init as __init ARM: at91: fix soc detection for SAM9X60 SiPs ARM: dts: at91: sama5d2_icp: fix eeprom compatibles ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt ARM: at91: pm: use proper compatible for sama5d2's rtc arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo firmware: arm_scmi: Remove usage of the deprecated ida_simple_xxx API firmware: arm_scmi: Fix response size warning for OPTEE transport arm64: dts: imx8mp-icore-mx8mp-edim2.2: correct pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings ... commit 9fc33eaaa979d112d10fea729edcd2a2e21aa912 Author: Dmitry Osipenko Date: Thu Jun 30 23:06:01 2022 +0300 drm/panfrost: Fix shrinker list corruption by madvise IOCTL Calling madvise IOCTL twice on BO causes memory shrinker list corruption and crashes kernel because BO is already on the list and it's added to the list again, while BO should be removed from the list before it's re-added. Fix it. Cc: stable@vger.kernel.org Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support") Acked-by: Alyssa Rosenzweig Reviewed-by: Steven Price Signed-off-by: Dmitry Osipenko Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20220630200601.1884120-3-dmitry.osipenko@collabora.com commit fb6e0637ab7ebd8e61fe24f4d663c4bae99cfa62 Author: Dmitry Osipenko Date: Thu Jun 30 23:06:00 2022 +0300 drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error When panfrost_mmu_map_fault_addr() fails, the BO's mapping should be unreferenced and not the shmem object which backs the mapping. Cc: stable@vger.kernel.org Fixes: bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept") Reviewed-by: Steven Price Signed-off-by: Dmitry Osipenko Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20220630200601.1884120-2-dmitry.osipenko@collabora.com commit 8490cad4dc4e2ee265ba9e12cd47bdfd6b9a3d34 Author: Steven Price Date: Wed Jun 15 16:48:30 2022 +0100 drm/rockchip: Detach from ARM DMA domain in attach_device Since commit 1ea2a07a532b ("iommu: Add DMA ownership management interfaces") the Rockchip display driver on the Firefly RK3288 fails to initialise properly. This is because ARM DMA domain is still attached. Let's follow the lead of exynos and tegra and add code to explicitly remove the ARM domain before attaching a new one. Fixes: 1ea2a07a532b ("iommu: Add DMA ownership management interfaces") Suggested-by: Robin Murphy Signed-off-by: Steven Price Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20220615154830.555422-1-steven.price@arm.com commit 1dbc790b4d416dacb124a6acd05f88a0bcf3be39 Author: Liu Ying Date: Fri Jul 1 14:56:34 2022 +0800 drm/bridge: fsl-ldb: Drop DE signal polarity inversion It's unnecessary to invert input data enable signal polarity according to the output one. Let's drop the inversion. Since ->atomic_check() does nothing more than the inversion, it can be dropped entirely as well. Without this patch, 'koe,tx26d202vm0bwa' LVDS panel connected with i.MX8MP EVK board does not show any data on screen. Fixes: 463db5c2ed4a ("drm: bridge: ldb: Implement simple Freescale i.MX8MP LDB bridge") Cc: Andrzej Hajda Cc: Neil Armstrong Cc: Robert Foss Cc: Laurent Pinchart Cc: Jonas Karlman Cc: Jernej Skrabec Cc: David Airlie Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Marek Vasut Cc: NXP Linux Team Signed-off-by: Liu Ying Reviewed-by: Marek Vasut Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220701065634.4027537-4-victor.liu@nxp.com commit 57ef278ef125e9188474a164f35dcffc69836d01 Author: Liu Ying Date: Fri Jul 1 14:56:33 2022 +0800 drm/bridge: fsl-ldb: Enable split mode for LVDS dual link When LVDS dual link is used, we have to enable the LDB_CTRL_SPLIT_MODE bit. Fixes: 463db5c2ed4a ("drm: bridge: ldb: Implement simple Freescale i.MX8MP LDB bridge") Cc: Andrzej Hajda Cc: Neil Armstrong Cc: Robert Foss Cc: Laurent Pinchart Cc: Jonas Karlman Cc: Jernej Skrabec Cc: David Airlie Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Marek Vasut Cc: NXP Linux Team Signed-off-by: Liu Ying Reviewed-by: Marek Vasut Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220701065634.4027537-3-victor.liu@nxp.com commit 591129d3db266648823bb953ebbc28c92e059bf3 Author: Liu Ying Date: Fri Jul 1 14:56:32 2022 +0800 drm/bridge: fsl-ldb: Fix mode clock rate validation With LVDS dual link, up to 160MHz mode clock rate is supported. With LVDS single link, up to 80MHz mode clock rate is supported. Fix mode clock rate validation by swapping the maximum mode clock rates of the two link modes. Fixes: 463db5c2ed4a ("drm: bridge: ldb: Implement simple Freescale i.MX8MP LDB bridge") Cc: Andrzej Hajda Cc: Neil Armstrong Cc: Robert Foss Cc: Laurent Pinchart Cc: Jonas Karlman Cc: Jernej Skrabec Cc: David Airlie Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Marek Vasut Cc: NXP Linux Team Signed-off-by: Liu Ying Reviewed-by: Marek Vasut Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220701065634.4027537-2-victor.liu@nxp.com commit c0d1a7bd6574c8805184468c736e26dc416bebf0 Merge: 0ec29ccf94eb4 1d0c1aadf1fd9 Author: Arnd Bergmann Date: Mon Jul 4 14:29:17 2022 +0200 Merge tag 'stm32-dt-for-v5.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into arm/fixes STM32 DT fixes for v5.19, round 2 Highlights: ----------- -Fixes STM32MP15: - Add missing usbh clock and fix clk order for usbh to avoid PLL issue. - Fix SCMI version: use scmi regulator and update missing SCMI clocks to be able to correcly boot. * tag 'stm32-dt-for-v5.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 ARM: dts: stm32: delete fixed clock node on STM32MP15-SCMI ARM: dts: stm32: DSI should use LSE SCMI clock on DK1/ED1 STM32 board ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 ARM: dts: stm32: fix pwr regulators references to use scmi Link: https://lore.kernel.org/r/1259e082-a3a4-96a5-ec9c-05dbb893a746@foss.st.com Signed-off-by: Arnd Bergmann commit 0ec29ccf94eb4c32570555a882575eca9eec6467 Author: Bill Wendling Date: Mon Mar 21 10:49:12 2022 -0700 soc: qcom: smem: use correct format characters When compiling with -Wformat, clang emits the following warnings: drivers/soc/qcom/smem.c:847:41: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat] dev_err(smem->dev, "bad host %hu\n", remote_host); ~~~ ^~~~~~~~~~~ %u ./include/linux/dev_printk.h:144:65: note: expanded from macro 'dev_err' dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ ./include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap' _p_func(dev, fmt, ##__VA_ARGS__); \ ~~~ ^~~~~~~~~~~ drivers/soc/qcom/smem.c:852:47: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat] dev_err(smem->dev, "duplicate host %hu\n", remote_host); ~~~ ^~~~~~~~~~~ %u ./include/linux/dev_printk.h:144:65: note: expanded from macro 'dev_err' dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ ./include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap' _p_func(dev, fmt, ##__VA_ARGS__); \ ~~~ ^~~~~~~~~~~ The types of these arguments are unconditionally defined, so this patch updates the format character to the correct one and change type of remote_host to "u16" to match with other types. Signed-off-by: Bill Wendling Tested-by: Justin Stitt Reviewed-by: Justin Stitt Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Arnd Bergmann commit dd84cfff3cc3b79c9d616f85bd1178df135cbd1a Merge: 2307a0e1ca0b5 980555e95f7ca Author: Takashi Iwai Date: Mon Jul 4 14:14:04 2022 +0200 Merge tag 'asoc-fix-v5.19-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 A collection of fixes for v5.19, quite large but nothing major - a good chunk of it is more stuff that was identified by mixer-test regarding event generation. commit 2307a0e1ca0b5c1337b37ac6302f96e017ebac3c Author: Egor Vorontsov Date: Mon Jun 27 13:00:35 2022 +0300 ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) The patch applies the same quirks used for SC-01 at firmware v1.1.0 to the ones running v1.0.0, with respect to hard-coded sample rates. I got two more units and successfully tested the patch series with both firmwares. The support is now complete (not accounting ASIO). Signed-off-by: Egor Vorontsov Link: https://lore.kernel.org/r/20220627100041.2861494-2-sdoregor@sdore.me Signed-off-by: Takashi Iwai commit 4fb7c24f69c48fdc02ea7858dbd5a60ff08bf7e5 Author: Egor Vorontsov Date: Mon Jun 27 13:00:34 2022 +0300 ALSA: usb-audio: Add quirk for Fiero SC-01 Fiero SC-01 is a USB sound card with two mono inputs and a single stereo output. The inputs are composed into a single stereo stream. The device uses a vendor-provided driver on Windows and does not work at all without it. The driver mostly provides ASIO functionality, but also alters the way the sound card is queried for sample rates and clocks. ALSA queries those failing with an EPIPE (same as Windows 10 does). Presumably, the vendor-provided driver does not query it at all, simply matching by VID:PID. Thus, I consider this a buggy firmware and adhere to a set of fixed endpoint quirks instead. The soundcard has an internal clock. Implicit feedback mode is required for the playback. I have updated my device to v1.1.0 from a Windows 10 VM using a vendor- provided binary prior to the development, hoping for it to just begin working. The device provides no obvious way to downgrade the firmware, and regardless, there's no binary available for v1.0.0 anyway. Thus, I will be getting another unit to extend the patch with support for that. Expected to be a simple copy-paste of the existing one, though. There were no previous reports of that device in context of Linux anywhere. Other issues have been reported though, but that's out of the scope. Signed-off-by: Egor Vorontsov Link: https://lore.kernel.org/r/20220627100041.2861494-1-sdoregor@sdore.me Signed-off-by: Takashi Iwai commit 11bea26929a1a3a9dd1a287b60c2f471701bf706 Author: Tim Crawford Date: Fri Jun 24 08:41:09 2022 -0600 ALSA: hda/realtek: Add quirk for Clevo L140PU Fixes headset detection on Clevo L140PU. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220624144109.3957-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 6e2c9105e0b743c92a157389d40f00b81bdd09fe Author: John Veness Date: Fri Jun 24 15:07:57 2022 +0100 ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices Treat the claimed 96kHz 1ch in the descriptors as 48kHz 2ch, so that the audio stream doesn't sound mono. Also fix initial stream alignment, so that left and right channels are in the correct order. Signed-off-by: John Veness Link: https://lore.kernel.org/r/20220624140757.28758-1-john-linux@pelago.org.uk Signed-off-by: Takashi Iwai commit bf43e4521ff3223a613f3a496991a22a4d78e04b Author: Thomas Zimmermann Date: Fri Jun 17 14:10:27 2022 +0200 drm/aperture: Run fbdev removal before internal helpers Always run fbdev removal first to remove simpledrm via sysfb_disable(). This clears the internal state. The later call to drm_aperture_detach_drivers() then does nothing. Otherwise, with drm_aperture_detach_drivers() running first, the call to sysfb_disable() uses inconsistent state. Example backtrace show below: [ 11.663422] ================================================================== [ 11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0 [ 11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311 [ 11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G E 5 .19.0-rc2-1-default+ #1689 [ 11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011 [ 11.663447] Call Trace: [ 11.663449] [ 11.663451] ? device_del+0x79/0x5f0 [ 11.663456] dump_stack_lvl+0x5b/0x73 [ 11.663462] print_address_description.constprop.0+0x1f/0x1b0 [ 11.663468] ? device_del+0x79/0x5f0 [ 11.663471] ? device_del+0x79/0x5f0 [ 11.663475] print_report.cold+0x3c/0x21c [ 11.663481] ? lock_acquired+0x87/0x1e0 [ 11.663484] ? lock_acquired+0x87/0x1e0 [ 11.663489] ? device_del+0x79/0x5f0 [ 11.663492] kasan_report+0xbf/0xf0 [ 11.663498] ? device_del+0x79/0x5f0 [ 11.663503] device_del+0x79/0x5f0 [ 11.663509] ? device_remove_attrs+0x170/0x170 [ 11.663514] ? lock_is_held_type+0xe8/0x140 [ 11.663523] platform_device_del.part.0+0x19/0xe0 [ 11.663530] platform_device_unregister+0x1c/0x30 [ 11.663535] sysfb_disable+0x2d/0x70 [ 11.663540] remove_conflicting_framebuffers+0x1c/0xf0 [ 11.663546] remove_conflicting_pci_framebuffers+0x130/0x1a0 [ 11.663554] drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0 [ 11.663561] ? mgag200_pci_remove+0x30/0x30 [mgag200] [ 11.663578] mgag200_pci_probe+0x2d/0x140 [mgag200] Reported-by: Zack Rusin Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Reviewed-by: Zack Rusin Fixes: ee7a69aa38d8 ("fbdev: Disable sysfb device registration when removing conflicting FBs") Cc: Javier Martinez Canillas Cc: Daniel Vetter Cc: Daniel Vetter Cc: Sam Ravnborg Cc: Helge Deller Cc: Thomas Zimmermann Cc: Alex Deucher Cc: Zhen Lei Cc: Changcheng Deng Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de (cherry picked from commit fb84efa28a48e30b87fa1122e8aab8016c7347cd) Signed-off-by: Thomas Zimmermann commit 887502826549caa7e4215fd9e628f48f14c0825a Author: Jason A. Donenfeld Date: Thu Jun 30 14:16:54 2022 +0200 powerpc/powernv: delay rng platform device creation until later in boot The platform device for the rng must be created much later in boot. Otherwise it tries to connect to a parent that doesn't yet exist, resulting in this splat: [ 0.000478] kobject: '(null)' ((____ptrval____)): is not initialized, yet kobject_get() is being called. [ 0.002925] [c000000002a0fb30] [c00000000073b0bc] kobject_get+0x8c/0x100 (unreliable) [ 0.003071] [c000000002a0fba0] [c00000000087e464] device_add+0xf4/0xb00 [ 0.003194] [c000000002a0fc80] [c000000000a7f6e4] of_device_add+0x64/0x80 [ 0.003321] [c000000002a0fcb0] [c000000000a800d0] of_platform_device_create_pdata+0xd0/0x1b0 [ 0.003476] [c000000002a0fd00] [c00000000201fa44] pnv_get_random_long_early+0x240/0x2e4 [ 0.003623] [c000000002a0fe20] [c000000002060c38] random_init+0xc0/0x214 This patch fixes the issue by doing the platform device creation inside of machine_subsys_initcall. Fixes: f3eac426657d ("powerpc/powernv: wire up rng during setup_arch") Cc: stable@vger.kernel.org Reported-by: Sachin Sant Signed-off-by: Jason A. Donenfeld Tested-by: Sachin Sant [mpe: Change "of node" to "platform device" in change log] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220630121654.1939181-1-Jason@zx2c4.com commit 1c0e78a287e3493e22bde8553d02f3b89177eaf7 Author: Marc Kleine-Budde Date: Mon Jun 20 11:49:24 2022 +0200 can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix endianness conversion In mcp251xfd_register_get_dev_id() the device ID register is read with handcrafted SPI transfers. As all registers, this register is in little endian. Further it is not naturally aligned in struct mcp251xfd_map_buf_nocrc::data. However after the transfer the register content is converted from big endian to CPU endianness not taking care of being unaligned. Fix the conversion by converting from little endian to CPU endianness taking the unaligned source into account. Side note: So far the register content is 0x0 on all mcp251xfd compatible chips, and is only used for an informative printk. Link: https://lore.kernel.org/all/20220627092859.809042-1-mkl@pengutronix.de Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN") Reviewed-by: Rasmus Villemoes Reviewed-by: Manivannan Sadhasivam Signed-off-by: Marc Kleine-Budde commit 0ff32bfa0e794ccc3601de7158b522bf736fa63c Author: Marc Kleine-Budde Date: Thu Jun 16 11:38:00 2022 +0200 can: mcp251xfd: mcp251xfd_register_get_dev_id(): use correct length to read dev_id The device ID register is 32 bits wide. The driver uses incorrectly the size of a pointer to a u32 to calculate the length of the SPI transfer. This results in a read of 2 registers on 64 bit platforms. This is no problem on the Linux side, as the RX buffer of the SPI transfer is large enough. In the mpc251xfd chip this results in the read of an undocumented register. So far no problems were observed. Fix the length of the SPI transfer to read the device ID register only. Link: https://lore.kernel.org/all/20220616094914.244440-1-mkl@pengutronix.de Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN") Reported-by: Rasmus Villemoes Reviewed-by: Manivannan Sadhasivam Signed-off-by: Marc Kleine-Budde commit d5a972f561a003e302e4267340c57e8fbd096fa4 Author: Marc Kleine-Budde Date: Mon Jun 6 14:46:18 2022 +0200 can: mcp251xfd: mcp251xfd_stop(): add missing hrtimer_cancel() In commit 169d00a25658 ("can: mcp251xfd: add TX IRQ coalescing support") software based TX coalescing was added to the driver. The key idea is to keep the TX complete IRQ disabled for some time after processing it and re-enable later by a hrtimer. When bringing the interface down, this timer has to be stopped. Add the missing hrtimer_cancel() of the tx_irq_time hrtimer to mcp251xfd_stop(). Link: https://lore.kernel.org/all/20220620143942.891811-1-mkl@pengutronix.de Fixes: 169d00a25658 ("can: mcp251xfd: add TX IRQ coalescing support") Cc: stable@vger.kernel.org # v5.18 Reviewed-by: Manivannan Sadhasivam Signed-off-by: Marc Kleine-Budde commit e3d4ee7d5f7f5256dfe89219afcc7a2d553b731f Author: Thomas Kopp Date: Tue Dec 21 22:24:52 2021 +0000 can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register The mcp251xfd compatible chips have an erratum ([1], [2]), where the received CRC doesn't match the calculated CRC. In commit c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register") the following workaround was implementierend. - If a CRC read error on the TBC register is detected and the first byte is 0x00 or 0x80, the most significant bit of the first byte is flipped and the CRC is calculated again. - If the CRC now matches, the _original_ data is passed to the reader. For now we assume transferred data was OK. New investigations and simulations indicate that the CRC send by the device is calculated on correct data, and the data is incorrectly received by the SPI host controller. Use flipped instead of original data and update workaround description in mcp251xfd_regmap_crc_read(). [1] mcp2517fd: DS80000792C: "Incorrect CRC for certain READ_CRC commands" [2] mcp2518fd: DS80000789C: "Incorrect CRC for certain READ_CRC commands" Link: https://lore.kernel.org/all/DM4PR11MB53901D49578FE265B239E55AFB7C9@DM4PR11MB5390.namprd11.prod.outlook.com Fixes: c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register") Cc: stable@vger.kernel.org Signed-off-by: Thomas Kopp [mkl: split into 2 patches, update patch description and documentation] Signed-off-by: Marc Kleine-Budde commit 406cc9cdb3e8d644b15e8028948f091b82abdbca Author: Thomas Kopp Date: Tue Dec 21 22:24:52 2021 +0000 can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd The mcp251xfd compatible chips have an erratum ([1], [2]), where the received CRC doesn't match the calculated CRC. In commit c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register") the following workaround was implementierend. - If a CRC read error on the TBC register is detected and the first byte is 0x00 or 0x80, the most significant bit of the first byte is flipped and the CRC is calculated again. - If the CRC now matches, the _original_ data is passed to the reader. For now we assume transferred data was OK. Measurements on the mcp2517fd show that the workaround is applicable not only of the lowest byte is 0x00 or 0x80, but also if 3 least significant bits are set. Update check on 1st data byte and workaround description accordingly. [1] mcp2517fd: DS80000792C: "Incorrect CRC for certain READ_CRC commands" [2] mcp2518fd: DS80000789C: "Incorrect CRC for certain READ_CRC commands" Link: https://lore.kernel.org/all/DM4PR11MB53901D49578FE265B239E55AFB7C9@DM4PR11MB5390.namprd11.prod.outlook.com Fixes: c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register") Cc: stable@vger.kernel.org Reported-by: Pavel Modilaynen Signed-off-by: Thomas Kopp [mkl: split into 2 patches, update patch description and documentation] Signed-off-by: Marc Kleine-Budde commit b3b6df2c56d80b8c6740433cff5f016668b8de70 Author: Jimmy Assarsson Date: Fri Jun 3 10:38:20 2022 +0200 can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits Use correct bittiming limits depending on device. For devices based on USBcanII, Leaf M32C or Leaf i.MX28. Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Fixes: b4f20130af23 ("can: kvaser_usb: add support for Kvaser Leaf v2 and usb mini PCIe") Fixes: f5d4abea3ce0 ("can: kvaser_usb: Add support for the USBcan-II family") Link: https://lore.kernel.org/all/20220603083820.800246-4-extja@kvaser.com Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson [mkl: remove stray netlink.h include] [mkl: keep struct can_bittiming_const kvaser_usb_flexc_bittiming_const in kvaser_usb_hydra.c] Signed-off-by: Marc Kleine-Budde commit e6c80e601053ffdac5709f11ff3ec1e19ed05f7b Author: Jimmy Assarsson Date: Fri Jun 3 10:38:19 2022 +0200 can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression The firmware of M32C based Leaf devices expects bittiming parameters calculated for 16MHz clock. Since we use the actual clock frequency of the device, the device may end up with wrong bittiming parameters, depending on user requested parameters. This regression affects M32C based Leaf devices with non-16MHz clock. Fixes: fb12797ab1fe ("can: kvaser_usb: get CAN clock frequency from device") Link: https://lore.kernel.org/all/20220603083820.800246-3-extja@kvaser.com Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Signed-off-by: Marc Kleine-Budde commit 49f274c72357d2d74cba70b172cf369768909707 Author: Jimmy Assarsson Date: Fri Jun 3 10:38:18 2022 +0200 can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info Unify and move compile-time known information into new struct kvaser_usb_driver_info, in favor of run-time checks. All Kvaser USBcanII supports listen-only mode and error counter reporting. Link: https://lore.kernel.org/all/20220603083820.800246-2-extja@kvaser.com Suggested-by: Marc Kleine-Budde Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson [mkl: move struct kvaser_usb_driver_info into kvaser_usb_core.c] Signed-off-by: Marc Kleine-Budde commit 1b18f09d31cfa7148df15a7d5c5e0e86f105f7d1 Author: Rick Lindsley Date: Sat Jul 2 03:37:12 2022 -0700 ibmvnic: Properly dispose of all skbs during a failover. During a reset, there may have been transmits in flight that are no longer valid and cannot be fulfilled. Resetting and clearing the queues is insufficient; each skb also needs to be explicitly freed so that upper levels are not left waiting for confirmation of a transmit that will never happen. If this happens frequently enough, the apparent backlog will cause TCP to begin "congestion control" unnecessarily, culminating in permanently decreased throughput. Fixes: d7c0ef36bde03 ("ibmvnic: Free and re-allocate scrqs when tx/rx scrqs change") Tested-by: Nick Child Reviewed-by: Brian King Signed-off-by: Rick Lindsley Signed-off-by: David S. Miller commit 4c3333693f07313f5f0145a922f14a7d3c0f4f21 Author: Marc Kleine-Budde Date: Mon May 30 19:30:28 2022 +0200 can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits In commit 1be37d3b0414 ("can: m_can: fix periph RX path: use rx-offload to ensure skbs are sent from softirq context") the RX path for peripheral devices was switched to RX-offload. Received CAN frames are pushed to RX-offload together with a timestamp. RX-offload is designed to handle overflows of the timestamp correctly, if 32 bit timestamps are provided. The timestamps of m_can core are only 16 bits wide. So this patch shifts them to full 32 bit before passing them to RX-offload. Link: https://lore.kernel.org/all/20220612211410.4081390-1-mkl@pengutronix.de Fixes: 1be37d3b0414 ("can: m_can: fix periph RX path: use rx-offload to ensure skbs are sent from softirq context") Cc: # 5.13 Cc: Torin Cooper-Bennun Reviewed-by: Chandrasekar Ramakrishnan Signed-off-by: Marc Kleine-Budde commit 5b12933de4e76ec164031c18ce8e0904abf530d7 Author: Marc Kleine-Budde Date: Mon May 23 17:18:33 2022 +0200 can: m_can: m_can_chip_config(): actually enable internal timestamping In commit df06fd678260 ("can: m_can: m_can_chip_config(): enable and configure internal timestamps") the timestamping in the m_can core should be enabled. In peripheral mode, the RX'ed CAN frames, TX compete frames and error events are sorted by the timestamp. The above mentioned commit however forgot to enable the timestamping. Add the missing bits to enable the timestamp counter to the write of the Timestamp Counter Configuration register. Link: https://lore.kernel.org/all/20220612212708.4081756-1-mkl@pengutronix.de Fixes: df06fd678260 ("can: m_can: m_can_chip_config(): enable and configure internal timestamps") Cc: # 5.13 Cc: Torin Cooper-Bennun Reviewed-by: Chandrasekar Ramakrishnan Signed-off-by: Marc Kleine-Budde commit 562fed945ea482833667f85496eeda766d511386 Author: Liang He Date: Sun Jun 19 15:02:57 2022 +0800 can: grcan: grcan_probe(): remove extra of_node_get() In grcan_probe(), of_find_node_by_path() has already increased the refcount. There is no need to call of_node_get() again, so remove it. Link: https://lore.kernel.org/all/20220619070257.4067022-1-windhl@126.com Fixes: 1e93ed26acf0 ("can: grcan: grcan_probe(): fix broken system id check for errata workaround needs") Cc: stable@vger.kernel.org # v5.18 Cc: Andreas Larsson Signed-off-by: Liang He Signed-off-by: Marc Kleine-Budde commit 2bda24ef95c0311ab93bda00db40486acf30bd0a Author: Rhett Aultman Date: Sun Jul 3 19:33:06 2022 +0200 can: gs_usb: gs_usb_open/close(): fix memory leak The gs_usb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usb_alloc_coherent() to allocate a number of USB request blocks (URBs) for RX, and then later relies on usb_kill_anchored_urbs() to free them, but this doesn't actually free them. As a result, this may be leaking DMA memory that's been used by the driver. This commit is an adaptation of the techniques found in the esd_usb2 driver where a similar design pattern led to a memory leak. It explicitly frees the RX URBs and their DMA memory via a call to usb_free_coherent(). Since the RX URBs were allocated in the gs_can_open(), we remove them in gs_can_close() rather than in the disconnect function as was done in esd_usb2. For more information, see the 928150fad41b ("can: esd_usb2: fix memory leak"). Link: https://lore.kernel.org/all/alpine.DEB.2.22.394.2206031547001.1630869@thelappy Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: stable@vger.kernel.org Signed-off-by: Rhett Aultman Signed-off-by: Marc Kleine-Budde commit 374e11f1bde91545674233459e5a0416ba842b69 Author: Duy Nguyen Date: Mon Jul 4 16:46:11 2022 +0900 can: rcar_canfd: Fix data transmission failed on R-Car V3U On R-Car V3U, this driver should use suitable register offset instead of other SoCs' one. Otherwise, data transmission failed on R-Car V3U. Fixes: 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC") Link: https://lore.kernel.org/all/20220704074611.957191-1-yoshihiro.shimoda.uh@renesas.com Reviewed-by: Geert Uytterhoeven Signed-off-by: Duy Nguyen Signed-off-by: Yoshihiro Shimoda Signed-off-by: Marc Kleine-Budde commit c6da4590fe819dfe28a4f8037a8dc1e056542fb4 Author: Srinivas Neeli Date: Thu Jun 9 13:54:32 2022 +0530 Revert "can: xilinx_can: Limit CANFD brp to 2" This reverts commit 05ca14fdb6fe65614e0652d03e44b02748d25af7. On early silicon engineering samples observed bit shrinking issue when we use brp as 1. Hence updated brp_min as 2. As in production silicon this issue is fixed, so reverting the patch. Link: https://lore.kernel.org/all/20220609082433.1191060-2-srinivas.neeli@xilinx.com Signed-off-by: Srinivas Neeli Signed-off-by: Marc Kleine-Budde commit ea1c3b77bc0b2a414496b3fe988f3abba33db288 Merge: 280e3a857d96f 5d407ca738926 Author: David S. Miller Date: Mon Jul 4 10:06:50 2022 +0100 Merge branch 'netdev-docs' Jakub Kicinski says: ==================== docs: netdev: document more of our rules The patch series length limit and reverse xmas tree are not documented. Add those, and a tl;dr section summarizing how we differ. v2: improve the series length blurb (Andrew) ==================== Signed-off-by: David S. Miller commit 5d407ca7389261c002c49068e4a11ed3bff0fc8e Author: Jakub Kicinski Date: Fri Jul 1 20:12:09 2022 -0700 docs: netdev: add a cheat sheet for the rules Summarize the rules we see broken most often and which may be less familiar to kernel devs who are used to working outside of netdev. Signed-off-by: Jakub Kicinski Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit a24875641143fce726529e6d550b313c53eb5821 Author: Jakub Kicinski Date: Fri Jul 1 20:12:08 2022 -0700 docs: netdev: document reverse xmas tree Similarly to the 15 patch rule the reverse xmas tree is not documented. Signed-off-by: Jakub Kicinski Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 02514a067fad6df27c4b21c316c1af93066af06e Author: Jakub Kicinski Date: Fri Jul 1 20:12:07 2022 -0700 docs: netdev: document that patch series length limit We had been asking people to avoid massive patch series but it does not appear in the FAQ. Signed-off-by: Jakub Kicinski Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Author: Oliver Hartkopp Date: Fri May 20 20:32:39 2022 +0200 can: bcm: use call_rcu() instead of costly synchronize_rcu() In commit d5f9023fa61e ("can: bcm: delay release of struct bcm_op after synchronize_rcu()") Thadeu Lima de Souza Cascardo introduced two synchronize_rcu() calls in bcm_release() (only once at socket close) and in bcm_delete_rx_op() (called on removal of each single bcm_op). Unfortunately this slow removal of the bcm_op's affects user space applications like cansniffer where the modification of a filter removes 2048 bcm_op's which blocks the cansniffer application for 40(!) seconds. In commit 181d4447905d ("can: gw: use call_rcu() instead of costly synchronize_rcu()") Eric Dumazet replaced the synchronize_rcu() calls with several call_rcu()'s to safely remove the data structures after the removal of CAN ID subscriptions with can_rx_unregister() calls. This patch adopts Erics approach for the can-bcm which should be applicable since the removal of tasklet_kill() in bcm_remove_op() and the introduction of the HRTIMER_MODE_SOFT timer handling in Linux 5.4. Fixes: d5f9023fa61e ("can: bcm: delay release of struct bcm_op after synchronize_rcu()") # >= 5.4 Link: https://lore.kernel.org/all/20220520183239.19111-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Cc: Eric Dumazet Cc: Norbert Slusarek Cc: Thadeu Lima de Souza Cascardo Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit 1d0c1aadf1fd9f3de95d1532b3651e8634546e71 Author: Fabrice Gasnier Date: Tue Jun 21 10:45:09 2022 +0200 ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 The USBH composed of EHCI and OHCI controllers needs the PHY clock to be initialized first, before enabling (gating) them. The reverse is also required when going to suspend. So, add USBPHY clock as 1st entry in both controllers, so the USBPHY PLL gets enabled 1st upon controller init. Upon suspend/resume, this also makes the clock to be disabled/re-enabled in the correct order. This fixes some IRQ storm conditions seen when going to low-power, due to PHY PLL being disabled before all clocks are cleanly gated. Fixes: 949a0c0dec85 ("ARM: dts: stm32: add USB Host (USBH) support to stm32mp157c") Fixes: db7be2cb87ae ("ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151") Signed-off-by: Fabrice Gasnier Signed-off-by: Alexandre Torgue commit bf74181e75c93a1b2b000ebf3c8b4c8c17cd59da Author: Gabriel Fernandez Date: Fri Jun 24 11:27:15 2022 +0200 ARM: dts: stm32: delete fixed clock node on STM32MP15-SCMI Delete the node fixed clock managed by secure world with SCMI. Signed-off-by: Gabriel Fernandez Signed-off-by: Alexandre Torgue commit cfd7ea394cd3b70ba4d9d87ee7b88e37459036b0 Author: Gabriel Fernandez Date: Fri Jun 24 11:27:14 2022 +0200 ARM: dts: stm32: DSI should use LSE SCMI clock on DK1/ED1 STM32 board LSE clock is provided by SCMI. Signed-off-by: Gabriel Fernandez Signed-off-by: Alexandre Torgue commit 78ece8cce1ba0c3f3e5a7c6c1b914b3794f04c44 Author: Gabriel Fernandez Date: Fri Jun 24 11:27:13 2022 +0200 ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 The peripheral clock of CEC is not LSE but CEC. Signed-off-by: Gabriel Fernandez Signed-off-by: Alexandre Torgue commit a34b42f8690ce2b8360971ca5b886786ee1781af Author: Etienne Carriere Date: Fri Jun 24 11:00:55 2022 +0200 ARM: dts: stm32: fix pwr regulators references to use scmi Fixes stm32mp15*-scmi DTS files introduced in [1] to also access PWR regulators through SCMI service. This is needed since enabling secure only access to RCC clock and reset controllers also enables secure access only on PWR voltage regulators reg11, reg18 and usb33 hence these must also be accessed through SCMI Voltage Domain protocol. This change applies on commit [2] that already corrects issues from commit [1]. Cc: Alexandre Torgue Link: [1] https://lore.kernel.org/linux-arm-kernel/20220422150952.20587-7-alexandre.torgue@foss.st.com Link: [2] https://lore.kernel.org/linux-arm-kernel/20220613071920.5463-1-alexandre.torgue@foss.st.com Signed-off-by: Etienne Carriere Signed-off-by: Alexandre Torgue commit 14c99d65941538aa33edd8dc7b1bbbb593c324a2 Author: Gowans, James Date: Thu Jun 23 05:24:03 2022 +0000 mm: split huge PUD on wp_huge_pud fallback Currently the implementation will split the PUD when a fallback is taken inside the create_huge_pud function. This isn't where it should be done: the splitting should be done in wp_huge_pud, just like it's done for PMDs. Reason being that if a callback is taken during create, there is no PUD yet so nothing to split, whereas if a fallback is taken when encountering a write protection fault there is something to split. It looks like this was the original intention with the commit where the splitting was introduced, but somehow it got moved to the wrong place between v1 and v2 of the patch series. Rebase mistake perhaps. Link: https://lkml.kernel.org/r/6f48d622eb8bce1ae5dd75327b0b73894a2ec407.camel@amazon.com Fixes: 327e9fd48972 ("mm: Split huge pages on write-notify or COW") Signed-off-by: James Gowans Reviewed-by: Thomas Hellström Cc: Christian König Cc: Jan H. Schönherr Signed-off-by: Andrew Morton commit 5924e6ec1585445f251ea92713eb15beb732622a Author: Ryusuke Konishi Date: Thu Jun 23 17:54:01 2022 +0900 nilfs2: fix incorrect masking of permission flags for symlinks The permission flags of newly created symlinks are wrongly dropped on nilfs2 with the current umask value even though symlinks should have 777 (rwxrwxrwx) permissions: $ umask 0022 $ touch file && ln -s file symlink; ls -l file symlink -rw-r--r--. 1 root root 0 Jun 23 16:29 file lrwxr-xr-x. 1 root root 4 Jun 23 16:29 symlink -> file This fixes the bug by inserting a missing check that excludes symlinks. Link: https://lkml.kernel.org/r/1655974441-5612-1-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: Tommy Pettersson Reported-by: Ciprian Craciun Tested-by: Ryusuke Konishi Signed-off-by: Andrew Morton commit 1118234e4bc22ff50e9eae40ad95b17a6b12cefa Author: David Hildenbrand Date: Thu Jun 23 22:53:32 2022 +0200 mm/rmap: fix dereferencing invalid subpage pointer in try_to_migrate_one() The subpage we calculate is an invalid pointer for device private pages, because device private pages are mapped via non-present device private entries, not ordinary present PTEs. Let's just not compute broken pointers and fixup later. Move the proper assignment of the correct subpage to the beginning of the function and assert that we really only have a single page in our folio. This currently results in a BUG when tying to compute anon_exclusive, because: [ 528.727237] BUG: unable to handle page fault for address: ffffea1fffffffc0 [ 528.739585] #PF: supervisor read access in kernel mode [ 528.745324] #PF: error_code(0x0000) - not-present page [ 528.751062] PGD 44eaf2067 P4D 44eaf2067 PUD 0 [ 528.756026] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 528.760890] CPU: 120 PID: 18275 Comm: hmm-tests Not tainted 5.19.0-rc3-kfd-alex #257 [ 528.769542] Hardware name: AMD Corporation BardPeak/BardPeak, BIOS RTY1002BDS 09/17/2021 [ 528.778579] RIP: 0010:try_to_migrate_one+0x21a/0x1000 [ 528.784225] Code: f6 48 89 c8 48 2b 05 45 d1 6a 01 48 c1 f8 06 48 29 c3 48 8b 45 a8 48 c1 e3 06 48 01 cb f6 41 18 01 48 89 85 50 ff ff ff 74 0b <4c> 8b 33 49 c1 ee 11 41 83 e6 01 48 8b bd 48 ff ff ff e8 3f 99 02 [ 528.805194] RSP: 0000:ffffc90003cdfaa0 EFLAGS: 00010202 [ 528.811027] RAX: 00007ffff7ff4000 RBX: ffffea1fffffffc0 RCX: ffffeaffffffffc0 [ 528.818995] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003cdfaf8 [ 528.826962] RBP: ffffc90003cdfb70 R08: 0000000000000000 R09: 0000000000000000 [ 528.834930] R10: ffffc90003cdf910 R11: 0000000000000002 R12: ffff888194450540 [ 528.842899] R13: ffff888160d057c0 R14: 0000000000000000 R15: 03ffffffffffffff [ 528.850865] FS: 00007ffff7fdb740(0000) GS:ffff8883b0600000(0000) knlGS:0000000000000000 [ 528.859891] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 528.866308] CR2: ffffea1fffffffc0 CR3: 00000001562b4003 CR4: 0000000000770ee0 [ 528.874275] PKRU: 55555554 [ 528.877286] Call Trace: [ 528.880016] [ 528.882356] ? lock_is_held_type+0xdf/0x130 [ 528.887033] rmap_walk_anon+0x167/0x410 [ 528.891316] try_to_migrate+0x90/0xd0 [ 528.895405] ? try_to_unmap_one+0xe10/0xe10 [ 528.900074] ? anon_vma_ctor+0x50/0x50 [ 528.904260] ? put_anon_vma+0x10/0x10 [ 528.908347] ? invalid_mkclean_vma+0x20/0x20 [ 528.913114] migrate_vma_setup+0x5f4/0x750 [ 528.917691] dmirror_devmem_fault+0x8c/0x250 [test_hmm] [ 528.923532] do_swap_page+0xac0/0xe50 [ 528.927623] ? __lock_acquire+0x4b2/0x1ac0 [ 528.932199] __handle_mm_fault+0x949/0x1440 [ 528.936876] handle_mm_fault+0x13f/0x3e0 [ 528.941256] do_user_addr_fault+0x215/0x740 [ 528.945928] exc_page_fault+0x75/0x280 [ 528.950115] asm_exc_page_fault+0x27/0x30 [ 528.954593] RIP: 0033:0x40366b ... Link: https://lkml.kernel.org/r/20220623205332.319257-1-david@redhat.com Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive") Signed-off-by: David Hildenbrand Reported-by: "Sierra Guiza, Alejandro (Alex)" Reviewed-by: Alistair Popple Tested-by: Alistair Popple Cc: Vlastimil Babka Cc: Christoph Hellwig Cc: "Matthew Wilcox (Oracle)" Signed-off-by: Andrew Morton commit 34c0a5b04da8a543bc7335953c635dea1099d757 Author: YueHaibing Date: Fri Jun 24 16:52:36 2022 +0800 riscv/mm: fix build error while PAGE_TABLE_CHECK enabled without MMU mm/page_table_check.c: In function `__page_table_check_pte_clear': mm/page_table_check.c:148:6: error: implicit declaration of function `pte_user_accessible_page'; did you mean `user_access_save'? [-Werror=implicit-function-declaration] if (pte_user_accessible_page(pte)) { ^~~~~~~~~~~~~~~~~~~~~~~~ user_access_save ARCH_SUPPORTS_PAGE_TABLE_CHECK should only enabled with MMU. Link: https://lkml.kernel.org/r/20220624085236.18544-1-yuehaibing@huawei.com Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Signed-off-by: YueHaibing Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Pasha Tatashin Cc: Tong Tiangen Signed-off-by: Andrew Morton commit cffe57bee62b155c08d71218fc0e9e84a0a90bbb Author: Bagas Sanjaya Date: Wed Jun 22 15:45:46 2022 +0700 Documentation: highmem: use literal block for code example in highmem.h comment When building htmldocs on Linus's tree, there are inline emphasis warnings on include/linux/highmem.h: Documentation/vm/highmem:166: ./include/linux/highmem.h:154: WARNING: Inline emphasis start-string without end-string. Documentation/vm/highmem:166: ./include/linux/highmem.h:157: WARNING: Inline emphasis start-string without end-string. These warnings above are due to comments in code example at the mentioned lines above are enclosed by double dash (--), which confuses Sphinx as inline markup delimiters instead. Fix these warnings by indenting the code example with literal block indentation and making the comments C comments. Link: https://lkml.kernel.org/r/20220622084546.17745-1-bagasdotme@gmail.com Fixes: 85a85e7601263f ("Documentation/vm: move "Using kmap-atomic" to highmem.h") Signed-off-by: Bagas Sanjaya Reviewed-by: Ira Weiny Tested-by: Ira Weiny Cc: "Matthew Wilcox (Oracle)" Cc: "Fabio M. De Francesco" Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 39d35edee4537487e5178f258e23518272a66413 Author: Muchun Song Date: Mon Jun 20 10:30:19 2022 +0800 mm: sparsemem: fix missing higher order allocation splitting Higher order allocations for vmemmap pages from buddy allocator must be able to be treated as indepdenent small pages as they can be freed individually by the caller. There is no problem for higher order vmemmap pages allocated at boot time since each individual small page will be initialized at boot time. However, it will be an issue for memory hotplug case since those higher order vmemmap pages are allocated from buddy allocator without initializing each individual small page's refcount. The system will panic in put_page_testzero() when CONFIG_DEBUG_VM is enabled if the vmemmap page is freed. Link: https://lkml.kernel.org/r/20220620023019.94257-1-songmuchun@bytedance.com Fixes: d8d55f5616cf ("mm: sparsemem: use page table lock to protect kernel pmd operations") Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Xiongchun Duan Cc: Signed-off-by: Andrew Morton commit ed1523a895ffdabcab6e067af18685ed00f5ce15 Author: Baolin Wang Date: Mon Jun 20 10:34:42 2022 +0800 mm/damon: use set_huge_pte_at() to make huge pte old The huge_ptep_set_access_flags() can not make the huge pte old according to the discussion [1], that means we will always mornitor the young state of the hugetlb though we stopped accessing the hugetlb, as a result DAMON will get inaccurate accessing statistics. So changing to use set_huge_pte_at() to make the huge pte old to fix this issue. [1] https://lore.kernel.org/all/Yqy97gXI4Nqb7dYo@arm.com/ Link: https://lkml.kernel.org/r/1655692482-28797-1-git-send-email-baolin.wang@linux.alibaba.com Fixes: 49f4203aae06 ("mm/damon: add access checking for hugetlb pages") Signed-off-by: Baolin Wang Reviewed-by: SeongJae Park Acked-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Signed-off-by: Andrew Morton commit d684e0a52d36f8939eda30a0f31ee235ee4ee741 Author: Geert Uytterhoeven Date: Mon Jun 20 09:01:43 2022 +0200 sh: convert nommu io{re,un}map() to static inline functions Recently, nommu iounmap() was converted from a static inline function to a macro again, basically reverting commit 4580ba4ad2e6b8dd ("sh: Convert iounmap() macros to inline functions"). With -Werror, this leads to build failures like: drivers/iio/adc/xilinx-ams.c: In function `ams_iounmap_ps': drivers/iio/adc/xilinx-ams.c:1195:14: error: unused variable `ams' [-Werror=unused-variable] 1195 | struct ams *ams = data; | ^~~ Fix this by replacing the macros for ioremap() and iounmap() by static inline functions, based on . Link: https://lkml.kernel.org/r/8d1b1766260961799b04035e7bc39a7f59729f72.1655708312.git.geert+renesas@glider.be Fixes: 13f1fc870dd74713 ("sh: move the ioremap implementation out of line") Signed-off-by: Geert Uytterhoeven Reported-by: kernel test robot Reported-by: Jonathan Cameron Acked-by: Jonathan Cameron Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton commit 73f37dbcfe1763ee2294c7717a1f571e27d17fd8 Author: Axel Rasmussen Date: Fri Jun 10 10:38:12 2022 -0700 mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages When fallocate() is used on a shmem file, the pages we allocate can end up with !PageUptodate. Since UFFDIO_CONTINUE tries to find the existing page the user wants to map with SGP_READ, we would fail to find such a page, since shmem_getpage_gfp returns with a "NULL" pagep for SGP_READ if it discovers !PageUptodate. As a result, UFFDIO_CONTINUE returns -EFAULT, as it would do if the page wasn't found in the page cache at all. This isn't the intended behavior. UFFDIO_CONTINUE is just trying to find if a page exists, and doesn't care whether it still needs to be cleared or not. So, instead of SGP_READ, pass in SGP_NOALLOC. This is the same, except for one critical difference: in the !PageUptodate case, SGP_NOALLOC will clear the page and then return it. With this change, UFFDIO_CONTINUE works properly (succeeds) on a shmem file which has been fallocated, but otherwise not modified. Link: https://lkml.kernel.org/r/20220610173812.1768919-1-axelrasmussen@google.com Fixes: 153132571f02 ("userfaultfd/shmem: support UFFDIO_CONTINUE for shmem") Signed-off-by: Axel Rasmussen Acked-by: Peter Xu Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton commit 88084a3df1672e131ddc1b4e39eeacfd39864acf Author: Linus Torvalds Date: Sun Jul 3 15:39:28 2022 -0700 Linux 5.19-rc5 commit b8d5109f50969ead9d49c3e8bd78ec1f82e548e3 Author: Linus Torvalds Date: Sun Jul 3 14:40:28 2022 -0700 lockref: remove unused 'lockref_get_or_lock()' function Looking at the conditional lock acquire functions in the kernel due to the new sparse support (see commit 4a557a5d1a61 "sparse: introduce conditional lock acquire function attribute"), it became obvious that the lockref code has a couple of them, but they don't match the usual naming convention for the other ones, and their return value logic is also reversed. In the other very similar places, the naming pattern is '*_and_lock()' (eg 'atomic_put_and_lock()' and 'refcount_dec_and_lock()'), and the function returns true when the lock is taken. The lockref code is superficially very similar to the refcount code, only with the special "atomic wrt the embedded lock" semantics. But instead of the '*_and_lock()' naming it uses '*_or_lock()'. And instead of returning true in case it took the lock, it returns true if it *didn't* take the lock. Now, arguably the reflock code is quite logical: it really is a "either decrement _or_ lock" kind of situation - and the return value is about whether the operation succeeded without any special care needed. So despite the similarities, the differences do make some sense, and maybe it's not worth trying to unify the different conditional locking primitives in this area. But while looking at this all, it did become obvious that the 'lockref_get_or_lock()' function hasn't actually had any users for almost a decade. The only user it ever had was the shortlived 'd_rcu_to_refcount()' function, and it got removed and replaced with 'lockref_get_not_dead()' back in 2013 in commits 0d98439ea3c6 ("vfs: use lockred 'dead' flag to mark unrecoverably dead dentries") and e5c832d55588 ("vfs: fix dentry RCU to refcounting possibly sleeping dput()") In fact, that single use was removed less than a week after the whole function was introduced in commit b3abd80250c1 ("lockref: add 'lockref_get_or_lock() helper") so this function has been around for a decade, but only had a user for six days. Let's just put this mis-designed and unused function out of its misery. We can think about the naming and semantic oddities of the remaining 'lockref_put_or_lock()' later, but at least that function has users. And while the naming is different and the return value doesn't match, that function matches the whole '{atomic,refcount}_dec_and_test()' pattern much better (ie the magic happens when the count goes down to zero, not when it is incremented from zero). Signed-off-by: Linus Torvalds commit 7ecd8a7af36efa52fb95fb42ecab03bc4e76c848 Merge: f99d621133ef4 5fb779558f1c9 Author: Arnd Bergmann Date: Sun Jul 3 22:36:46 2022 +0200 Merge tag 'qcom-arm64-fixes-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DT fixes for v5.19 This removes duplicate includes in the sc7180-trogdor files, which accidentally ended up disabling nodes intended to be enabled. It corrects identifiers for CPU6/7 on MSM8994. On SM8450 the UFS node's interconnects property is updated to match the #interconnect-cells, avoiding sync_state issues and the GIC ITS is defined, to correct the references from the PCIe nodes. On SDM845 the display subsystem's AHB clock is corrected and on msm8992 devices, the supplies for lvs 1 and 2 are correctly specified. Lastly, a welcome addition of Konrad as reviewer for the Qualcomm SoC. * tag 'qcom-arm64-fixes-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo MAINTAINERS: Add myself as a reviewer for Qualcomm ARM/64 support arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node arm64: dts: qcom: sm8450 add ITS device tree node arm64: dts: qcom: msm8994: Fix CPU6/7 reg values arm64: dts: qcom: sm8450: fix interconnects property of UFS node arm64: dts: qcom: Remove duplicate sc7180-trogdor include on lazor/homestar Link: https://lore.kernel.org/r/20220703030208.408109-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 4a557a5d1a6145ea586dc9b17a9b4e5190c9c017 Author: Linus Torvalds Date: Thu Jun 30 09:34:10 2022 -0700 sparse: introduce conditional lock acquire function attribute The kernel tends to try to avoid conditional locking semantics because it makes it harder to think about and statically check locking rules, but we do have a few fundamental locking primitives that take locks conditionally - most obviously the 'trylock' functions. That has always been a problem for 'sparse' checking for locking imbalance, and we've had a special '__cond_lock()' macro that we've used to let sparse know how the locking works: # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0) so that you can then use this to tell sparse that (for example) the spinlock trylock macro ends up acquiring the lock when it succeeds, but not when it fails: #define raw_spin_trylock(lock) __cond_lock(lock, _raw_spin_trylock(lock)) and then sparse can follow along the locking rules when you have code like if (!spin_trylock(&dentry->d_lock)) return LRU_SKIP; .. sparse sees that the lock is held here.. spin_unlock(&dentry->d_lock); and sparse ends up happy about the lock contexts. However, this '__cond_lock()' use does result in very ugly header files, and requires you to basically wrap the real function with that macro that uses '__cond_lock'. Which has made PeterZ NAK things that try to fix sparse warnings over the years [1]. To solve this, there is now a very experimental patch to sparse that basically does the exact same thing as '__cond_lock()' did, but using a function attribute instead. That seems to make PeterZ happy [2]. Note that this does not replace existing use of '__cond_lock()', but only exposes the new proposed attribute and uses it for the previously unannotated 'refcount_dec_and_lock()' family of functions. For existing sparse installations, this will make no difference (a negative output context was ignored), but if you have the experimental sparse patch it will make sparse now understand code that uses those functions, the same way '__cond_lock()' makes sparse understand the very similar 'atomic_dec_and_lock()' uses that have the old '__cond_lock()' annotations. Note that in some cases this will silence existing context imbalance warnings. But in other cases it may end up exposing new sparse warnings for code that sparse just didn't see the locking for at all before. This is a trial, in other words. I'd expect that if it ends up being successful, and new sparse releases end up having this new attribute, we'll migrate the old-style '__cond_lock()' users to use the new-style '__cond_acquires' function attribute. The actual experimental sparse patch was posted in [3]. Link: https://lore.kernel.org/all/20130930134434.GC12926@twins.programming.kicks-ass.net/ [1] Link: https://lore.kernel.org/all/Yr60tWxN4P568x3W@worktop.programming.kicks-ass.net/ [2] Link: https://lore.kernel.org/all/CAHk-=wjZfO9hGqJ2_hGQG3U_XzSh9_XaXze=HgPdvJbgrvASfA@mail.gmail.com/ [3] Acked-by: Peter Zijlstra Cc: Alexander Aring Cc: Luc Van Oostenryck Signed-off-by: Linus Torvalds commit 20855e4cb361adeabce3665f5174b09b4a6ebfe6 Merge: 69cb6c6556ad8 7561cea5dbb97 Author: Linus Torvalds Date: Sun Jul 3 09:42:17 2022 -0700 Merge tag 'xfs-5.19-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "This fixes some stalling problems and corrects the last of the problems (I hope) observed during testing of the new atomic xattr update feature. - Fix statfs blocking on background inode gc workers - Fix some broken inode lock assertion code - Fix xattr leaf buffer leaks when cancelling a deferred xattr update operation - Clean up xattr recovery to make it easier to understand. - Fix xattr leaf block verifiers tripping over empty blocks. - Remove complicated and error prone xattr leaf block bholding mess. - Fix a bug where an rt extent crossing EOF was treated as "posteof" blocks and cleaned unnecessarily. - Fix a UAF when log shutdown races with unmount" * tag 'xfs-5.19-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: prevent a UAF when log IO errors race with unmount xfs: dont treat rt extents beyond EOF as eofblocks to be cleared xfs: don't hold xattr leaf buffers across transaction rolls xfs: empty xattr leaf header blocks are not corruption xfs: clean up the end of xfs_attri_item_recover xfs: always free xattri_leaf_bp when cancelling a deferred op xfs: use invalidate_lock to check the state of mmap_lock xfs: factor out the common lock flags assert xfs: introduce xfs_inodegc_push() xfs: bound maximum wait time for inodegc work commit 280e3a857d96f9ca8e24632788e1e7a0fec4e9f7 Merge: 3d5a2a396f198 9827a0e6e23bf Author: David S. Miller Date: Sun Jul 3 12:29:18 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Insufficient validation of element datatype and length in nft_setelem_parse_data(). At least commit 7d7402642eaf updates maximum element data area up to 64 bytes when only 16 bytes where supported at the time. Support for larger element size came later in fdb9c405e35b though. Picking this older commit as Fixes: tag to be safe than sorry. 2) Memleak in pipapo destroy path, reproducible when transaction in aborted. This is already triggering in the existing netfilter test infrastructure since more recent new tests are covering this path. ==================== Signed-off-by: David S. Miller commit 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e Author: Pablo Neira Ayuso Date: Sat Jul 2 04:16:31 2022 +0200 netfilter: nft_set_pipapo: release elements in clone from abort path New elements that reside in the clone are not released in case that the transaction is aborted. [16302.231754] ------------[ cut here ]------------ [16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables] [...] [16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155 [...] [16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables] [16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 <0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05 [...] [16302.231917] Call Trace: [16302.231919] [16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables] [16302.231934] nf_tables_abort+0x30/0x50 [nf_tables] [16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink] [16302.231952] ? __nla_validate_parse+0x48/0x190 [16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink] [16302.231963] netlink_unicast+0x211/0x340 [16302.231969] netlink_sendmsg+0x21e/0x460 Add nft_set_pipapo_match_destroy() helper function to release the elements in the lookup tables. Stefano Brivio says: "We additionally look for elements pointers in the cloned matching data if priv->dirty is set, because that means that cloned data might point to additional elements we did not commit to the working copy yet (such as the abort path case, but perhaps not limited to it)." Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 Author: Pablo Neira Ayuso Date: Sat Jul 2 04:16:30 2022 +0200 netfilter: nf_tables: stricter validation of element data Make sure element data type and length do not mismatch the one specified by the set declaration. Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") Reported-by: Hugues ANGUELKOV Signed-off-by: Pablo Neira Ayuso commit 69cb6c6556ad89620547318439d6be8bb1629a5a Merge: 34074da5424c0 a23dd544debcd Author: Linus Torvalds Date: Sat Jul 2 11:20:56 2022 -0700 Merge tag 'nfsd-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Notable regression fixes: - Fix NFSD crash during NFSv4.2 READ_PLUS operation - Fix incorrect status code returned by COMMIT operation" * tag 'nfsd-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Fix READ_PLUS crasher NFSD: restore EINVAL error translation in nfsd_commit() commit 34074da5424c08542d197396757cc3194ef754b4 Merge: bb7c512687769 aa78fa905b443 Author: Linus Torvalds Date: Sat Jul 2 10:23:36 2022 -0700 Merge tag 'for-5.19/parisc-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "Two important fixes for bugs in code which was added in 5.18: - Fix userspace signal failures on 32-bit kernel due to a bug in vDSO - Fix 32-bit load-word unalignment exception handler which returned wrong values" * tag 'for-5.19/parisc-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix vDSO signal breakage on 32-bit kernel parisc/unaligned: Fix emulate_ldw() breakage commit aa78fa905b4431c432071a878da99c2b37fc0e79 Author: Helge Deller Date: Fri Jul 1 09:00:41 2022 +0200 parisc: Fix vDSO signal breakage on 32-bit kernel Addition of vDSO support for parisc in kernel v5.18 suddenly broke glibc signal testcases on a 32-bit kernel. The trampoline code (sigtramp.S) which is mapped into userspace includes an offset to the context data on the stack, which is used by gdb and glibc to get access to registers. In a 32-bit kernel we used by mistake the offset into the compat context (which is valid on a 64-bit kernel only) instead of the offset into the "native" 32-bit context. Reported-by: John David Anglin Tested-by: John David Anglin Fixes: df24e1783e6e ("parisc: Add vDSO support") CC: stable@vger.kernel.org # 5.18 Signed-off-by: Helge Deller commit bb7c51268776941b7533374caabcaaed302b91e0 Merge: 5411de0733623 ff898552fb32d Author: Linus Torvalds Date: Sat Jul 2 09:28:36 2022 -0700 Merge tag 'perf-tools-fixes-for-v5.19-2022-07-02' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - BPF program info linear (BPIL) data is accessed assuming 64-bit alignment resulting in undefined behavior as the data is just byte aligned. Fix it, Found using -fsanitize=undefined. - Fix 'perf offcpu' build on old kernels wrt task_struct's state/__state field. - Fix perf_event_attr.sample_type setting on the 'offcpu-time' event synthesized by the 'perf offcpu' tool. - Don't bail out when synthesizing PERF_RECORD_ events for pre-existing threads when one goes away while parsing its procfs entries. - Don't sort the task scan result from /proc, its not needed and introduces bugs when the main thread isn't the first one to be processed. - Fix uninitialized 'offset' variable on aarch64 in the unwind code. - Sync KVM headers with the kernel sources. * tag 'perf-tools-fixes-for-v5.19-2022-07-02' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf synthetic-events: Ignore dead threads during event synthesis perf synthetic-events: Don't sort the task scan result from /proc perf unwind: Fix unitialized 'offset' variable on aarch64 tools headers UAPI: Sync linux/kvm.h with the kernel sources perf bpf: 8 byte align bpil data tools kvm headers arm64: Update KVM headers from the kernel sources perf offcpu: Accept allowed sample types only perf offcpu: Fix build failure on old kernels commit 5411de073362300d99bb35d46d77d656760e4606 Merge: 089866061428e ac790d09885d3 Author: Linus Torvalds Date: Sat Jul 2 09:11:44 2022 -0700 Merge tag 'powerpc-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix BPF uapi confusion about the correct type of bpf_user_pt_regs_t. - Fix virt_addr_valid() when memory is hotplugged above the boot-time high_memory value. - Fix a bug in 64-bit Book3E map_kernel_page() which would incorrectly allocate a PMD page at PUD level. - Fix a couple of minor issues found since we enabled KASAN for 64-bit Book3S. Thanks to Aneesh Kumar K.V, Cédric Le Goater, Christophe Leroy, Kefeng Wang, Liam Howlett, Nathan Lynch, and Naveen N. Rao. * tag 'powerpc-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/memhotplug: Add add_pages override for PPC powerpc/bpf: Fix use of user_pt_regs in uapi powerpc/prom_init: Fix kernel config grep powerpc/book3e: Fix PUD allocation size in map_kernel_page() powerpc/xive/spapr: correct bitmap allocation size commit 3d5a2a396f19874b02196268a567a529ad5c7448 Author: Karsten Graul Date: Fri Jul 1 20:41:43 2022 +0200 MAINTAINERS: add Wenjia as SMC maintainer Add Wenjia as maintainer for Shared Memory Communications (SMC) Sockets. Acked-by: Wenjia Zhang Acked-by: Alexandra Winter Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 2cd37c2e72449a7add6da1183d20a6247d6db111 Author: Shuah Khan Date: Fri Jul 1 10:53:52 2022 -0600 misc: rtsx_usb: set return value in rsp_buf alloc err path Set return value in rsp_buf alloc error path before going to error handling. drivers/misc/cardreader/rtsx_usb.c:639:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] if (!ucr->rsp_buf) ^~~~~~~~~~~~~ drivers/misc/cardreader/rtsx_usb.c:678:9: note: uninitialized use occurs here return ret; ^~~ drivers/misc/cardreader/rtsx_usb.c:639:2: note: remove the 'if' if its condition is always false if (!ucr->rsp_buf) ^~~~~~~~~~~~~~~~~~ drivers/misc/cardreader/rtsx_usb.c:622:9: note: initialize the variable 'ret' to silence this warning int ret; ^ = 0 Fixes: 3776c7855985 ("misc: rtsx_usb: use separate command and response buffers") Reported-by: kernel test robot Cc: stable Signed-off-by: Shuah Khan Link: https://lore.kernel.org/r/20220701165352.15687-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit ff898552fb32d255517fb0676f9fa500664c484d Author: Namhyung Kim Date: Fri Jul 1 13:54:58 2022 -0700 perf synthetic-events: Ignore dead threads during event synthesis When it synthesize various task events, it scans the list of task first and then accesses later. There's a window threads can die between the two and proc entries may not be available. Instead of bailing out, we can ignore that thread and move on. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220701205458.985106-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 363afa3aef24f5e08df6a539f5dc3aae4cddcc1a Author: Namhyung Kim Date: Fri Jul 1 13:54:57 2022 -0700 perf synthetic-events: Don't sort the task scan result from /proc It should not sort the result as procfs already returns a proper ordering of tasks. Actually sorting the order caused problems that it doesn't guararantee to process the main thread first. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220701205458.985106-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5eb502b2e1ae1ab052cdf6bdd7615217e8517360 Author: Ivan Babrou Date: Fri Jul 1 11:20:46 2022 -0700 perf unwind: Fix unitialized 'offset' variable on aarch64 Commit dc2cf4ca866f5715 ("perf unwind: Fix segbase for ld.lld linked objects") uncovered the following issue on aarch64: util/unwind-libunwind-local.c: In function 'find_proc_info': util/unwind-libunwind-local.c:386:28: error: 'offset' may be used uninitialized in this function [-Werror=maybe-uninitialized] 386 | if (ofs > 0) { | ^ util/unwind-libunwind-local.c:199:22: note: 'offset' was declared here 199 | u64 address, offset; | ^~~~~~ util/unwind-libunwind-local.c:371:20: error: 'offset' may be used uninitialized in this function [-Werror=maybe-uninitialized] 371 | if (ofs <= 0) { | ^ util/unwind-libunwind-local.c:199:22: note: 'offset' was declared here 199 | u64 address, offset; | ^~~~~~ util/unwind-libunwind-local.c:363:20: error: 'offset' may be used uninitialized in this function [-Werror=maybe-uninitialized] 363 | if (ofs <= 0) { | ^ util/unwind-libunwind-local.c:199:22: note: 'offset' was declared here 199 | u64 address, offset; | ^~~~~~ In file included from util/libunwind/arm64.c:37: Fixes: dc2cf4ca866f5715 ("perf unwind: Fix segbase for ld.lld linked objects") Signed-off-by: Ivan Babrou Cc: Alexander Shishkin Cc: Fangrui Song Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: kernel-team@cloudflare.com Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220701182046.12589-1-ivan@cloudflare.com Signed-off-by: Arnaldo Carvalho de Melo commit d28b25a62a47a8c8aa19bd543863aab6717e68c9 Author: Hangbin Liu Date: Thu Jun 30 14:22:28 2022 +0800 selftests/net: fix section name when using xdp_dummy.o Since commit 8fffa0e3451a ("selftests/bpf: Normalize XDP section names in selftests") the xdp_dummy.o's section name has changed to xdp. But some tests are still using "section xdp_dummy", which make the tests failed. Fix them by updating to the new section name. Fixes: 8fffa0e3451a ("selftests/bpf: Normalize XDP section names in selftests") Signed-off-by: Hangbin Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20220630062228.3453016-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit bc38fae3a68b5140a39e2948de2b5b301438abfe Merge: 8dfeee9dc52cb a49b8ce7306cf Author: Jakub Kicinski Date: Fri Jul 1 19:56:28 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2022-07-02 We've added 7 non-merge commits during the last 14 day(s) which contain a total of 6 files changed, 193 insertions(+), 86 deletions(-). The main changes are: 1) Fix clearing of page contiguity when unmapping XSK pool, from Ivan Malov. 2) Two verifier fixes around bounds data propagation, from Daniel Borkmann. 3) Fix fprobe sample module's parameter descriptions, from Masami Hiramatsu. 4) General BPF maintainer entry revamp to better scale patch reviews. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, selftests: Add verifier test case for jmp32's jeq/jne bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals bpf: Fix incorrect verifier simulation around jmp32's jeq/jne xsk: Clear page contiguity bit when unmapping pool bpf, docs: Better scale maintenance of BPF subsystem fprobe, samples: Add module parameter descriptions ==================== Link: https://lore.kernel.org/r/20220701230121.10354-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 089866061428ec9bf67221247c936792078c41a4 Merge: 1ce8c443e9569 ef9102004a87c Author: Linus Torvalds Date: Fri Jul 1 16:58:19 2022 -0700 Merge tag 'libnvdimm-fixes-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Vishal Verma: - Fix a bug in the libnvdimm 'BTT' (Block Translation Table) driver where accounting for poison blocks to be cleared was off by one, causing a failure to clear the the last badblock in an nvdimm region. * tag 'libnvdimm-fixes-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Fix badblocks clear off-by-one error commit 2cc39179acbbe524127f0427cee92b629db4d64b Author: Masahiro Yamada Date: Wed Jun 15 06:33:03 2022 +0900 doc: module: update file references Adjust documents to the file moves made by commit cfc1d277891e ("module: Move all into module/"). Thanks to Yanteng Si for helping me to update Documentation/translations/zh_CN/core-api/kernel-api.rst Signed-off-by: Masahiro Yamada Acked-by: Yanteng Si Signed-off-by: Luis Chamberlain commit f963ef123900ac534aeb6141642e5351989ac14c Author: Christophe Leroy Date: Sun Jun 12 17:33:20 2022 +0200 module: Fix "warning: variable 'exit' set but not used" When CONFIG_MODULE_UNLOAD is not selected, 'exit' is set but never used. It is not possible to replace the #ifdef CONFIG_MODULE_UNLOAD by IS_ENABLED(CONFIG_MODULE_UNLOAD) because mod->exit doesn't exist when CONFIG_MODULE_UNLOAD is not selected. And because of the rcu_read_lock_sched() section it is not easy to regroup everything in a single #ifdef. Let's regroup partially and add missing #ifdef to completely opt out the use of 'exit' when CONFIG_MODULE_UNLOAD is not selected. Reported-by: kernel test robot Signed-off-by: Christophe Leroy Signed-off-by: Luis Chamberlain commit cfa94c538be621a0ba645adfa9ead005b5fa02f6 Author: Christophe Leroy Date: Sun Jun 12 17:21:56 2022 +0200 module: Fix selfAssignment cppcheck warning cppcheck reports the following warnings: kernel/module/main.c:1455:26: warning: Redundant assignment of 'mod->core_layout.size' to itself. [selfAssignment] mod->core_layout.size = strict_align(mod->core_layout.size); ^ kernel/module/main.c:1489:26: warning: Redundant assignment of 'mod->init_layout.size' to itself. [selfAssignment] mod->init_layout.size = strict_align(mod->init_layout.size); ^ kernel/module/main.c:1493:26: warning: Redundant assignment of 'mod->init_layout.size' to itself. [selfAssignment] mod->init_layout.size = strict_align(mod->init_layout.size); ^ kernel/module/main.c:1504:26: warning: Redundant assignment of 'mod->init_layout.size' to itself. [selfAssignment] mod->init_layout.size = strict_align(mod->init_layout.size); ^ kernel/module/main.c:1459:26: warning: Redundant assignment of 'mod->data_layout.size' to itself. [selfAssignment] mod->data_layout.size = strict_align(mod->data_layout.size); ^ kernel/module/main.c:1463:26: warning: Redundant assignment of 'mod->data_layout.size' to itself. [selfAssignment] mod->data_layout.size = strict_align(mod->data_layout.size); ^ kernel/module/main.c:1467:26: warning: Redundant assignment of 'mod->data_layout.size' to itself. [selfAssignment] mod->data_layout.size = strict_align(mod->data_layout.size); ^ This is due to strict_align() being a no-op when CONFIG_STRICT_MODULE_RWX is not selected. Transform strict_align() macro into an inline function. It will allow type checking and avoid the selfAssignment warning. Reported-by: kernel test robot Signed-off-by: Christophe Leroy Signed-off-by: Luis Chamberlain commit 35adf9a4e55e0b0a9d5e313e65ad83681dc32e9a Author: Adrian Hunter Date: Fri Jul 1 12:44:03 2022 +0300 modules: Fix corruption of /proc/kallsyms The commit 91fb02f31505 ("module: Move kallsyms support into a separate file") changed from using strlcpy() to using strscpy() which created a buffer overflow. That happened because: 1) an incorrect value was passed as the buffer length 2) strscpy() (unlike strlcpy()) may copy beyond the length of the input string when copying word-by-word. The assumption was that because it was already known that the strings being copied would fit in the space available, it was not necessary to correctly set the buffer length. strscpy() breaks that assumption because although it will not touch bytes beyond the given buffer length it may write bytes beyond the input string length when writing word-by-word. The result of the buffer overflow is to corrupt the symbol type information that follows. e.g. $ sudo cat -v /proc/kallsyms | grep '\^' | head ffffffffc0615000 ^@ rfcomm_session_get [rfcomm] ffffffffc061c060 ^@ session_list [rfcomm] ffffffffc06150d0 ^@ rfcomm_send_frame [rfcomm] ffffffffc0615130 ^@ rfcomm_make_uih [rfcomm] ffffffffc07ed58d ^@ bnep_exit [bnep] ffffffffc07ec000 ^@ bnep_rx_control [bnep] ffffffffc07ec1a0 ^@ bnep_session [bnep] ffffffffc07e7000 ^@ input_leds_event [input_leds] ffffffffc07e9000 ^@ input_leds_handler [input_leds] ffffffffc07e7010 ^@ input_leds_disconnect [input_leds] Notably, the null bytes (represented above by ^@) can confuse tools. Fix by correcting the buffer length. Fixes: 91fb02f31505 ("module: Move kallsyms support into a separate file") Signed-off-by: Adrian Hunter Signed-off-by: Luis Chamberlain commit f99d621133ef48c9ace6416e864ffacba1cb2bc8 Merge: d95ce66d4cc3b 34d2cd3fccced Author: Arnd Bergmann Date: Fri Jul 1 22:27:45 2022 +0200 Merge tag 'amlogic-arm-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes Amlogic ARM mach-meson changes for v5.20: - Fix refcount leak in meson_smp_prepare_cpus * tag 'amlogic-arm-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: ARM: meson: Fix refcount leak in meson_smp_prepare_cpus Link: https://lore.kernel.org/r/cbf6bcb5-c7be-40fe-4436-4578c9d6c532@baylibre.com Signed-off-by: Arnd Bergmann commit d95ce66d4cc3b088308821de185cb372097fec84 Merge: 1f66f63c7312e 4ce7e51dc712f Author: Arnd Bergmann Date: Fri Jul 1 22:25:43 2022 +0200 Merge tag 'scmi-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI firmware driver fixes for v5.19 Few more fixes to address: 1. Issue reported on Juno with HDLCD clock which turned out to be yet another firmware issue. The firmware is not conformant to the spec and we now have to workaround as this may be copied to other platforms as well. The spec expects to return size of 3 for a range clock rate description while the firmware returns 1. We have other ways to validate all the 3 entries the driver reads are polpulated and we use the same to workaround this firmware bug. 2. Optee transport not setting the correct reponse length which is similar to the one reported earlier on Rockchip platform. 3. Drop the usage of the deprecated ida_simple_{get,remove} and migrate to the ida_{alloc,free} * tag 'scmi-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Remove usage of the deprecated ida_simple_xxx API firmware: arm_scmi: Fix response size warning for OPTEE transport firmware: arm_scmi: Relax CLOCK_DESCRIBE_RATES out-of-spec checks Link: https://lore.kernel.org/r/20220628133315.699803-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 1ce8c443e95698cecc32cc8ed5ff4b72da61eed4 Merge: 9ee7827668c7c 62f46fc7b8c63 Author: Linus Torvalds Date: Fri Jul 1 13:00:47 2022 -0700 Merge tag 'thermal-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Add a new CPU ID to the list of supported processors in the intel_tcc_cooling driver (Sumeet Pawnikar)" * tag 'thermal-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel_tcc_cooling: Add TCC cooling support for RaptorLake commit a49b8ce7306cf8031361a6a4f7f6bc7a775a39c8 Author: Daniel Borkmann Date: Fri Jul 1 14:47:27 2022 +0200 bpf, selftests: Add verifier test case for jmp32's jeq/jne Add a test case to trigger the verifier's incorrect conclusion in the case of jmp32's jeq/jne. Also here, make use of dead code elimination, so that we can see the verifier bailing out on unfixed kernels. Before: # ./test_verifier 724 #724/p jeq32/jne32: bounds checking FAIL Failed to load prog 'Permission denied'! R4 !read_ok verification time 8 usec stack depth 0 processed 8 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0 Summary: 0 PASSED, 0 SKIPPED, 1 FAILED After: # ./test_verifier 724 #724/p jeq32/jne32: bounds checking OK Summary: 1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220701124727.11153-4-daniel@iogearbox.net commit 73c4936f916de73fa3faec204a4deb37c25e18c1 Author: Daniel Borkmann Date: Fri Jul 1 14:47:26 2022 +0200 bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar Add a test case to trigger the constant scalar issue which leaves the register in scalar(imm=0,umin=0,umax=1,var_off=(0x0; 0x0)) state. Make use of dead code elimination, so that we can see the verifier bailing out on unfixed kernels. For the condition, we use jle given it checks on umax bound. Before: # ./test_verifier 743 #743/p jump & dead code elimination FAIL Failed to load prog 'Permission denied'! R4 !read_ok verification time 11 usec stack depth 0 processed 13 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1 Summary: 0 PASSED, 0 SKIPPED, 1 FAILED After: # ./test_verifier 743 #743/p jump & dead code elimination OK Summary: 1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220701124727.11153-3-daniel@iogearbox.net commit 3844d153a41adea718202c10ae91dc96b37453b5 Author: Daniel Borkmann Date: Fri Jul 1 14:47:25 2022 +0200 bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals Kuee reported a corner case where the tnum becomes constant after the call to __reg_bound_offset(), but the register's bounds are not, that is, its min bounds are still not equal to the register's max bounds. This in turn allows to leak pointers through turning a pointer register as is into an unknown scalar via adjust_ptr_min_max_vals(). Before: func#0 @0 0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 0: (b7) r0 = 1 ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) 1: (b7) r3 = 0 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) 2: (87) r3 = -r3 ; R3_w=scalar() 3: (87) r3 = -r3 ; R3_w=scalar() 4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881) 5: (75) if r3 s>= 0x0 goto pc+1 ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 6: (95) exit from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 7: (d5) if r3 s<= 0x8000 goto pc+1 ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 8: (95) exit from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 9: (07) r3 += -32767 ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)) <--- [*] 10: (95) exit What can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) after the operation R3 += -32767 results in a 'malformed' constant, that is, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has not been done at that point via __update_reg_bounds(), which would have improved the umax to be equal to umin. Refactor the tnum <> min/max bounds information flow into a reg_bounds_sync() helper and use it consistently everywhere. After the fix, bounds have been corrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register is regarded as a 'proper' constant scalar of 0. After: func#0 @0 0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 0: (b7) r0 = 1 ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) 1: (b7) r3 = 0 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) 2: (87) r3 = -r3 ; R3_w=scalar() 3: (87) r3 = -r3 ; R3_w=scalar() 4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881) 5: (75) if r3 s>= 0x0 goto pc+1 ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 6: (95) exit from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 7: (d5) if r3 s<= 0x8000 goto pc+1 ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 8: (95) exit from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 9: (07) r3 += -32767 ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) <--- [*] 10: (95) exit Fixes: b03c9f9fdc37 ("bpf/verifier: track signed and unsigned min/max values") Reported-by: Kuee K1r0a Signed-off-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20220701124727.11153-2-daniel@iogearbox.net commit a12ca6277eca6aeeccf66e840c23a2b520e24c8f Author: Daniel Borkmann Date: Fri Jul 1 14:47:24 2022 +0200 bpf: Fix incorrect verifier simulation around jmp32's jeq/jne Kuee reported a quirk in the jmp32's jeq/jne simulation, namely that the register value does not match expectations for the fall-through path. For example: Before fix: 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r2 = 0 ; R2_w=P0 1: (b7) r6 = 563 ; R6_w=P563 2: (87) r2 = -r2 ; R2_w=Pscalar() 3: (87) r2 = -r2 ; R2_w=Pscalar() 4: (4c) w2 |= w6 ; R2_w=Pscalar(umin=563,umax=4294967295,var_off=(0x233; 0xfffffdcc),s32_min=-2147483085) R6_w=P563 5: (56) if w2 != 0x8 goto pc+1 ; R2_w=P571 <--- [*] 6: (95) exit R0 !read_ok After fix: 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r2 = 0 ; R2_w=P0 1: (b7) r6 = 563 ; R6_w=P563 2: (87) r2 = -r2 ; R2_w=Pscalar() 3: (87) r2 = -r2 ; R2_w=Pscalar() 4: (4c) w2 |= w6 ; R2_w=Pscalar(umin=563,umax=4294967295,var_off=(0x233; 0xfffffdcc),s32_min=-2147483085) R6_w=P563 5: (56) if w2 != 0x8 goto pc+1 ; R2_w=P8 <--- [*] 6: (95) exit R0 !read_ok As can be seen on line 5 for the branch fall-through path in R2 [*] is that given condition w2 != 0x8 is false, verifier should conclude that r2 = 8 as upper 32 bit are known to be zero. However, verifier incorrectly concludes that r2 = 571 which is far off. The problem is it only marks false{true}_reg as known in the switch for JE/NE case, but at the end of the function, it uses {false,true}_{64,32}off to update {false,true}_reg->var_off and they still hold the prior value of {false,true}_reg->var_off before it got marked as known. The subsequent __reg_combine_32_into_64() then propagates this old var_off and derives new bounds. The information between min/max bounds on {false,true}_reg from setting the register to known const combined with the {false,true}_reg->var_off based on the old information then derives wrong register data. Fix it by detangling the BPF_JEQ/BPF_JNE cases and updating relevant {false,true}_{64,32}off tnums along with the register marking to known constant. Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") Reported-by: Kuee K1r0a Signed-off-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20220701124727.11153-1-daniel@iogearbox.net commit 9ee7827668c7c30f587b0101c4e6240672a4f429 Merge: b336ad598a3bb bc621588ff591 Author: Linus Torvalds Date: Fri Jul 1 12:55:28 2022 -0700 Merge tag 'pm-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix some issues in cpufreq drivers and some issues in devfreq: - Fix error code path issues related PROBE_DEFER handling in devfreq (Christian Marangi) - Revert an editing accident in SPDX-License line in the devfreq passive governor (Lukas Bulwahn) - Fix refcount leak in of_get_devfreq_events() in the exynos-ppmu devfreq driver (Miaoqian Lin) - Use HZ_PER_KHZ macro in the passive devfreq governor (Yicong Yang) - Fix missing of_node_put for qoriq and pmac32 driver (Liang He) - Fix issues around throttle interrupt for qcom driver (Stephen Boyd) - Add MT8186 to cpufreq-dt-platdev blocklist (AngeloGioacchino Del Regno) - Make amd-pstate enable CPPC on resume from S3 (Jinzhou Su)" * tag 'pm-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / devfreq: passive: revert an editing accident in SPDX-License line PM / devfreq: Fix kernel warning with cpufreq passive register fail PM / devfreq: Rework freq_table to be local to devfreq struct PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events PM / devfreq: passive: Use HZ_PER_KHZ macro in units.h PM / devfreq: Fix cpufreq passive unregister erroring on PROBE_DEFER PM / devfreq: Mute warning on governor PROBE_DEFER PM / devfreq: Fix kernel panic with cpu based scaling to passive gov cpufreq: Add MT8186 to cpufreq-dt-platdev blocklist cpufreq: pmac32-cpufreq: Fix refcount leak bug cpufreq: qcom-hw: Don't do lmh things without a throttle interrupt drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c cpufreq: amd-pstate: Add resume and suspend callbacks commit bc621588ff591564ea01ad107e7bae869c1c0285 Merge: 589cb2c0b8daf 049b1ed9bef1e Author: Rafael J. Wysocki Date: Fri Jul 1 21:43:08 2022 +0200 Merge branch 'pm-cpufreq' Merge cpufreq fixes for 5.19-rc5, including ARM cpufreq fixes and the following one: - Make amd-pstate enable CPPC on resume from S3 (Jinzhou Su). * pm-cpufreq: cpufreq: Add MT8186 to cpufreq-dt-platdev blocklist cpufreq: pmac32-cpufreq: Fix refcount leak bug cpufreq: qcom-hw: Don't do lmh things without a throttle interrupt drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c cpufreq: amd-pstate: Add resume and suspend callbacks commit b336ad598a3bbeddfdb71d86349b9d4024bddefe Merge: d0f67adb79069 d0e51022a025c Author: Linus Torvalds Date: Fri Jul 1 12:05:27 2022 -0700 Merge tag 'hwmon-for-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix error handling in ibmaem driver initialization - Fix bad data reported by occ driver after setting power cap - Fix typos in pmbus/ucd9200 driver comments * tag 'hwmon-for-v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails hwmon: (pmbus/ucd9200) fix typos in comments hwmon: (occ) Prevent power cap command overwriting poll response commit 887371066039011144b4a94af97d9328df6869a2 Author: Rafael J. Wysocki Date: Thu Jun 30 21:16:41 2022 +0200 PM: runtime: Fix supplier device management during consumer probe Because pm_runtime_get_suppliers() bumps up the rpm_active counter of each device link to a supplier of the given device in addition to bumping up the supplier's PM-runtime usage counter, a runtime suspend of the consumer device may case the latter to go down to 0 when pm_runtime_put_suppliers() is running on a remote CPU. If that happens after pm_runtime_put_suppliers() has released power.lock for the consumer device, and a runtime resume of that device takes place immediately after it, before pm_runtime_put() is called for the supplier, that pm_runtime_put() call may cause the supplier to be suspended even though the consumer is active. To prevent that from happening, modify pm_runtime_get_suppliers() to call pm_runtime_get_sync() for the given device's suppliers without touching the rpm_active counters of the involved device links Accordingly, modify pm_runtime_put_suppliers() to call pm_runtime_put() for the given device's suppliers without looking at the rpm_active counters of the device links at hand. [This is analogous to what happened before commit 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage counter imbalance").] Since pm_runtime_get_suppliers() sets supplier_preactivated for each device link where the supplier's PM-runtime usage counter has been incremented and pm_runtime_put_suppliers() calls pm_runtime_put() for the suppliers whose device links have supplier_preactivated set, the PM-runtime usage counter is balanced for each supplier and this is independent of the runtime suspend and resume of the consumer device. However, in case a device link with DL_FLAG_PM_RUNTIME set is dropped during the consumer device probe, so pm_runtime_get_suppliers() bumps up the supplier's PM-runtime usage counter, but it cannot be dropped by pm_runtime_put_suppliers(), make device_link_release_fn() take care of that. Fixes: 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage counter imbalance") Reported-by: Peter Wang Signed-off-by: Rafael J. Wysocki Reviewed-by: Greg Kroah-Hartman Reviewed-by: Peter Wang Cc: 5.1+ # 5.1+ commit 07358194badf73e267289b40b761f5dc56928eab Author: Rafael J. Wysocki Date: Mon Jun 27 20:42:18 2022 +0200 PM: runtime: Redefine pm_runtime_release_supplier() Instead of passing an extra bool argument to pm_runtime_release_supplier(), make its callers take care of triggering a runtime-suspend of the supplier device as needed. No expected functional impact. Suggested-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki Reviewed-by: Greg Kroah-Hartman Cc: 5.1+ # 5.1+ commit d0e51022a025ca5350fafb8e413a6fe5d4baf833 Author: Yang Yingliang Date: Fri Jul 1 15:41:53 2022 +0800 hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails If platform_device_add() fails, it no need to call platform_device_del(), split platform_device_unregister() into platform_device_del/put(), so platform_device_put() can be called separately. Fixes: 8808a793f052 ("ibmaem: new driver for power/energy/temp meters in IBM System X hardware") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220701074153.4021556-1-yangyingliang@huawei.com Signed-off-by: Guenter Roeck commit d0f67adb790698017030365e90e9e394de7cac7c Merge: cec84e7547d3f 4109823037729 Author: Linus Torvalds Date: Fri Jul 1 11:23:21 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Restore TLB invalidation for the 'break-before-make' rule on contiguous ptes (missed in a recent clean-up)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: hugetlb: Restore TLB invalidation for BBM on contiguous ptes commit cec84e7547d3f95b3fa4ded1618cb43d5d98a76a Merge: 76ff294e16192 d7d488f41b41a Author: Linus Torvalds Date: Fri Jul 1 11:19:14 2022 -0700 Merge tag 's390-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix purgatory build process so bin2c tool does not get built unnecessarily and the Makefile is more consistent with other architectures. - Return earlier simple design of arch_get_random_seed_long|int() and arch_get_random_long|int() callbacks as result of changes in generic RNG code. - Fix minor comment typos and spelling mistakes. * tag 's390-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/qdio: Fix spelling mistake s390/sclp: Fix typo in comments s390/archrandom: simplify back to earlier design and initialize earlier s390/purgatory: remove duplicated build rule of kexec-purgatory.o s390/purgatory: hard-code obj-y in Makefile s390: remove unneeded 'select BUILD_BIN2C' commit 76ff294e161921e9867ad68775ba95a210eb5ec3 Merge: 6f8693ea2bfe8 4f40a5b554461 Author: Linus Torvalds Date: Fri Jul 1 11:11:32 2022 -0700 Merge tag 'nfs-for-5.19-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Allocate a fattr for _nfs4_discover_trunking() - Fix module reference count leak in nfs4_run_state_manager() * tag 'nfs-for-5.19-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4: Add an fattr allocation to _nfs4_discover_trunking() NFS: restore module put when manager exits. commit 6f8693ea2bfe8c10a859841b907bc7c8f41dbd55 Merge: 8300d380309a4 8692969e9164c Author: Linus Torvalds Date: Fri Jul 1 11:06:21 2022 -0700 Merge tag 'ceph-for-5.19-rc5' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A ceph filesystem fix, marked for stable. There appears to be a deeper issue on the MDS side, but for now we are going with this one-liner to avoid busy looping and potential soft lockups" * tag 'ceph-for-5.19-rc5' of https://github.com/ceph/ceph-client: ceph: wait on async create before checking caps for syncfs commit 8300d380309a47b4f960379667278bcfa4d901e1 Merge: 0a35d1622d5cd 617b365872a24 Author: Linus Torvalds Date: Fri Jul 1 10:58:39 2022 -0700 Merge tag 'for-5.19/dm-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: "Three fixes for invalid memory accesses discovered by using KASAN while running the lvm2 testsuite's dm-raid tests. Includes changes to MD's raid5.c given the dependency dm-raid has on the MD code" * tag 'for-5.19/dm-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm raid: fix KASAN warning in raid5_add_disks dm raid: fix KASAN warning in raid5_remove_disk dm raid: fix accesses beyond end of raid member array commit 0a35d1622d5cd7693d75b7124913c75a7e3fabd0 Merge: d516e221e2fb8 09007af2b627f Author: Linus Torvalds Date: Fri Jul 1 10:52:01 2022 -0700 Merge tag 'io_uring-5.19-2022-07-01' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Two minor tweaks: - While we still can, adjust the send/recv based flags to be in ->ioprio rather than in ->addr2. This is consistent with eg accept, and also doesn't waste a full 64-bit field for flags (Pavel) - 5.18-stable fix for re-importing provided buffers. Not much real world relevance here as it'll only impact non-pollable files gone async, which is more of a practical test case rather than something that is used in the wild (Dylan)" * tag 'io_uring-5.19-2022-07-01' of git://git.kernel.dk/linux-block: io_uring: fix provided buffer import io_uring: keep sendrecv flags in ioprio commit d516e221e2fb88cd31c7ea29d743045efc4e69dd Merge: 067c227379c0e f3163d8567adb Author: Linus Torvalds Date: Fri Jul 1 10:42:10 2022 -0700 Merge tag 'block-5.19-2022-07-01' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Fix for batch getting of tags in sbitmap (wuchi) - NVMe pull request via Christoph: - More quirks (Lamarque Vieira Souza, Pablo Greco) - Fix a fabrics disconnect regression (Ruozhu Li) - Fix a nvmet-tcp data_digest calculation regression (Sagi Grimberg) - Fix nvme-tcp send failure handling (Sagi Grimberg) - Fix a regression with nvmet-loop and passthrough controllers (Alan Adamson) * tag 'block-5.19-2022-07-01' of git://git.kernel.dk/linux-block: nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1 nvmet: add a clear_ids attribute for passthru targets nvme: fix regression when disconnect a recovering ctrl nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G) nvme-tcp: always fail a request when sending it failed nvmet-tcp: fix regression in data_digest calculation lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() commit 067c227379c0ec96cb19ed9aacea6b1281982368 Merge: 690685ffcdcec fce54ed027577 Author: Linus Torvalds Date: Fri Jul 1 10:38:17 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "One simple driver fix for a dma overrun" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hisi_sas: Limit max hw sectors for v3 HW commit 690685ffcdcec3975f45eafe3dcf4bff29aa1676 Merge: 9650910d05a31 32788beb103f7 Author: Linus Torvalds Date: Fri Jul 1 10:31:44 2022 -0700 Merge tag 'ata-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fix from Damien Le Moal: - Fix a compilation warning with some versions of gcc/sparse when compiling the pata_cs5535 driver, from John. * tag 'ata-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_cs5535: Fix W=1 warnings commit 410982303772993a86bb7a9cfa7ece34522b2636 Author: Will Deacon Date: Wed Jun 29 10:53:49 2022 +0100 arm64: hugetlb: Restore TLB invalidation for BBM on contiguous ptes Commit fb396bb459c1 ("arm64/hugetlb: Drop TLB flush from get_clear_flush()") removed TLB invalidation from get_clear_flush() [now get_clear_contig()] on the basis that the core TLB invalidation code is aware of hugetlb mappings backed by contiguous page-table entries and will cover the correct virtual address range. However, this change also resulted in the TLB invalidation being removed from the "break" step in the break-before-make (BBM) sequence used internally by huge_ptep_set_{access_flags,wrprotect}(), therefore making the BBM sequence unsafe irrespective of later invalidation. Although the architecture is desperately unclear about how exactly contiguous ptes should be updated in a live page-table, restore TLB invalidation to our BBM sequence under the assumption that BBM is the right thing to be doing in the first place. Fixes: fb396bb459c1 ("arm64/hugetlb: Drop TLB flush from get_clear_flush()") Cc: Ard Biesheuvel Cc: Steve Capper Cc: Anshuman Khandual Cc: Mike Kravetz Cc: Marc Zyngier Signed-off-by: Will Deacon Reviewed-by: Catalin Marinas Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20220629095349.25748-1-will@kernel.org Signed-off-by: Catalin Marinas commit 9650910d05a31d62f562f90ca15ece685a4c1b9c Merge: a175eca0f3d74 a79e69c8714f4 Author: Linus Torvalds Date: Fri Jul 1 10:01:32 2022 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Two small fixes - Initialize a spinlock in the stm32 reset code - Add dt bindings to the clk maintainer filepattern" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: MAINTAINERS: add include/dt-bindings/clock to COMMON CLK FRAMEWORK clk: stm32: rcc_reset: Fix missing spin_lock_init() commit 09f7b80fac3e588b282ad26aabd7336d7d293efd Author: Sascha Hauer Date: Fri Jun 17 13:50:42 2022 +0200 dmaengine: imx-sdma: only restart cyclic channel when enabled An interrupt for a channel might be pending even after struct dma_device::device_terminate_all has been called. In that case the recently introduced warning message "restart cyclic channel..." triggers and the channel will be restarted. This is not desired as the channel has just been stopped. Only restart the channel when we still have a descriptor set for it (which will be set to NULL in sdma_terminate_all()). Fixes: 5b215c28b9235 ("dmaengine: imx-sdma: restart cyclic channel if needed") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer Link: https://lore.kernel.org/r/20220617115042.4004062-1-s.hauer@pengutronix.de Signed-off-by: Vinod Koul commit 7561cea5dbb97fecb952548a0fb74fb105bf4664 Author: Darrick J. Wong Date: Fri Jul 1 09:08:33 2022 -0700 xfs: prevent a UAF when log IO errors race with unmount KASAN reported the following use after free bug when running generic/475: XFS (dm-0): Mounting V5 Filesystem XFS (dm-0): Starting recovery (logdev: internal) XFS (dm-0): Ending recovery (logdev: internal) Buffer I/O error on dev dm-0, logical block 20639616, async page read Buffer I/O error on dev dm-0, logical block 20639617, async page read XFS (dm-0): log I/O error -5 XFS (dm-0): Filesystem has been shut down due to log error (0x2). XFS (dm-0): Unmounting Filesystem XFS (dm-0): Please unmount the filesystem and rectify the problem(s). ================================================================== BUG: KASAN: use-after-free in do_raw_spin_lock+0x246/0x270 Read of size 4 at addr ffff888109dd84c4 by task 3:1H/136 CPU: 3 PID: 136 Comm: 3:1H Not tainted 5.19.0-rc4-xfsx #rc4 8e53ab5ad0fddeb31cee5e7063ff9c361915a9c4 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: xfs-log/dm-0 xlog_ioend_work [xfs] Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x2b8/0x661 ? do_raw_spin_lock+0x246/0x270 kasan_report+0xab/0x120 ? do_raw_spin_lock+0x246/0x270 do_raw_spin_lock+0x246/0x270 ? rwlock_bug.part.0+0x90/0x90 xlog_force_shutdown+0xf6/0x370 [xfs 4ad76ae0d6add7e8183a553e624c31e9ed567318] xlog_ioend_work+0x100/0x190 [xfs 4ad76ae0d6add7e8183a553e624c31e9ed567318] process_one_work+0x672/0x1040 worker_thread+0x59b/0xec0 ? __kthread_parkme+0xc6/0x1f0 ? process_one_work+0x1040/0x1040 ? process_one_work+0x1040/0x1040 kthread+0x29e/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Allocated by task 154099: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 kmem_alloc+0x8d/0x2e0 [xfs] xlog_cil_init+0x1f/0x540 [xfs] xlog_alloc_log+0xd1e/0x1260 [xfs] xfs_log_mount+0xba/0x640 [xfs] xfs_mountfs+0xf2b/0x1d00 [xfs] xfs_fs_fill_super+0x10af/0x1910 [xfs] get_tree_bdev+0x383/0x670 vfs_get_tree+0x7d/0x240 path_mount+0xdb7/0x1890 __x64_sys_mount+0x1fa/0x270 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 154151: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x110/0x190 slab_free_freelist_hook+0xab/0x180 kfree+0xbc/0x310 xlog_dealloc_log+0x1b/0x2b0 [xfs] xfs_unmountfs+0x119/0x200 [xfs] xfs_fs_put_super+0x6e/0x2e0 [xfs] generic_shutdown_super+0x12b/0x3a0 kill_block_super+0x95/0xd0 deactivate_locked_super+0x80/0x130 cleanup_mnt+0x329/0x4d0 task_work_run+0xc5/0x160 exit_to_user_mode_prepare+0xd4/0xe0 syscall_exit_to_user_mode+0x1d/0x40 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This appears to be a race between the unmount process, which frees the CIL and waits for in-flight iclog IO; and the iclog IO completion. When generic/475 runs, it starts fsstress in the background, waits a few seconds, and substitutes a dm-error device to simulate a disk falling out of a machine. If the fsstress encounters EIO on a pure data write, it will exit but the filesystem will still be online. The next thing the test does is unmount the filesystem, which tries to clean the log, free the CIL, and wait for iclog IO completion. If an iclog was being written when the dm-error switch occurred, it can race with log unmounting as follows: Thread 1 Thread 2 xfs_log_unmount xfs_log_clean xfs_log_quiesce xlog_ioend_work xlog_force_shutdown test_and_set_bit(XLOG_IOERROR) xfs_log_force xfs_log_umount_write xlog_dealloc_log xlog_cil_destroy spin_lock(&log->l_cilp->xc_push_lock) Therefore, free the CIL after waiting for the iclogs to complete. I /think/ this race has existed for quite a few years now, though I don't remember the ~2014 era logging code well enough to know if it was a real threat then or if the actual race was exposed only more recently. Fixes: ac983517ec59 ("xfs: don't sleep in xlog_cil_force_lsn on shutdown") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 1357d2a65601bc0afb221672d5a8f1649063a141 Author: Wei Yongjun Date: Sat Jun 18 07:28:24 2022 +0000 irqchip/apple-aic: Make symbol 'use_fast_ipi' static The sparse tool complains as follows: drivers/irqchip/irq-apple-aic.c:231:1: warning: symbol 'use_fast_ipi' was not declared. Should it be static? This symbol is not used outside of irq-apple-aic.c, so marks it static. Fixes: 2cf68211664a ("irqchip/apple-aic: Add Fast IPI support") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Reviewed-by: Hector Martin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220618072824.562350-1-weiyongjun1@huawei.com commit fd31000d58f41588fa10128278efdab8474f5ce8 Author: Jamie Iles Date: Thu Jun 30 12:10:08 2022 +0100 irqchip/xilinx: Add explicit dependency on OF_ADDRESS Commit b84dc7f0e364 ("irqchip/xilinx: Remove microblaze+zynq dependency") relaxed the dependencies on the Xilinx interrupt controller to be OF only, but some OF architectures (s390 for example) do not support OF_ADDRESS and so a build of the driver will result in undefined references to of_iomap/iounmap and friends. Fixes: b84dc7f0e364 ("irqchip/xilinx: Remove microblaze+zynq dependency") Reported-by: kernel test robot Signed-off-by: Jamie Iles Acked-by: Michal Simek Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220630111008.3838307-1-jamie@jamieiles.com commit 1f66f63c7312ee085dc989b3c5fa4b3d09fe9d52 Merge: a38dbb4f2028f 8630354f42bef Author: Arnd Bergmann Date: Fri Jul 1 15:15:21 2022 +0200 Merge tag 'imx-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.19, round 2: - Fix the SDIO description for imx7d-smegw01 board to ensure there is no communication made at 1.8V. - Fix pgc_ispdwp power-domain clock, which should be IMX8MP_CLK_MEDIA_ISP_ROOT. - Re-enable framebuffer support in mxs_defconfig to fix a Kconfig regression. - A series from Peng Fan (and Sherry Sun) fixing various pads on i.MX8MP based boards to leave reserved bits untouched. * tag 'imx-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mp-icore-mx8mp-edim2.2: correct pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings arm64: dts: imx8mp-venice-gw74xx: correct pad settings arm64: dts: imx8mp-evk: correct I2C3 pad settings arm64: dts: imx8mp-evk: correct I2C1 pad settings arm64: dts: imx8mp-evk: correct I2C5 pad settings arm64: dts: imx8mp-evk: correct vbus pad settings arm64: dts: imx8mp-evk: correct eqos pad settings arm64: dts: imx8mp-evk: correct vbus pad settings arm64: dts: imx8mp-evk: correct gpio-led pad settings arm64: dts: imx8mp-evk: correct the uart2 pinctl value arm64: dts: imx8mp-evk: correct mmc pad settings ARM: mxs_defconfig: Enable the framebuffer arm64: dts: imx8mp: correct clock of pgc_ispdwp ARM: dts: imx7d-smegw01: Fix the SDIO description Link: https://lore.kernel.org/r/20220629021244.GL819983@dragon Signed-off-by: Arnd Bergmann commit a38dbb4f2028f4b9418855239a4c82466ecb935b Merge: 620f83b8326ce 91d60e259c0f5 Author: Arnd Bergmann Date: Fri Jul 1 15:15:07 2022 +0200 Merge tag 'at91-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 5.19 It contains 3 SoC fixes and 2 DT fixes: SoC: - fix the wakeup from RTC and RTT for ULP1 mode - fix section mismatch warning - fix SAM9X60 SiP detection DT: - fixes the EEPROMs compatibles for sama5d2_icp and sam9x60ek and EEPROM size for sam9x60ek * tag 'at91-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: pm: Mark at91_pm_secure_init as __init ARM: at91: fix soc detection for SAM9X60 SiPs ARM: dts: at91: sama5d2_icp: fix eeprom compatibles ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt ARM: at91: pm: use proper compatible for sama5d2's rtc Link: https://lore.kernel.org/r/20220628135130.3114878-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 620f83b8326ce9706b1118334f0257ae028ce045 Author: Linus Walleij Date: Sun Jun 26 09:43:15 2022 +0200 soc: ixp4xx/npe: Fix unused match warning The kernel test robot found this inconsistency: drivers/soc/ixp4xx/ixp4xx-npe.c:737:34: warning: 'ixp4xx_npe_of_match' defined but not used [-Wunused-const-variable=] 737 | static const struct of_device_id ixp4xx_npe_of_match[] = { This is because the match is enclosed in the of_match_ptr() which compiles into NULL when OF is disabled and this is unnecessary. Fix it by dropping of_match_ptr() around the match. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220626074315.61209-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit 8dfeee9dc52cb979cf520f6b345e7baa6b29ecb4 Author: Li kunyu Date: Fri Jul 1 14:47:23 2022 +0800 net: usb: Fix typo in code Remove the repeated ';' from code. Signed-off-by: Li kunyu Signed-off-by: David S. Miller commit 49db68d45bdcad06e28a420d5d911e4178389666 Author: Emil Renner Berthing Date: Mon Jun 27 11:09:39 2022 +0200 dmaengine: dw-axi-dmac: Fix RMW on channel suspend register When the DMA is configured for more than 8 channels the bits controlling suspend moves to another register. However when adding support for this the new register would be completely overwritten in one case and overwritten with values from the old register in another case. Found by comparing the parallel implementation of more than 8 channel support for the StarFive JH7100 SoC by Samin. Fixes: 824351668a41 ("dmaengine: dw-axi-dmac: support DMAX_NUM_CHANNELS > 8") Co-developed-by: Samin Guo Signed-off-by: Samin Guo Signed-off-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20220627090939.1775717-1-emil.renner.berthing@canonical.com Signed-off-by: Vinod Koul commit 44c4237cf3436bda2b185ff728123651ad133f69 Author: Dave Jiang Date: Tue Jun 28 16:00:56 2022 -0700 dmaengine: idxd: force wq context cleanup on device disable path Testing shown that when a wq mode is setup to be dedicated and then torn down and reconfigured to shared, the wq configured end up being dedicated anyays. The root cause is when idxd_device_wqs_clear_state() gets called during idxd_driver removal, idxd_wq_disable_cleanup() does not get called vs when the wq driver is removed first. The check of wq state being "enabled" causes the cleanup to be bypassed. However, idxd_driver->remove() releases all wq drivers. So the wqs goes to "disabled" state and will never be "enabled". By that point, the driver has no idea if the wq was previously configured or clean. So force call idxd_wq_disable_cleanup() on all wqs always to make sure everything gets cleaned up. Reported-by: Tony Zhu Tested-by: Tony Zhu Fixes: 0dcfe41e9a4c ("dmanegine: idxd: cleanup all device related bits after disabling device") Signed-off-by: Dave Jiang Co-developed-by: Fenghua Yu Signed-off-by: Fenghua Yu Link: https://lore.kernel.org/r/20220628230056.2527816-1-fenghua.yu@intel.com Signed-off-by: Vinod Koul commit 0ac9c3dd0d6fe293cd5044cfad10bec27d171e4e Author: Caleb Connolly Date: Wed Jun 29 15:06:00 2022 +0100 dmaengine: qcom: bam_dma: fix runtime PM underflow Commit dbad41e7bb5f ("dmaengine: qcom: bam_dma: check if the runtime pm enabled") caused unbalanced pm_runtime_get/put() calls when the bam is controlled remotely. This commit reverts it and just enables pm_runtime in all cases, the clk_* functions already just nop when the clock is NULL. Also clean up a bit by removing unnecessary bamclk null checks. Suggested-by: Stephan Gerhold Fixes: dbad41e7bb5f ("dmaengine: qcom: bam_dma: check if the runtime pm enabled") Signed-off-by: Caleb Connolly Link: https://lore.kernel.org/r/20220629140559.118537-1-caleb.connolly@linaro.org Signed-off-by: Vinod Koul commit 71560d98e7f18eb316a17cf12dc139eacb5b490f Merge: 5e8379351dbde fed0d9f13266a Author: David S. Miller Date: Fri Jul 1 11:25:20 2022 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-06-30 This series contains updates to i40e driver only. Lukasz adds reporting of packets dropped for being too large into the Rx dropped statistics. Norbert clears VF filter and MAC address to resolve issue with older VFs being unable to change their MAC address. ==================== Signed-off-by: David S. Miller commit 7e09ac27f43b382f5fe9bb7c7f4c465ece1f8a23 Author: Juergen Gross Date: Thu Jun 30 09:14:41 2022 +0200 x86: Fix .brk attribute in linker script Commit in Fixes added the "NOLOAD" attribute to the .brk section as a "failsafe" measure. Unfortunately, this leads to the linker no longer covering the .brk section in a program header, resulting in the kernel loader not knowing that the memory for the .brk section must be reserved. This has led to crashes when loading the kernel as PV dom0 under Xen, but other scenarios could be hit by the same problem (e.g. in case an uncompressed kernel is used and the initrd is placed directly behind it). So drop the "NOLOAD" attribute. This has been verified to correctly cover the .brk section by a program header of the resulting ELF file. Fixes: e32683c6f7d2 ("x86/mm: Fix RESERVE_BRK() for older binutils") Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20220630071441.28576-4-jgross@suse.com commit 38fa5479b41376dc9d7f57e71c83514285a25ca0 Author: Juergen Gross Date: Thu Jun 30 09:14:40 2022 +0200 x86: Clear .brk area at early boot The .brk section has the same properties as .bss: it is an alloc-only section and should be cleared before being used. Not doing so is especially a problem for Xen PV guests, as the hypervisor will validate page tables (check for writable page tables and hypervisor private bits) before accepting them to be used. Make sure .brk is initially zero by letting clear_bss() clear the brk area, too. Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220630071441.28576-3-jgross@suse.com commit 96e8fc5818686d4a1591bb6907e7fdb64ef29884 Author: Juergen Gross Date: Thu Jun 30 09:14:39 2022 +0200 x86/xen: Use clear_bss() for Xen PV guests Instead of clearing the bss area in assembly code, use the clear_bss() function. This requires to pass the start_info address as parameter to xen_start_kernel() in order to avoid the xen_start_info being zeroed again. Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Reviewed-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220630071441.28576-2-jgross@suse.com commit 144248515246e52a3706de1ee928af29a63794b8 Author: Hans de Goede Date: Thu Jun 23 13:27:10 2022 +0200 drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Tablet 2 830 The Lenovo Yoga Tablet 2 830F / 830L use a panel which has been mounted 90 degrees rotated. Add a quirk for this. Signed-off-by: Hans de Goede Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220623112710.15693-1-hdegoede@redhat.com commit b75cd218274e01d026dc5240e86fdeb44bbed0c8 Author: Oleksandr Tyshchenko Date: Fri Jul 1 08:57:44 2022 +0200 xen/arm: Fix race in RB-tree based P2M accounting During the PV driver life cycle the mappings are added to the RB-tree by set_foreign_p2m_mapping(), which is called from gnttab_map_refs() and are removed by clear_foreign_p2m_mapping() which is called from gnttab_unmap_refs(). As both functions end up calling __set_phys_to_machine_multi() which updates the RB-tree, this function can be called concurrently. There is already a "p2m_lock" to protect against concurrent accesses, but the problem is that the first read of "phys_to_mach.rb_node" in __set_phys_to_machine_multi() is not covered by it, so this might lead to the incorrect mappings update (removing in our case) in RB-tree. In my environment the related issue happens rarely and only when PV net backend is running, the xen_add_phys_to_mach_entry() claims that it cannot add new pfn <-> mfn mapping to the tree since it is already exists which results in a failure when mapping foreign pages. But there might be other bad consequences related to the non-protected root reads such use-after-free, etc. While at it, also fix the similar usage in __pfn_to_mfn(), so initialize "struct rb_node *n" with the "p2m_lock" held in both functions to avoid possible bad consequences. This is CVE-2022-33744 / XSA-406. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross commit f63c2c2032c2e3caad9add3b82cc6e91c376fd26 Author: Jan Beulich Date: Fri Jul 1 08:56:52 2022 +0200 xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() The commit referenced below moved the invocation past the "next" label, without any explanation. In fact this allows misbehaving backends undue control over the domain the frontend runs in, as earlier detected errors require the skb to not be freed (it may be retained for later processing via xennet_move_rx_slot(), or it may simply be unsafe to have it freed). This is CVE-2022-33743 / XSA-405. Fixes: 6c5aa6fc4def ("xen networking: add basic XDP support for xen-netfront") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 2400617da7eebf9167d71a46122828bc479d64c9 Author: Roger Pau Monne Date: Thu Apr 7 13:04:24 2022 +0200 xen/blkfront: force data bouncing when backend is untrusted Split the current bounce buffering logic used with persistent grants into it's own option, and allow enabling it independently of persistent grants. This allows to reuse the same code paths to perform the bounce buffering required to avoid leaking contiguous data in shared pages not part of the request fragments. Reporting whether the backend is to be trusted can be done using a module parameter, or from the xenstore frontend path as set by the toolstack when adding the device. This is CVE-2022-33742, part of XSA-403. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 4491001c2e0fa69efbb748c96ec96b100a5cdb7e Author: Roger Pau Monne Date: Thu Apr 7 12:20:06 2022 +0200 xen/netfront: force data bouncing when backend is untrusted Bounce all data on the skbs to be transmitted into zeroed pages if the backend is untrusted. This avoids leaking data present in the pages shared with the backend but not part of the skb fragments. This requires introducing a new helper in order to allocate skbs with a size multiple of XEN_PAGE_SIZE so we don't leak contiguous data on the granted pages. Reporting whether the backend is to be trusted can be done using a module parameter, or from the xenstore frontend path as set by the toolstack when adding the device. This is CVE-2022-33741, part of XSA-403. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 307c8de2b02344805ebead3440d8feed28f2f010 Author: Roger Pau Monne Date: Wed Apr 6 17:38:04 2022 +0200 xen/netfront: fix leaking data in shared pages When allocating pages to be used for shared communication with the backend always zero them, this avoids leaking unintended data present on the pages. This is CVE-2022-33740, part of XSA-403. Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit ee6c6e7342471d468096a16bee9f89b5a6c1e39d Author: Davidlohr Bueso Date: Wed Jun 29 09:52:25 2022 -0700 staging/wlan-ng: get the correct struct hfa384x in work callback hfa384x_usbctlx_completion_task() is bogusly using the reaper BH when in fact this is the completion_bh. This was reflected when trying to acquire the hw->ctlxq.lock and getting a failed lockdep class initialized to it. Fixes: 9442e81d7e7c ("staging/wlan-ng, prism2usb: replace completion_bh tasklet with work") Reported-by: syzbot+ce3408364c4a234dd90c@syzkaller.appspotmail.com Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20220629165225.3436822-1-dave@stgolabs.net Signed-off-by: Greg Kroah-Hartman commit 3776c78559853fd151be7c41e369fd076fb679d5 Author: Shuah Khan Date: Thu Jun 30 20:32:56 2022 -0600 misc: rtsx_usb: use separate command and response buffers rtsx_usb uses same buffer for command and response. There could be a potential conflict using the same buffer for both especially if retries and timeouts are involved. Use separate command and response buffers to avoid conflicts. Signed-off-by: Shuah Khan Cc: stable Link: https://lore.kernel.org/r/07e3721804ff07aaab9ef5b39a5691d0718b9ade.1656642167.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit eb7f8e28420372787933eec079735c35034bda7d Author: Shuah Khan Date: Thu Jun 30 20:32:55 2022 -0600 misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer rtsx_usb driver allocates coherent dma buffer for urb transfers. This buffer is passed to usb_bulk_msg() and usb core tries to map already mapped buffer running into a dma mapping error. xhci_hcd 0000:01:00.0: rejecting DMA map of vmalloc memory WARNING: CPU: 1 PID: 279 at include/linux/dma-mapping.h:326 usb_ hcd_map_urb_for_dma+0x7d6/0x820 ... xhci_map_urb_for_dma+0x291/0x4e0 usb_hcd_submit_urb+0x199/0x12b0 ... usb_submit_urb+0x3b8/0x9e0 usb_start_wait_urb+0xe3/0x2d0 usb_bulk_msg+0x115/0x240 rtsx_usb_transfer_data+0x185/0x1a8 [rtsx_usb] rtsx_usb_send_cmd+0xbb/0x123 [rtsx_usb] rtsx_usb_write_register+0x12c/0x143 [rtsx_usb] rtsx_usb_probe+0x226/0x4b2 [rtsx_usb] Fix it to use kmalloc() to get DMA-able memory region instead. Signed-off-by: Shuah Khan Cc: stable Link: https://lore.kernel.org/r/667d627d502e1ba9ff4f9b94966df3299d2d3c0d.1656642167.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 2f446ffe9d737e9a844b97887919c4fda18246e7 Author: Roger Pau Monne Date: Fri Jul 1 08:23:54 2022 +0200 xen/blkfront: fix leaking data in shared pages When allocating pages to be used for shared communication with the backend always zero them, this avoids leaking unintended data present on the pages. This is CVE-2022-26365, part of XSA-403. Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 03110b46c99bb0c712f46bec660b1c3f674ce100 Author: Luca Weiss Date: Mon Jun 6 18:04:21 2022 +0200 ARM: dts: qcom: msm8974: re-add missing pinctrl As part of a recent cleanup commit, the pinctrl for a few uart and i2c nodes was removed. Adjust the names and/or add it back and assign it to the uart and i2c nodes. Fixes: 1dfe967ec7cf ("ARM: dts: qcom-msm8974*: Consolidate I2C/UART/SDHCI") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220606160421.1641778-1-luca@z3ntu.xyz commit a175eca0f3d747599f1fdfac04cc9195b71ec996 Merge: 5e8379351dbde b8f0009bc9edf Author: Linus Torvalds Date: Thu Jun 30 17:19:19 2022 -0700 Merge tag 'drm-fixes-2022-07-01' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Bit quieter this week, the main thing is it pulls in the fixes for the sysfb resource issue you were seeing. these had been queued for next so should have had some decent testing. Otherwise amdgpu, i915 and msm each have a few fixes, and vc4 has one. fbdev: - sysfb fixes/conflicting fb fixes amdgpu: - GPU recovery fix - Fix integer type usage in fourcc header for AMD modifiers - KFD TLB flush fix for gfx9 APUs - Display fix i915: - Fix ioctl argument error return - Fix d3cold disable to allow PCI upstream bridge D3 transition - Fix setting cache_dirty for dma-buf objects on discrete msm: - Fix to increment vsync_cnt before calling drm_crtc_handle_vblank so that userspace sees the value *after* it is incremented if waiting for vblank events - Fix to reset drm_dev to NULL in dp_display_unbind to avoid a crash in probe/bind error paths - Fix to resolve the smatch error of de-referencing before NULL check in dpu_encoder_phys_wb.c - Fix error return to userspace if fence-id allocation fails in submit ioctl vc4: - NULL ptr dereference fix" * tag 'drm-fixes-2022-07-01' of git://anongit.freedesktop.org/drm/drm: Revert "drm/amdgpu/display: set vblank_disable_immediate for DC" drm/amdgpu: To flush tlb for MMHUB of RAVEN series drm/fourcc: fix integer type usage in uapi header drm/amdgpu: fix adev variable used in amdgpu_device_gpu_recover() fbdev: Disable sysfb device registration when removing conflicting FBs firmware: sysfb: Add sysfb_disable() helper function firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer drm/msm/gem: Fix error return on fence id alloc fail drm/i915: tweak the ordering in cpu_write_needs_clflush drm/i915/dgfx: Disable d3cold at gfx root port drm/i915/gem: add missing else drm/vc4: perfmon: Fix variable dereferenced before check drm/msm/dpu: Fix variable dereferenced before check drm/msm/dp: reset drm_dev to NULL at dp_display_unbind() drm/msm/dpu: Increment vsync_cnt before waking up userspace commit b8f0009bc9edf9186b20ae2a9e442ef0af93040e Merge: 078a3be79325e ee7a69aa38d87 Author: Dave Airlie Date: Fri Jul 1 09:27:28 2022 +1000 Merge tag 'drm-misc-fixes-2022-06-30' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A NULL pointer dereference fix for vc4, and 3 patches to improve the sysfb device behaviour when removing conflicting framebuffers Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220630072404.2fa4z3nk5h5q34ci@houat commit 5e8379351dbde61ea383e514f0f9ecb2c047cf4e Merge: 868f9f2f8e004 58bf4db695287 Author: Linus Torvalds Date: Thu Jun 30 15:26:55 2022 -0700 Merge tag 'net-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Current release - new code bugs: - clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user() - mptcp: - invoke MP_FAIL response only when needed - fix shutdown vs fallback race - consistent map handling on failure - octeon_ep: use bitwise AND Previous releases - regressions: - tipc: move bc link creation back to tipc_node_create, fix NPD Previous releases - always broken: - tcp: add a missing nf_reset_ct() in 3WHS handling to prevent socket buffered skbs from keeping refcount on the conntrack module - ipv6: take care of disable_policy when restoring routes - tun: make sure to always disable and unlink NAPI instances - phy: don't trigger state machine while in suspend - netfilter: nf_tables: avoid skb access on nf_stolen - asix: fix "can't send until first packet is send" issue - usb: asix: do not force pause frames support - nxp-nci: don't issue a zero length i2c_master_read() Misc: - ncsi: allow use of proper "mellanox" DT vendor prefix - act_api: add a message for user space if any actions were already flushed before the error was hit" * tag 'net-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits) net: dsa: felix: fix race between reading PSFP stats and port stats selftest: tun: add test for NAPI dismantle net: tun: avoid disabling NAPI twice net: sparx5: mdb add/del handle non-sparx5 devices net: sfp: fix memory leak in sfp_probe() mlxsw: spectrum_router: Fix rollback in tunnel next hop init net: rose: fix UAF bugs caused by timer handler net: usb: ax88179_178a: Fix packet receiving net: bonding: fix use-after-free after 802.3ad slave unbind ipv6: fix lockdep splat in in6_dump_addrs() net: phy: ax88772a: fix lost pause advertisement configuration net: phy: Don't trigger state machine while in suspend usbnet: fix memory allocation in helpers selftests net: fix kselftest net fatal error NFC: nxp-nci: don't print header length mismatch on i2c error NFC: nxp-nci: Don't issue a zero length i2c_master_read() net: tipc: fix possible refcount leak in tipc_sk_create() nfc: nfcmrvl: Fix irq_of_parse_and_map() return value net: ipv6: unexport __init-annotated seg6_hmac_net_init() ipv6/sit: fix ipip6_tunnel_get_prl return value ... commit 868f9f2f8e004bfe0d3935b1976f625b2924893b Author: Amir Goldstein Date: Thu Jun 30 22:58:49 2022 +0300 vfs: fix copy_file_range() regression in cross-fs copies A regression has been reported by Nicolas Boichat, found while using the copy_file_range syscall to copy a tracefs file. Before commit 5dae222a5ff0 ("vfs: allow copy_file_range to copy across devices") the kernel would return -EXDEV to userspace when trying to copy a file across different filesystems. After this commit, the syscall doesn't fail anymore and instead returns zero (zero bytes copied), as this file's content is generated on-the-fly and thus reports a size of zero. Another regression has been reported by He Zhe - the assertion of WARN_ON_ONCE(ret == -EOPNOTSUPP) can be triggered from userspace when copying from a sysfs file whose read operation may return -EOPNOTSUPP. Since we do not have test coverage for copy_file_range() between any two types of filesystems, the best way to avoid these sort of issues in the future is for the kernel to be more picky about filesystems that are allowed to do copy_file_range(). This patch restores some cross-filesystem copy restrictions that existed prior to commit 5dae222a5ff0 ("vfs: allow copy_file_range to copy across devices"), namely, cross-sb copy is not allowed for filesystems that do not implement ->copy_file_range(). Filesystems that do implement ->copy_file_range() have full control of the result - if this method returns an error, the error is returned to the user. Before this change this was only true for fs that did not implement the ->remap_file_range() operation (i.e. nfsv3). Filesystems that do not implement ->copy_file_range() still fall-back to the generic_copy_file_range() implementation when the copy is within the same sb. This helps the kernel can maintain a more consistent story about which filesystems support copy_file_range(). nfsd and ksmbd servers are modified to fall-back to the generic_copy_file_range() implementation in case vfs_copy_file_range() fails with -EOPNOTSUPP or -EXDEV, which preserves behavior of server-side-copy. fall-back to generic_copy_file_range() is not implemented for the smb operation FSCTL_DUPLICATE_EXTENTS_TO_FILE, which is arguably a correct change of behavior. Fixes: 5dae222a5ff0 ("vfs: allow copy_file_range to copy across devices") Link: https://lore.kernel.org/linux-fsdevel/20210212044405.4120619-1-drinkcat@chromium.org/ Link: https://lore.kernel.org/linux-fsdevel/CANMq1KDZuxir2LM5jOTm0xx+BnvW=ZmpsG47CyHFJwnw7zSX6Q@mail.gmail.com/ Link: https://lore.kernel.org/linux-fsdevel/20210126135012.1.If45b7cdc3ff707bc1efa17f5366057d60603c45f@changeid/ Link: https://lore.kernel.org/linux-fsdevel/20210630161320.29006-1-lhenriques@suse.de/ Reported-by: Nicolas Boichat Reported-by: kernel test robot Signed-off-by: Luis Henriques Fixes: 64bf5ff58dff ("vfs: no fallback for ->copy_file_range") Link: https://lore.kernel.org/linux-fsdevel/20f17f64-88cb-4e80-07c1-85cb96c83619@windriver.com/ Reported-by: He Zhe Tested-by: Namjae Jeon Tested-by: Luis Henriques Signed-off-by: Amir Goldstein Signed-off-by: Linus Torvalds commit a23dd544debcda4ee4a549ec7de59e85c3c8345c Author: Chuck Lever Date: Thu Jun 30 16:48:18 2022 -0400 SUNRPC: Fix READ_PLUS crasher Looks like there are still cases when "space_left - frag1bytes" can legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains within the current encode buffer. Reported-by: Bruce Fields Reported-by: Zorro Lang Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151 Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()") Signed-off-by: Chuck Lever commit 4f40a5b5544618b096d1611a18219dd91fd57f80 Author: Scott Mayhew Date: Mon Jun 27 17:31:29 2022 -0400 NFSv4: Add an fattr allocation to _nfs4_discover_trunking() This was missed in c3ed222745d9 ("NFSv4: Fix free of uninitialized nfs4_label on referral lookup.") and causes a panic when mounting with '-o trunkdiscovery': PID: 1604 TASK: ffff93dac3520000 CPU: 3 COMMAND: "mount.nfs" #0 [ffffb79140f738f8] machine_kexec at ffffffffaec64bee #1 [ffffb79140f73950] __crash_kexec at ffffffffaeda67fd #2 [ffffb79140f73a18] crash_kexec at ffffffffaeda76ed #3 [ffffb79140f73a30] oops_end at ffffffffaec2658d #4 [ffffb79140f73a50] general_protection at ffffffffaf60111e [exception RIP: nfs_fattr_init+0x5] RIP: ffffffffc0c18265 RSP: ffffb79140f73b08 RFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff93dac304a800 RCX: 0000000000000000 RDX: ffffb79140f73bb0 RSI: ffff93dadc8cbb40 RDI: d03ee11cfaf6bd50 RBP: ffffb79140f73be8 R8: ffffffffc0691560 R9: 0000000000000006 R10: ffff93db3ffd3df8 R11: 0000000000000000 R12: ffff93dac4040000 R13: ffff93dac2848e00 R14: ffffb79140f73b60 R15: ffffb79140f73b30 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffb79140f73b08] _nfs41_proc_get_locations at ffffffffc0c73d53 [nfsv4] #6 [ffffb79140f73bf0] nfs4_proc_get_locations at ffffffffc0c83e90 [nfsv4] #7 [ffffb79140f73c60] nfs4_discover_trunking at ffffffffc0c83fb7 [nfsv4] #8 [ffffb79140f73cd8] nfs_probe_fsinfo at ffffffffc0c0f95f [nfs] #9 [ffffb79140f73da0] nfs_probe_server at ffffffffc0c1026a [nfs] RIP: 00007f6254fce26e RSP: 00007ffc69496ac8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6254fce26e RDX: 00005600220a82a0 RSI: 00005600220a64d0 RDI: 00005600220a6520 RBP: 00007ffc69496c50 R8: 00005600220a8710 R9: 003035322e323231 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc69496c50 R13: 00005600220a8440 R14: 0000000000000010 R15: 0000560020650ef9 ORIG_RAX: 00000000000000a5 CS: 0033 SS: 002b Fixes: c3ed222745d9 ("NFSv4: Fix free of uninitialized nfs4_label on referral lookup.") Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit 080abad71e99d2becf38c978572982130b927a28 Author: NeilBrown Date: Thu Jun 23 14:47:34 2022 +1000 NFS: restore module put when manager exits. Commit f49169c97fce ("NFSD: Remove svc_serv_ops::svo_module") removed calls to module_put_and_kthread_exit() from threads that acted as SUNRPC servers and had a related svc_serv_ops structure. This was correct. It ALSO removed the module_put_and_kthread_exit() call from nfs4_run_state_manager() which is NOT a SUNRPC service. Consequently every time the NFSv4 state manager runs the module count increments and won't be decremented. So the nfsv4 module cannot be unloaded. So restore the module_put_and_kthread_exit() call. Fixes: f49169c97fce ("NFSD: Remove svc_serv_ops::svo_module") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit fed0d9f13266a22ce1fc9a97521ef9cdc6271a23 Author: Norbert Zulinski Date: Wed Jun 8 11:10:56 2022 +0200 i40e: Fix VF's MAC Address change on VM Clear VF MAC from parent PF and remove VF filter from VSI when both conditions are true: -VIRTCHNL_VF_OFFLOAD_USO is not used -VM MAC was not set from PF level It affects older version of IAVF and it allow them to change MAC Address on VM, newer IAVF won't change their behaviour. Previously it wasn't possible to change VF's MAC Address on VM because there is flag on IAVF driver that won't allow to change MAC Address if this address is given from PF driver. Fixes: 155f0ac2c96b ("iavf: allow permanent MAC address to change") Signed-off-by: Norbert Zulinski Signed-off-by: Jan Sokolowski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 1adb1563e7b7ec659379a18e607e8bc3522d8a78 Author: Lukasz Cieplicki Date: Tue May 31 12:54:20 2022 +0200 i40e: Fix dropped jumbo frames statistics Dropped packets caused by too large frames were not included in dropped RX packets statistics. Issue was caused by not reading the GL_RXERR1 register. That register stores count of packet which was have been dropped due to too large size. Fix it by reading GL_RXERR1 register for each interface. Repro steps: Send a packet larger than the set MTU to SUT Observe rx statists: ethtool -S | grep rx | grep -v ": 0" Fixes: 41a9e55c89be ("i40e: add missing VSI statistics") Signed-off-by: Lukasz Cieplicki Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f3163d8567adbfebe574fb22c647ce5b829c5971 Merge: fbb564a557809 e1c70d7934635 Author: Jens Axboe Date: Thu Jun 30 14:00:11 2022 -0600 Merge tag 'nvme-5.19-2022-06-30' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - more quirks (Lamarque Vieira Souza, Pablo Greco) - fix a fabrics disconnect regression (Ruozhu Li) - fix a nvmet-tcp data_digest calculation regression (Sagi Grimberg) - fix nvme-tcp send failure handling (Sagi Grimberg) - fix a regression with nvmet-loop and passthrough controllers (Alan Adamson)" * tag 'nvme-5.19-2022-06-30' of git://git.infradead.org/nvme: nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1 nvmet: add a clear_ids attribute for passthru targets nvme: fix regression when disconnect a recovering ctrl nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G) nvme-tcp: always fail a request when sending it failed nvmet-tcp: fix regression in data_digest calculation commit 58bf4db695287c4bb2a5fc9fc12c78fdd4c36894 Author: Vladimir Oltean Date: Wed Jun 29 21:30:07 2022 +0300 net: dsa: felix: fix race between reading PSFP stats and port stats Both PSFP stats and the port stats read by ocelot_check_stats_work() are indirectly read through the same mechanism - write to STAT_CFG:STAT_VIEW, read from SYS:STAT:CNT[n]. It's just that for port stats, we write STAT_VIEW with the index of the port, and for PSFP stats, we write STAT_VIEW with the filter index. So if we allow them to run concurrently, ocelot_check_stats_work() may change the view from vsc9959_psfp_counters_get(), and vice versa. Fixes: 7d4b564d6add ("net: dsa: felix: support psfp filter on vsc9959") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220629183007.3808130-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 839b92fede7ba308f1a475aa00fea55f63b7fccf Author: Jakub Kicinski Date: Wed Jun 29 11:19:11 2022 -0700 selftest: tun: add test for NAPI dismantle Being lazy does not pay, add the test for various ordering of tun queue close / detach / destroy. Link: https://lore.kernel.org/r/20220629181911.372047-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ff1fa2081d173b01cebe2fbf0a2d0f1cee9ce4b5 Author: Jakub Kicinski Date: Wed Jun 29 11:19:10 2022 -0700 net: tun: avoid disabling NAPI twice Eric reports that syzbot made short work out of my speculative fix. Indeed when queue gets detached its tfile->tun remains, so we would try to stop NAPI twice with a detach(), close() sequence. Alternative fix would be to move tun_napi_disable() to tun_detach_all() and let the NAPI run after the queue has been detached. Fixes: a8fc8cb5692a ("net: tun: stop NAPI when detaching queues") Reported-by: syzbot Reported-by: Eric Dumazet Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220629181911.372047-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9c5de246c1dbe785268fc2e83c88624b92e4ec93 Author: Casper Andersson Date: Thu Jun 30 14:22:26 2022 +0200 net: sparx5: mdb add/del handle non-sparx5 devices When adding/deleting mdb entries on other net_devices, eg., tap interfaces, it should not crash. Fixes: 3bacfccdcb2d ("net: sparx5: Add mdb handlers") Signed-off-by: Casper Andersson Reviewed-by: Steen Hegelund Link: https://lore.kernel.org/r/20220630122226.316812-1-casper.casan@gmail.com Signed-off-by: Jakub Kicinski commit 62f46fc7b8c639bc97cc9c69e063c40970b6e14c Author: Sumeet Pawnikar Date: Fri May 6 19:20:09 2022 +0530 thermal: intel_tcc_cooling: Add TCC cooling support for RaptorLake Add RaptorLake to the list of processor models supported by the Intel TCC cooling driver. Signed-off-by: Sumeet Pawnikar [ rjw: Subject edits, new changelog ] Signed-off-by: Rafael J. Wysocki commit d7d488f41b41a1b7a1df3c74f2f65eb4585f5d55 Author: Zhang Jiaming Date: Thu Jun 23 14:05:43 2022 +0800 s390/qdio: Fix spelling mistake Change 'defineable' to 'definable'. Change 'paramater' to 'parameter'. Signed-off-by: Zhang Jiaming Reviewed-by: Benjamin Block Link: https://lore.kernel.org/r/20220623060543.12870-1-jiaming@nfschina.com Signed-off-by: Alexander Gordeev commit d608f45ed3cfd411a409cec93fa64232181752ff Author: Jiang Jian Date: Wed Jun 22 22:27:13 2022 +0800 s390/sclp: Fix typo in comments Remove the repeated word 'and' from comments Signed-off-by: Jiang Jian Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20220622142713.14187-1-jiangjian@cdjrlc.com Signed-off-by: Alexander Gordeev commit e4f74400308cb8abde5fdc9cad609c2aba32110c Author: Jason A. Donenfeld Date: Sat Jun 11 00:20:23 2022 +0200 s390/archrandom: simplify back to earlier design and initialize earlier s390x appears to present two RNG interfaces: - a "TRNG" that gathers entropy using some hardware function; and - a "DRBG" that takes in a seed and expands it. Previously, the TRNG was wired up to arch_get_random_{long,int}(), but it was observed that this was being called really frequently, resulting in high overhead. So it was changed to be wired up to arch_get_random_ seed_{long,int}(), which was a reasonable decision. Later on, the DRBG was then wired up to arch_get_random_{long,int}(), with a complicated buffer filling thread, to control overhead and rate. Fortunately, none of the performance issues matter much now. The RNG always attempts to use arch_get_random_seed_{long,int}() first, which means a complicated implementation of arch_get_random_{long,int}() isn't really valuable or useful to have around. And it's only used when reseeding, which means it won't hit the high throughput complications that were faced before. So this commit returns to an earlier design of just calling the TRNG in arch_get_random_seed_{long,int}(), and returning false in arch_get_ random_{long,int}(). Part of what makes the simplification possible is that the RNG now seeds itself using the TRNG at bootup. But this only works if the TRNG is detected early in boot, before random_init() is called. So this commit also causes that check to happen in setup_arch(). Cc: stable@vger.kernel.org Cc: Harald Freudenberger Cc: Ingo Franzki Cc: Juergen Christ Cc: Heiko Carstens Signed-off-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20220610222023.378448-1-Jason@zx2c4.com Reviewed-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 09007af2b627f0f195c6c53c4829b285cc3990ec Author: Dylan Yudaken Date: Thu Jun 30 06:20:06 2022 -0700 io_uring: fix provided buffer import io_import_iovec uses the s pointer, but this was changed immediately after the iovec was re-imported and so it was imported into the wrong place. Change the ordering. Fixes: 2be2eb02e2f5 ("io_uring: ensure reads re-import for selected buffers") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220630132006.2825668-1-dylany@fb.com [axboe: ensure we don't half-import as well] Signed-off-by: Jens Axboe commit 1a0e93df1e107dc766fdf86ae88076efd9f376e6 Merge: 9fb3bb25d1532 0fe3dbbefb74a Author: Linus Torvalds Date: Thu Jun 30 10:03:22 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Three minor bug fixes: - qedr not setting the QP timeout properly toward userspace - Memory leak on error path in ib_cm - Divide by 0 in RDMA interrupt moderation" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: linux/dim: Fix divide by 0 in RDMA DIM RDMA/cm: Fix memory leak in ib_cm_insert_listen RDMA/qedr: Fix reporting QP timeout attribute commit 9fb3bb25d15326464e2183a5eb4b1ea8725d560c Merge: f5da5ddf81ad0 8698e3bab4dd7 Author: Linus Torvalds Date: Thu Jun 30 09:57:18 2022 -0700 Merge tag 'fsnotify_for_v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fanotify fix from Jan Kara: "A fix for recently added fanotify API to have stricter checks and refuse some invalid flag combinations to make our life easier in the future" * tag 'fsnotify_for_v5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: refine the validation checks on non-dir inode mask commit f5da5ddf81ad0bfb91fa5e7d087e2ad96f26b7b7 Merge: d9b2ba67917c1 87d044096ea62 Author: Linus Torvalds Date: Thu Jun 30 09:45:42 2022 -0700 Merge tag 'v5.19-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a regression that breaks the ccp driver" * tag 'v5.19-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccp - Fix device IRQ counting by using platform_irq_count() commit b941e487152e0909ef43faacae6eeee266d9b378 Author: Biju Das Date: Thu Jun 30 09:39:09 2022 +0100 serial: 8250: dw: Fix the macro RZN1_UART_xDMACR_8_WORD_BURST As per RZ/N1 peripheral user manual(r01uh0752ej0100-rzn1-peripheral.pdf) rev 1.0.0 Mar,2019, the value for 8_WORD_BURST is 4(b2,b1=2’b10). This patch fixes the macro as per the user manual. Fixes: aa63d786cea2 ("serial: 8250: dw: Add support for DMA flow controlling devices") Reviewed-by: Phil Edworthy Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20220630083909.4294-1-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc Author: Yangxi Xiang Date: Tue Jun 28 17:33:22 2022 +0800 vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic. Fix this problem by using replacing the scr_memcpyw with scr_memmovew. Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable Signed-off-by: Yangxi Xiang Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4f532c1e25319e42996ec18a1f473fd50c8e575d Author: Pali Rohár Date: Tue Jun 28 12:09:22 2022 +0200 serial: mvebu-uart: correctly report configured baudrate value Functions tty_termios_encode_baud_rate() and uart_update_timeout() should be called with the baudrate value which was set to hardware. Linux then report exact values via ioctl(TCGETS2) to userspace. Change mvebu_uart_baud_rate_set() function to return baudrate value which was set to hardware and propagate this value to above mentioned functions. With this change userspace would see precise value in termios c_ospeed field. Fixes: 68a0db1d7da2 ("serial: mvebu-uart: add function to change baudrate") Cc: stable Reviewed-by: Ilpo Järvinen Signed-off-by: Pali Rohár Link: https://lore.kernel.org/r/20220628100922.10717-1-pali@kernel.org Signed-off-by: Greg Kroah-Hartman commit f9b11229b79c0fb2100b5bb4628a101b1d37fbf6 Author: Ilpo Järvinen Date: Wed Jun 29 12:48:41 2022 +0300 serial: 8250: Fix PM usage_count for console handover When console is enabled, univ8250_console_setup() calls serial8250_console_setup() before .dev is set to uart_port. Therefore, it will not call pm_runtime_get_sync(). Later, when the actual driver is going to take over univ8250_console_exit() is called. As .dev is already set, serial8250_console_exit() makes pm_runtime_put_sync() call with usage count being zero triggering PM usage count warning (extra debug for univ8250_console_setup(), univ8250_console_exit(), and serial8250_register_ports()): [ 0.068987] univ8250_console_setup ttyS0 nodev [ 0.499670] printk: console [ttyS0] enabled [ 0.717955] printk: console [ttyS0] printing thread started [ 1.960163] serial8250_register_ports assigned dev for ttyS0 [ 1.976830] printk: console [ttyS0] disabled [ 1.976888] printk: console [ttyS0] printing thread stopped [ 1.977073] univ8250_console_exit ttyS0 usage:0 [ 1.977075] serial8250 serial8250: Runtime PM usage count underflow! [ 1.977429] dw-apb-uart.6: ttyS0 at MMIO 0x4010006000 (irq = 33, base_baud = 115200) is a 16550A [ 1.977812] univ8250_console_setup ttyS0 usage:2 [ 1.978167] printk: console [ttyS0] printing thread started [ 1.978203] printk: console [ttyS0] enabled To fix the issue, call pm_runtime_get_sync() in serial8250_register_ports() as soon as .dev is set for an uart_port if it has console enabled. This problem became apparent only recently because 82586a721595 ("PM: runtime: Avoid device usage count underflows") added the warning printout. I confirmed this problem also occurs with v5.18 (w/o the warning printout, obviously). Fixes: bedb404e91bb ("serial: 8250_port: Don't use power management for kernel console") Cc: stable Tested-by: Tony Lindgren Reviewed-by: Andy Shevchenko Reviewed-by: Tony Lindgren Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/b4f428e9-491f-daf2-2232-819928dc276e@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6e690d54cfa802f939cefbd2fa2c91bd0b8bd1b6 Author: Yi Yang Date: Tue Jun 28 16:35:15 2022 +0800 serial: 8250: fix return error code in serial8250_request_std_resource() If port->mapbase = NULL in serial8250_request_std_resource() , it need return a error code instead of 0. If uart_set_info() fail to request new regions by serial8250_request_std_resource() but the return value of serial8250_request_std_resource() is 0, The system incorrectly considers that the resource application is successful and does not attempt to restore the old setting. A null pointer reference is triggered when the port resource is later invoked. Signed-off-by: Yi Yang Cc: stable Link: https://lore.kernel.org/r/20220628083515.64138-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 5c5f44e36217de5ead789ff25da71c31c2331c96 Author: Ilpo Järvinen Date: Mon Jun 27 18:07:52 2022 +0300 serial: stm32: Clear prev values before setting RTS delays The code lacks clearing of previous DEAT/DEDT values. Thus, changing values on the fly results in garbage delays tending towards the maximum value as more and more bits are ORed together. (Leaving RS485 mode would have cleared the old values though). Fixes: 1bcda09d2910 ("serial: stm32: add support for RS485 hardware control mode") Cc: stable Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220627150753.34510-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 589cb2c0b8daf4fd03e7012c00a52804769e7699 Merge: 03c765b0e3b4c f08fe6fcbe13f Author: Rafael J. Wysocki Date: Thu Jun 30 15:30:30 2022 +0200 Merge tag 'devfreq-fixes-for-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull devfreq fixes for 5.19-rc5 from Chanwoo Choi: "1. Fix devfreq passive governor issue when cpufreq policies are not ready during kernel boot because some CPUs turn on after kernel booting or others. - Re-initialize the vairables of struct devfreq_passive_data when PROBE_DEFER happens when cpufreq_get() returns NULL. - Use dev_err_probe to mute warning when PROBE_DEFER. - Fix cpufreq passive unregister erroring on PROBE_DEFER by using the allocated parent_cpu_data list to free resouce instead of for_each_possible_cpu(). - Remove duplicate cpufreq passive unregister and warning when PROBE_DEFER. - Use HZ_PER_KZH macro in units.h. - Fix wrong indentation in SPDX-License line. 2. Fix reference count leak in exynos-ppmu.c by using of_node_put(). 3. Rework freq_table to be local to devfreq struct - struct devfreq_dev_profile includes freq_table array to store the supported frequencies. If devfreq driver doesn't initialize the freq_table, devfreq core allocates the memory and initializes the freq_table. On a devfreq PROBE_DEFER, the freq_table in the driver profile struct is never reset and may be left in an undefined state. To fix this and correctly handle PROBE_DEFER, use a local freq_table and max_state in the devfreq struct." * tag 'devfreq-fixes-for-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: passive: revert an editing accident in SPDX-License line PM / devfreq: Fix kernel warning with cpufreq passive register fail PM / devfreq: Rework freq_table to be local to devfreq struct PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events PM / devfreq: passive: Use HZ_PER_KHZ macro in units.h PM / devfreq: Fix cpufreq passive unregister erroring on PROBE_DEFER PM / devfreq: Mute warning on governor PROBE_DEFER PM / devfreq: Fix kernel panic with cpu based scaling to passive gov commit 29c1ac230e6056b26846c66881802b581a78ad72 Author: Pavel Begunkov Date: Thu Jun 30 13:25:57 2022 +0100 io_uring: keep sendrecv flags in ioprio We waste a u64 SQE field for flags even though we don't need as many bits and it can be used for something more useful later. Store io_uring specific send/recv flags in sqe->ioprio instead of ->addr2. Signed-off-by: Pavel Begunkov Fixes: 0455d4ccec54 ("io_uring: add POLL_FIRST support for send/sendmsg and recv/recvmsg") [axboe: change comment in io_uring.h as well] Signed-off-by: Jens Axboe commit 20159e287a031bd6a28429675ccc66b06372fa3c Author: Masahiro Yamada Date: Tue Jun 14 02:09:02 2022 +0900 s390/purgatory: remove duplicated build rule of kexec-purgatory.o This is equivalent to the pattern rule in scripts/Makefile.build. Having the dependency on $(obj)/purgatory.ro is enough. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220613170902.1775211-3-masahiroy@kernel.org Signed-off-by: Alexander Gordeev commit b9a56c113f907b19b91dc5c2383b0169831e15a4 Author: Masahiro Yamada Date: Tue Jun 14 02:09:01 2022 +0900 s390/purgatory: hard-code obj-y in Makefile The purgatory/ directory is entirely guarded in arch/s390/Kbuild. CONFIG_ARCH_HAS_KEXEC_PURGATORY is bool type. $(CONFIG_ARCH_HAS_KEXEC_PURGATORY) is always 'y' when Kbuild visits this Makefile for building. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220613170902.1775211-2-masahiroy@kernel.org Signed-off-by: Alexander Gordeev commit 25deecb21c18ee29e3be8ac6177b2a9504c33d2d Author: Masahiro Yamada Date: Tue Jun 14 02:09:00 2022 +0900 s390: remove unneeded 'select BUILD_BIN2C' Since commit 4c0f032d4963 ("s390/purgatory: Omit use of bin2c"), s390 builds the purgatory without using bin2c. Remove 'select BUILD_BIN2C' to avoid the unneeded build of bin2c. Fixes: 4c0f032d4963 ("s390/purgatory: Omit use of bin2c") Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220613170902.1775211-1-masahiroy@kernel.org Signed-off-by: Alexander Gordeev commit 0a18d802d65cf662644fd1d369c86d84a5630652 Author: Jianglei Nie Date: Wed Jun 29 15:55:50 2022 +0800 net: sfp: fix memory leak in sfp_probe() sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak. We should use devm_add_action_or_reset() instead of devm_add_action(). Signed-off-by: Jianglei Nie Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20220629075550.2152003-1-niejianglei2021@163.com Signed-off-by: Paolo Abeni commit 665030fd0c1ed9f505932e6e73e7a2c788787a0a Author: Petr Machata Date: Wed Jun 29 10:02:05 2022 +0300 mlxsw: spectrum_router: Fix rollback in tunnel next hop init In mlxsw_sp_nexthop6_init(), a next hop is always added to the router linked list, and mlxsw_sp_nexthop_type_init() is invoked afterwards. When that function results in an error, the next hop will not have been removed from the linked list. As the error is propagated upwards and the caller frees the next hop object, the linked list ends up holding an invalid object. A similar issue comes up with mlxsw_sp_nexthop4_init(), where rollback block does exist, however does not include the linked list removal. Both IPv6 and IPv4 next hops have a similar issue with next-hop counter rollbacks. As these were introduced in the same patchset as the next hop linked list, include the cleanup in this patch. Fixes: dbe4598c1e92 ("mlxsw: spectrum_router: Keep nexthops in a linked list") Fixes: a5390278a5eb ("mlxsw: spectrum: Add support for setting counters on nexthops") Signed-off-by: Petr Machata Reviewed-by: Amit Cohen Signed-off-by: Ido Schimmel Link: https://lore.kernel.org/r/20220629070205.803952-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 9cc02ede696272c5271a401e4f27c262359bc2f6 Author: Duoming Zhou Date: Wed Jun 29 08:26:40 2022 +0800 net: rose: fix UAF bugs caused by timer handler There are UAF bugs in rose_heartbeat_expiry(), rose_timer_expiry() and rose_idletimer_expiry(). The root cause is that del_timer() could not stop the timer handler that is running and the refcount of sock is not managed properly. One of the UAF bugs is shown below: (thread 1) | (thread 2) | rose_bind | rose_connect | rose_start_heartbeat rose_release | (wait a time) case ROSE_STATE_0 | rose_destroy_socket | rose_heartbeat_expiry rose_stop_heartbeat | sock_put(sk) | ... sock_put(sk) // FREE | | bh_lock_sock(sk) // USE The sock is deallocated by sock_put() in rose_release() and then used by bh_lock_sock() in rose_heartbeat_expiry(). Although rose_destroy_socket() calls rose_stop_heartbeat(), it could not stop the timer that is running. The KASAN report triggered by POC is shown below: BUG: KASAN: use-after-free in _raw_spin_lock+0x5a/0x110 Write of size 4 at addr ffff88800ae59098 by task swapper/3/0 ... Call Trace: dump_stack_lvl+0xbf/0xee print_address_description+0x7b/0x440 print_report+0x101/0x230 ? irq_work_single+0xbb/0x140 ? _raw_spin_lock+0x5a/0x110 kasan_report+0xed/0x120 ? _raw_spin_lock+0x5a/0x110 kasan_check_range+0x2bd/0x2e0 _raw_spin_lock+0x5a/0x110 rose_heartbeat_expiry+0x39/0x370 ? rose_start_heartbeat+0xb0/0xb0 call_timer_fn+0x2d/0x1c0 ? rose_start_heartbeat+0xb0/0xb0 expire_timers+0x1f3/0x320 __run_timers+0x3ff/0x4d0 run_timer_softirq+0x41/0x80 __do_softirq+0x233/0x544 irq_exit_rcu+0x41/0xa0 sysvec_apic_timer_interrupt+0x8c/0xb0 asm_sysvec_apic_timer_interrupt+0x1b/0x20 RIP: 0010:default_idle+0xb/0x10 RSP: 0018:ffffc9000012fea0 EFLAGS: 00000202 RAX: 000000000000bcae RBX: ffff888006660f00 RCX: 000000000000bcae RDX: 0000000000000001 RSI: ffffffff843a11c0 RDI: ffffffff843a1180 RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed100da36d46 R10: dfffe9100da36d47 R11: ffffffff83cf0950 R12: 0000000000000000 R13: 1ffff11000ccc1e0 R14: ffffffff8542af28 R15: dffffc0000000000 ... Allocated by task 146: __kasan_kmalloc+0xc4/0xf0 sk_prot_alloc+0xdd/0x1a0 sk_alloc+0x2d/0x4e0 rose_create+0x7b/0x330 __sock_create+0x2dd/0x640 __sys_socket+0xc7/0x270 __x64_sys_socket+0x71/0x80 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 152: kasan_set_track+0x4c/0x70 kasan_set_free_info+0x1f/0x40 ____kasan_slab_free+0x124/0x190 kfree+0xd3/0x270 __sk_destruct+0x314/0x460 rose_release+0x2fa/0x3b0 sock_close+0xcb/0x230 __fput+0x2d9/0x650 task_work_run+0xd6/0x160 exit_to_user_mode_loop+0xc7/0xd0 exit_to_user_mode_prepare+0x4e/0x80 syscall_exit_to_user_mode+0x20/0x40 do_syscall_64+0x4f/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This patch adds refcount of sock when we use functions such as rose_start_heartbeat() and so on to start timer, and decreases the refcount of sock when timer is finished or deleted by functions such as rose_stop_heartbeat() and so on. As a result, the UAF bugs could be mitigated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Tested-by: Duoming Zhou Link: https://lore.kernel.org/r/20220629002640.5693-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni commit f8ebb3ac881b17712e1d5967c97ab1806b16d3d6 Author: Jose Alonso Date: Tue Jun 28 12:13:02 2022 -0300 net: usb: ax88179_178a: Fix packet receiving This patch corrects packet receiving in ax88179_rx_fixup. - problem observed: ifconfig shows allways a lot of 'RX Errors' while packets are received normally. This occurs because ax88179_rx_fixup does not recognise properly the usb urb received. The packets are normally processed and at the end, the code exits with 'return 0', generating RX Errors. (pkt_cnt==-2 and ptk_hdr over field rx_hdr trying to identify another packet there) This is a usb urb received by "tcpdump -i usbmon2 -X" on a little-endian CPU: 0x0000: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ^ packet 1 start (pkt_len = 0x05ec) ^^^^ IP alignment pseudo header ^ ethernet packet start last byte ethernet packet v padding (8-bytes aligned) vvvv vvvv 0x05e0: c92d d444 1420 8a69 83dd 272f e82b 9811 0x05f0: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... ^ packet 2 0x0be0: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... 0x1130: 9d41 9171 8a38 0ec5 eeee f8e3 3b19 87a0 ... 0x1720: 8cfc 15ff 5e4c e85c eeee f8e3 3b19 87a0 ... 0x1d10: ecfa 2a3a 19ab c78c eeee f8e3 3b19 87a0 ... 0x2070: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... ^ packet 7 0x2120: 7c88 4ca5 5c57 7dcc 0d34 7577 f778 7e0a 0x2130: f032 e093 7489 0740 3008 ec05 0000 0080 ====1==== ====2==== hdr_off ^ pkt_len = 0x05ec ^^^^ AX_RXHDR_*=0x00830 ^^^^ ^ pkt_len = 0 ^^^^ AX_RXHDR_DROP_ERR=0x80000000 ^^^^ ^ 0x2140: 3008 ec05 0000 0080 3008 5805 0000 0080 0x2150: 3008 ec05 0000 0080 3008 ec05 0000 0080 0x2160: 3008 5803 0000 0080 3008 c800 0000 0080 ===11==== ===12==== ===13==== ===14==== 0x2170: 0000 0000 0e00 3821 ^^^^ ^^^^ rx_hdr ^^^^ pkt_cnt=14 ^^^^ hdr_off=0x2138 ^^^^ ^^^^ padding The dump shows that pkt_cnt is the number of entrys in the per-packet metadata. It is "2 * packet count". Each packet have two entrys. The first have a valid value (pkt_len and AX_RXHDR_*) and the second have a dummy-header 0x80000000 (pkt_len=0 with AX_RXHDR_DROP_ERR). Why exists dummy-header for each packet?!? My guess is that this was done probably to align the entry for each packet to 64-bits and maintain compatibility with old firmware. There is also a padding (0x00000000) before the rx_hdr to align the end of rx_hdr to 64-bit. Note that packets have a alignment of 64-bits (8-bytes). This patch assumes that the dummy-header and the last padding are optional. So it preserves semantics and recognises the same valid packets as the current code. This patch was made using only the dumpfile information and tested with only one device: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet Fixes: 57bc3d3ae8c1 ("net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup") Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") Signed-off-by: Jose Alonso Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/d6970bb04bf67598af4d316eaeb1792040b18cfd.camel@gmail.com Signed-off-by: Paolo Abeni commit e1c70d79346356bb1ede3f79436df80917845ab9 Author: Lamarque Vieira Souza Date: Wed Jun 29 21:30:53 2022 -0300 nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA IM2P33F8ABR1 ADATA IM2P33F8ABR1 reports bogus eui64 values that appear to be the same across all drives. Quirk them out so they are not marked as "non globally unique" duplicates. Co-developed-by: Felipe de Jesus Araujo da Conceição Signed-off-by: Felipe de Jesus Araujo da Conceição Signed-off-by: Lamarque V. Souza Cc: stable@vger.kernel.org Signed-off-by: Christoph Hellwig commit 34ad61514c4c3657df21a058f9961c3bb2f84ff2 Author: Alan Adamson Date: Mon Jun 27 16:25:43 2022 -0700 nvmet: add a clear_ids attribute for passthru targets If the clear_ids attribute is set to true, the EUI/GUID/UUID is cleared for the passthru target. By default, loop targets will set clear_ids to true. This resolves an issue where a connect to a passthru target fails when using a trtype of 'loop' because EUI/GUID/UUID is not unique. Fixes: 2079f41ec6ff ("nvme: check that EUI/GUID/UUID are globally unique") Signed-off-by: Alan Adamson Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 050133e1aa2cb49bb17be847d48a4431598ef562 Author: Yevhen Orlov Date: Wed Jun 29 04:29:14 2022 +0300 net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 Fixes: 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") Co-developed-by: Maksym Glubokiy Signed-off-by: Maksym Glubokiy Signed-off-by: Yevhen Orlov Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20220629012914.361-1-yevhen.orlov@plvision.eu Signed-off-by: Jakub Kicinski commit 4e43e64d0f1332fcc503babad4dc31aead7131ca Author: Eric Dumazet Date: Tue Jun 28 12:12:48 2022 +0000 ipv6: fix lockdep splat in in6_dump_addrs() As reported by syzbot, we should not use rcu_dereference() when rcu_read_lock() is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller #0 Not tainted net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor326/3617: #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223 stack backtrace: CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380 netlink_dump_start include/linux/netlink.h:245 [inline] rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Taehee Yoo Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fa152f626b24ec2ca3489100d8c5c0a0bce4e2ef Author: Oleksij Rempel Date: Tue Jun 28 13:43:49 2022 +0200 net: phy: ax88772a: fix lost pause advertisement configuration In case of asix_ax88772a_link_change_notify() workaround, we run soft reset which will automatically clear MII_ADVERTISE configuration. The PHYlib framework do not know about changed configuration state of the PHY, so we need use phy_init_hw() to reinit PHY configuration. Fixes: dde258469257 ("net: usb/phy: asix: add support for ax88772A/C PHYs") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220628114349.3929928-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 1758bde2e4aa5ff188d53e7d9d388bbb7e12eebb Author: Lukas Wunner Date: Tue Jun 28 12:15:08 2022 +0200 net: phy: Don't trigger state machine while in suspend Upon system sleep, mdio_bus_phy_suspend() stops the phy_state_machine(), but subsequent interrupts may retrigger it: They may have been left enabled to facilitate wakeup and are not quiesced until the ->suspend_noirq() phase. Unwanted interrupts may hence occur between mdio_bus_phy_suspend() and dpm_suspend_noirq(), as well as between dpm_resume_noirq() and mdio_bus_phy_resume(). Retriggering the phy_state_machine() through an interrupt is not only undesirable for the reason given in mdio_bus_phy_suspend() (freezing it midway with phydev->lock held), but also because the PHY may be inaccessible after it's suspended: Accesses to USB-attached PHYs are blocked once usb_suspend_both() clears the can_submit flag and PHYs on PCI network cards may become inaccessible upon suspend as well. Amend phy_interrupt() to avoid triggering the state machine if the PHY is suspended. Signal wakeup instead if the attached net_device or its parent has been configured as a wakeup source. (Those conditions are identical to mdio_bus_phy_may_suspend().) Postpone handling of the interrupt until the PHY has resumed. Before stopping the phy_state_machine() in mdio_bus_phy_suspend(), wait for a concurrent phy_interrupt() to run to completion. That is necessary because phy_interrupt() may have checked the PHY's suspend status before the system sleep transition commenced and it may thus retrigger the state machine after it was stopped. Likewise, after re-enabling interrupt handling in mdio_bus_phy_resume(), wait for a concurrent phy_interrupt() to complete to ensure that interrupts which it postponed are properly rerun. The issue was exposed by commit 1ce8b37241ed ("usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling"), but has existed since forever. Fixes: 541cd3ee00a4 ("phylib: Fix deadlock on resume") Link: https://lore.kernel.org/netdev/a5315a8a-32c2-962f-f696-de9a26d30091@samsung.com/ Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: Lukas Wunner Acked-by: Rafael J. Wysocki Cc: stable@vger.kernel.org # v2.6.33+ Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/b7f386d04e9b5b0e2738f0125743e30676f309ef.1656410895.git.lukas@wunner.de Signed-off-by: Jakub Kicinski commit e65af5403e462ccd7dff6a045a886c64da598c2e Author: Oliver Neukum Date: Tue Jun 28 11:35:17 2022 +0200 usbnet: fix memory allocation in helpers usbnet provides some helper functions that are also used in the context of reset() operations. During a reset the other drivers on a device are unable to operate. As that can be block drivers, a driver for another interface cannot use paging in its memory allocations without risking a deadlock. Use GFP_NOIO in the helpers. Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220628093517.7469-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit 7b92aa9e613508cbaa29dd35bf27db4c35628b10 Author: Coleman Dietsch Date: Tue Jun 28 12:47:44 2022 -0500 selftests net: fix kselftest net fatal error The incorrect path is causing the following error when trying to run net kselftests: In file included from bpf/nat6to4.c:43: ../../../lib/bpf/bpf_helpers.h:11:10: fatal error: 'bpf_helper_defs.h' file not found ^~~~~~~~~~~~~~~~~~~ 1 error generated. Fixes: cf67838c4422 ("selftests net: fix bpf build error") Signed-off-by: Coleman Dietsch Link: https://lore.kernel.org/r/20220628174744.7908-1-dietschc@csp.edu Signed-off-by: Jakub Kicinski commit 236d59292efab107fb7b83f34c78ed2b10ed8e6d Merge: 9577fc5fdc8b0 c2577862eeb0b Author: Jakub Kicinski Date: Wed Jun 29 20:09:32 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Restore set counter when one of the CPU loses race to add elements to sets. 2) After NF_STOLEN, skb might be there no more, update nftables trace infra to avoid access to skb in this case. From Florian Westphal. 3) nftables bridge might register a prerouting hook with zero priority, br_netfilter incorrectly skips it. Also from Florian. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: br_netfilter: do not skip all hooks with 0 priority netfilter: nf_tables: avoid skb access on nf_stolen netfilter: nft_dynset: restore set element counter when failing to update ==================== Link: https://lore.kernel.org/r/ Signed-off-by: Jakub Kicinski commit 078a3be79325e4a5e7e16576b3919999efadfa3f Merge: 8cdf1b56ccab9 a775e4e4941bf Author: Dave Airlie Date: Thu Jun 30 10:48:54 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-06-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-06-29: amdgpu: - GPU recovery fix - Fix integer type usage in fourcc header for AMD modifiers - KFD TLB flush fix for gfx9 APUs - Display fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220629192220.5870-1-alexander.deucher@amd.com commit 8cdf1b56ccab969b393269a8abbf5e1d6dc700c9 Merge: 76f0544428ace 79538490fd7ad Author: Dave Airlie Date: Thu Jun 30 10:21:14 2022 +1000 Merge tag 'drm-intel-fixes-2022-06-29' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.19-rc5: - Fix ioctl argument error return - Fix d3cold disable to allow PCI upstream bridge D3 transition - Fix setting cache_dirty for dma-buf objects on discrete Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/871qv7rblv.fsf@intel.com commit 617b365872a247480e9dcd50a32c8d1806b21861 Author: Mikulas Patocka Date: Wed Jun 29 13:40:57 2022 -0400 dm raid: fix KASAN warning in raid5_add_disks There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning by verifying that rdev->saved_raid_disk is within limits. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 1ebc2cec0b7dd8dad0812449110803bd875ac816 Author: Mikulas Patocka Date: Wed Jun 29 13:40:01 2022 -0400 dm raid: fix KASAN warning in raid5_remove_disk There's a KASAN warning in raid5_remove_disk when running the LVM testsuite. We fix this warning by verifying that the "number" variable is within limits. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 32788beb103f7f71e0192dce701f387070914651 Author: John Garry Date: Wed Jun 29 17:18:44 2022 +0800 ata: pata_cs5535: Fix W=1 warnings x86_64 allmodconfig build with W=1 gives these warnings: drivers/ata/pata_cs5535.c: In function ‘cs5535_set_piomode’: drivers/ata/pata_cs5535.c:93:11: error: variable ‘dummy’ set but not used [-Werror=unused-but-set-variable] u32 reg, dummy; ^~~~~ drivers/ata/pata_cs5535.c: In function ‘cs5535_set_dmamode’: drivers/ata/pata_cs5535.c:132:11: error: variable ‘dummy’ set but not used [-Werror=unused-but-set-variable] u32 reg, dummy; ^~~~~ cc1: all warnings being treated as errors Mark variables 'dummy' as "maybe unused" as they are only ever written in rdmsr() calls. Signed-off-by: John Garry Reviewed-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit f0aa153b6ce8018a052d9c05dc1b8483ac3a0f1a Author: Jiang Jian Date: Wed Jun 22 14:32:31 2022 +0800 hwmon: (pmbus/ucd9200) fix typos in comments Drop the redundant word 'the' in the comments following /* * Set PHASE registers on all pages to 0xff to ensure that phase * specific commands will apply to all phases of a given page (rail). * This only affects the READ_IOUT and READ_TEMPERATURE2 registers. * READ_IOUT will return the sum of currents of all phases of a rail, * and READ_TEMPERATURE2 will return the maximum temperature detected * for the [the - DROP] phases of the rail. */ Signed-off-by: Jiang Jian Link: https://lore.kernel.org/r/20220622063231.20612-1-jiangjian@cdjrlc.com Signed-off-by: Guenter Roeck commit 1bbb2809040a1f9c7c53c9f06c21aa83275ed27b Author: Eddie James Date: Tue Jun 28 15:30:29 2022 -0500 hwmon: (occ) Prevent power cap command overwriting poll response Currently, the response to the power cap command overwrites the first eight bytes of the poll response, since the commands use the same buffer. This means that user's get the wrong data between the time of sending the power cap and the next poll response update. Fix this by specifying a different buffer for the power cap command response. Fixes: 5b5513b88002 ("hwmon: Add On-Chip Controller (OCC) hwmon driver") Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220628203029.51747-1-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit f08fe6fcbe13f83558ecccc4acaf5af3dce71a1f Author: Lukas Bulwahn Date: Tue Jun 28 07:34:11 2022 +0200 PM / devfreq: passive: revert an editing accident in SPDX-License line Commit 26984d9d581e ("PM / devfreq: passive: Keep cpufreq_policy for possible cpus") reworked governor_passive.c, and accidently added a tab in the first line, i.e., the SPDX-License-Identifier line. The checkpatch script warns with the SPDX_LICENSE_TAG warning, and hence pointed this issue out while investigating checkpatch warnings. Revert this editing accident. No functional change. Signed-off-by: Lukas Bulwahn Signed-off-by: Chanwoo Choi commit 82c66d2bbbeda9e493487e7413769087a0b46250 Author: Christian Marangi Date: Mon Jun 20 00:29:39 2022 +0200 PM / devfreq: Fix kernel warning with cpufreq passive register fail Remove cpufreq_passive_unregister_notifier from cpufreq_passive_register_notifier in case of error as devfreq core already call unregister on GOV_START fail. This fix the kernel always printing a WARN on governor PROBE_DEFER as cpufreq_passive_unregister_notifier is called two times and return error on the second call as the cpufreq is already unregistered. Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor") Signed-off-by: Christian Marangi Signed-off-by: Chanwoo Choi commit b5d281f6c16dd432b618bdfd36ddba1a58d5b603 Author: Christian Marangi Date: Mon Jun 20 00:03:51 2022 +0200 PM / devfreq: Rework freq_table to be local to devfreq struct On a devfreq PROBE_DEFER, the freq_table in the driver profile struct, is never reset and may be leaved in an undefined state. This comes from the fact that we store the freq_table in the driver profile struct that is commonly defined as static and not reset on PROBE_DEFER. We currently skip the reinit of the freq_table if we found it's already defined since a driver may declare his own freq_table. This logic is flawed in the case devfreq core generate a freq_table, set it in the profile struct and then PROBE_DEFER, freeing the freq_table. In this case devfreq will found a NOT NULL freq_table that has been freed, skip the freq_table generation and probe the driver based on the wrong table. To fix this and correctly handle PROBE_DEFER, use a local freq_table and max_state in the devfreq struct and never modify the freq_table present in the profile struct if it does provide it. Fixes: 0ec09ac2cebe ("PM / devfreq: Set the freq_table of devfreq device") Cc: stable@vger.kernel.org Signed-off-by: Christian Marangi Signed-off-by: Chanwoo Choi commit f44b799603a9b5d2e375b0b2d54dd0b791eddfc2 Author: Miaoqian Lin Date: Thu May 26 12:28:56 2022 +0400 PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. This function only calls of_node_put() in normal path, missing it in error paths. Add missing of_node_put() to avoid refcount leak. Fixes: f262f28c1470 ("PM / devfreq: event: Add devfreq_event class") Signed-off-by: Miaoqian Lin Signed-off-by: Chanwoo Choi commit 20e6c3cc90c0a86dba659dd9e7d60b429d88746d Author: Yicong Yang Date: Fri Jun 10 15:54:28 2022 +0800 PM / devfreq: passive: Use HZ_PER_KHZ macro in units.h HZ macros has been centralized in units.h since [1]. Use it to avoid duplicated definition. [1] commit e2c77032fcbe ("units: add the HZ macros") Signed-off-by: Yicong Yang Signed-off-by: Chanwoo Choi commit 0cca7e8dcfa9e6fe7ba697e534a732571f1689d0 Author: Christian Marangi Date: Wed Jun 15 01:09:47 2022 +0200 PM / devfreq: Fix cpufreq passive unregister erroring on PROBE_DEFER With the passive governor, the cpu based scaling can PROBE_DEFER due to the fact that CPU policy are not ready. The cpufreq passive unregister notifier is called both from the GOV_START errors and for the GOV_STOP and assume the notifier is successfully registred every time. With GOV_START failing it's wrong to loop over each possible CPU since the register path has failed for some CPU policy not ready. Change the logic and unregister the notifer based on the current allocated parent_cpu_data list to correctly handle errors and the governor unregister path. Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor") Signed-off-by: Christian 'Ansuel' Marangi Signed-off-by: Chanwoo Choi commit e52b045fe07d7874474665c843befa7521853234 Author: Christian Marangi Date: Wed Jun 15 01:09:50 2022 +0200 PM / devfreq: Mute warning on governor PROBE_DEFER Don't print warning when a governor PROBE_DEFER as it's not a real GOV_START fail. Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor") Signed-off-by: Christian 'Ansuel' Marangi Signed-off-by: Chanwoo Choi commit 57e00b40033a376de3f3cf0bb9bf7590d2dd679d Author: Christian Marangi Date: Tue Jun 14 13:06:59 2022 +0200 PM / devfreq: Fix kernel panic with cpu based scaling to passive gov The cpufreq passive register notifier can PROBE_DEFER and the devfreq struct is freed and then reallocaed on probe retry. The current logic assume that the code can't PROBE_DEFER so the devfreq struct in the this variable in devfreq_passive_data is assumed to be (if already set) always correct. This cause kernel panic as the code try to access the wrong address. To correctly handle this, update the this variable in devfreq_passive_data to the devfreq reallocated struct. Fixes: a03dacb0316f ("PM / devfreq: Add cpu based scaling support to passive governor") Signed-off-by: Christian 'Ansuel' Marangi Signed-off-by: Chanwoo Choi commit 8ad59b397f86a4d8014966fdc0552095a0c4fb2b Author: Jean Delvare Date: Wed Jun 22 08:37:43 2022 +0200 i2c: piix4: Fix a memory leak in the EFCH MMIO support The recently added support for EFCH MMIO regions introduced a memory leak in that code path. The leak is caused by the fact that release_resource() merely removes the resource from the tree but does not free its memory. We need to call release_mem_region() instead, which does free the memory. As a nice side effect, this brings back some symmetry between the legacy and MMIO paths. Signed-off-by: Jean Delvare Reported-by: Yi Zhang Tested-by: Yi Zhang Reviewed-by: Terry Bowman Tested-by: Terry Bowman Fixes: 7c148722d074 ("i2c: piix4: Add EFCH MMIO support to region request and release") Signed-off-by: Wolfram Sang commit 5812175389e258141c5e9f8eadc1ed226f67bc11 Author: Yang Yingliang Date: Wed Jun 29 17:46:35 2022 +0800 usb: dwc3-am62: remove unnecesary clk_put() The clk get by devm_clk_get() will be released in devres_release_all(), so there is no need explicitly call clk_put(), or it will cause UAF. Fixes: e8784c0aec03 ("drivers: usb: dwc3: Add AM62 USB wrapper driver") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220629094635.3116961-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 7441b273388b9a59d8387a03ffbbca9d5af6348c Author: Thinh Nguyen Date: Mon Jun 27 18:41:19 2022 -0700 usb: dwc3: gadget: Fix event pending check The DWC3_EVENT_PENDING flag is used to protect against invalid call to top-half interrupt handler, which can occur when there's a delay in software detection of the interrupt line deassertion. However, the clearing of this flag was done prior to unmasking the interrupt line, creating opportunity where the top-half handler can come. This breaks the serialization and creates a race between the top-half and bottom-half handler, resulting in losing synchronization between the controller and the driver when processing events. To fix this, make sure the clearing of the DWC3_EVENT_PENDING is done at the end of the bottom-half handler. Fixes: d325a1de49d6 ("usb: dwc3: gadget: Prevent losing events in event cache") Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Link: https://lore.kernel.org/r/8670aaf1cf52e7d1e6df2a827af2d77263b93b75.1656380429.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman commit a775e4e4941bf2f326aa36c58f67bd6c96cac717 Author: Alex Deucher Date: Mon Jun 20 18:29:39 2022 -0400 Revert "drm/amdgpu/display: set vblank_disable_immediate for DC" This reverts commit 92020e81ddbeac351ea4a19bcf01743f32b9c800. This causes stuttering and timeouts with DMCUB for some users so revert it until we understand why and safely enable it to save power. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1887 Acked-by: Harry Wentland Signed-off-by: Alex Deucher Cc: Nicholas Kazlauskas Cc: stable@vger.kernel.org commit 5cb0e3fb2c54eabfb3f932a1574bff1774946bc0 Author: Ruili Ji Date: Wed Jun 22 14:20:22 2022 +0800 drm/amdgpu: To flush tlb for MMHUB of RAVEN series amdgpu: [mmhub0] no-retry page fault (src_id:0 ring:40 vmid:8 pasid:32769, for process test_basic pid 3305 thread test_basic pid 3305) amdgpu: in page starting at address 0x00007ff990003000 from IH client 0x12 (VMC) amdgpu: VM_L2_PROTECTION_FAULT_STATUS:0x00840051 amdgpu: Faulty UTCL2 client ID: MP1 (0x0) amdgpu: MORE_FAULTS: 0x1 amdgpu: WALKER_ERROR: 0x0 amdgpu: PERMISSION_FAULTS: 0x5 amdgpu: MAPPING_ERROR: 0x0 amdgpu: RW: 0x1 When memory is allocated by kfd, no one triggers the tlb flush for MMHUB0. There is page fault from MMHUB0. v2:fix indentation v3:change subject and fix indentation Signed-off-by: Ruili Ji Reviewed-by: Philip Yang Reviewed-by: Aaron Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 20b8264394b33adb1640a485a62a84bc1388b6a3 Author: Carlos Llamas Date: Tue Jun 21 20:39:21 2022 +0000 drm/fourcc: fix integer type usage in uapi header Kernel uapi headers are supposed to use __[us]{8,16,32,64} types defined by as opposed to 'uint32_t' and similar. See [1] for the relevant discussion about this topic. In this particular case, the usage of 'uint64_t' escaped headers_check as these macros are not being called here. However, the following program triggers a compilation error: #include int main() { unsigned long x = AMD_FMT_MOD_CLEAR(RB); return 0; } gcc error: drm.c:5:27: error: ‘uint64_t’ undeclared (first use in this function) 5 | unsigned long x = AMD_FMT_MOD_CLEAR(RB); | ^~~~~~~~~~~~~~~~~ This patch changes AMD_FMT_MOD_{SET,CLEAR} macros to use the correct integer types, which fixes the above issue. [1] https://lkml.org/lkml/2019/6/5/18 Fixes: 8ba16d599374 ("drm/fourcc: Add AMD DRM modifiers.") Signed-off-by: Carlos Llamas Reviewed-by: Simon Ser Signed-off-by: Alex Deucher commit bbba251577b27422ebe173e1bd006424d6a8cfb3 Author: Alex Deucher Date: Thu Jun 16 16:52:01 2022 -0400 drm/amdgpu: fix adev variable used in amdgpu_device_gpu_recover() Use the correct adev variable for the drm_fb_helper in amdgpu_device_gpu_recover(). Noticed by inspection. Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 30554a1f0fd6a5d2e2413bdc05389995d5611736 Author: Cédric Le Goater Date: Wed Jun 22 18:16:17 2022 +0200 spi: aspeed: Fix division by zero When using the normal read operation for data transfers, the dummy bus width is zero. In that case, they are no dummy bytes to transfer and setting the dummy field in the controller register becomes useless. Issue was found on a custom "Bifrost" board based on the AST2500 SoC and using a MX25L51245GMI-08G SPI Flash. Reported-by: Ian Woloschin Reviewed-by: Pratyush Yadav Tested-by: Ian Woloschin Fixes: 9da06d7bdec7dad80 ("spi: aspeed: Add support for direct mapping") Signed-off-by: Cédric Le Goater Link: https://lore.kernel.org/r/20220622161617.3719096-3-clg@kaod.org Signed-off-by: Mark Brown commit 8988ba7dec43aabd43adb1214b922b8873e9da88 Author: Cédric Le Goater Date: Wed Jun 22 18:16:16 2022 +0200 spi: aspeed: Add dev_dbg() to dump the spi-mem direct mapping descriptor The default value of the control register is set using the direct mapping information passed to the ->dirmap_create() handler. Dump the mapping range and the SPI memory operation characteristics to analyze how the register value has been computed. spi-aspeed-smc 1e630000.spi: CE0 read dirmap [ 0x00000000 - 0x04000000 ] OP 0x6c mode:1.1.1.4 naddr:0x4 ndummies:0x1 ... spi-aspeed-smc 1e630000.spi: CE0 write dirmap [ 0x00000000 - 0x04000000 ] OP 0x12 mode:1.1.0.1 naddr:0x4 ndummies:0x0 Reviewed-by: Paul Menzel Signed-off-by: Cédric Le Goater Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220622161617.3719096-2-clg@kaod.org Signed-off-by: Mark Brown commit d9b2ba67917c18822c6a09af41c32fa161f1606b Merge: 732f30694325a 9ab762a84b809 Author: Linus Torvalds Date: Wed Jun 29 09:32:06 2022 -0700 Merge tag 'platform-drivers-x86-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - thinkpad_acpi/ideapad-laptop: mem-leak and platform-profile fixes - panasonic-laptop: missing hotkey presses regression fix - some hardware-id additions - some other small fixes * tag 'platform-drivers-x86-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: hp-wmi: Ignore Sanitization Mode event platform/x86: thinkpad_acpi: do not use PSC mode on Intel platforms platform/x86: thinkpad-acpi: profile capabilities as integer platform/x86: panasonic-laptop: filter out duplicate volume up/down/mute keypresses platform/x86: panasonic-laptop: don't report duplicate brightness key-presses platform/x86: panasonic-laptop: revert "Resolve hotkey double trigger bug" platform/x86: panasonic-laptop: sort includes alphabetically platform/x86: panasonic-laptop: de-obfuscate button codes ACPI: video: Change how we determine if brightness key-presses are handled platform/x86: ideapad-laptop: Add Ideapad 5 15ITL05 to ideapad_dytc_v4_allow_table[] platform/x86: ideapad-laptop: Add allow_v4_dytc module parameter platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource platform/mellanox: nvsw-sn2201: fix error code in nvsw_sn2201_create_static_devices() platform/x86: intel/pmc: Add Alder Lake N support to PMC core driver commit 732f30694325ab586a4d90412ace81e50dfe448e Merge: 941e3e7912696 067baa9a37b32 Author: Linus Torvalds Date: Wed Jun 29 09:20:40 2022 -0700 Merge tag '5.19-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: - seek null check (don't use f_seek op directly and blindly) - offset validation in FSCTL_SET_ZERO_DATA - fallocate fix (relates e.g. to xfstests generic/091 and 263) - two cleanup fixes - fix socket settings on some arch * tag '5.19-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use vfs_llseek instead of dereferencing NULL ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA ksmbd: set the range of bytes to zero without extending file size in FSCTL_ZERO_DATA ksmbd: remove duplicate flag set in smb2_write ksmbd: smbd: Remove useless license text when SPDX-License-Identifier is already used ksmbd: use SOCK_NONBLOCK type for kernel_accept() commit 8692969e9164c15474b356b9898e5b9b21a85643 Author: Jeff Layton Date: Mon Jun 6 19:31:42 2022 -0400 ceph: wait on async create before checking caps for syncfs Currently, we'll call ceph_check_caps, but if we're still waiting on the reply, we'll end up spinning around on the same inode in flush_dirty_session_caps. Wait for the async create reply before flushing caps. Cc: stable@vger.kernel.org URL: https://tracker.ceph.com/issues/55823 Fixes: fbed7045f552 ("ceph: wait for async create reply before sending any cap messages") Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 8944c6fb8add384154b784a90ceca88a51a8c364 Author: Darrick J. Wong Date: Sat Jun 25 10:47:45 2022 -0700 xfs: dont treat rt extents beyond EOF as eofblocks to be cleared On a system with a realtime volume and a 28k realtime extent, generic/491 fails because the test opens a file on a frozen filesystem and closing it causes xfs_release -> xfs_can_free_eofblocks to mistakenly think that the the blocks of the realtime extent beyond EOF are posteof blocks to be freed. Realtime extents cannot be partially unmapped, so this is pointless. Worse yet, this triggers posteof cleanup, which stalls on a transaction allocation, which is why the test fails. Teach the predicate to account for realtime extents properly. Reviewed-by: Dave Chinner Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit e53bcffad0326c1ef4b4baec4262b5343e420c44 Author: Darrick J. Wong Date: Sat Jun 25 10:01:20 2022 -0700 xfs: don't hold xattr leaf buffers across transaction rolls Now that we've established (again!) that empty xattr leaf buffers are ok, we no longer need to bhold them to transactions when we're creating new leaf blocks. Get rid of the entire mechanism, which should simplify the xattr code quite a bit. The original justification for using bhold here was to prevent the AIL from trying to write the empty leaf block into the fs during the brief time that we release the buffer lock. The reason for /that/ was to prevent recovery from tripping over the empty ondisk block. Reviewed-by: Dave Chinner Signed-off-by: Darrick J. Wong commit 7be3bd8856fba99f8b25b9c223250e42292c312e Author: Darrick J. Wong Date: Fri Jun 24 15:01:28 2022 -0700 xfs: empty xattr leaf header blocks are not corruption TLDR: Revert commit 51e6104fdb95 ("xfs: detect empty attr leaf blocks in xfs_attr3_leaf_verify") because it was wrong. Every now and then we get a corruption report from the kernel or xfs_repair about empty leaf blocks in the extended attribute structure. We've long thought that these shouldn't be possible, but prior to 5.18 one would shake loose in the recoveryloop fstests about once a month. A new addition to the xattr leaf block verifier in 5.19-rc1 makes this happen every 7 minutes on my testing cloud. I added a ton of logging to detect any time we set the header count on an xattr leaf block to zero. This produced the following dmesg output on generic/388: XFS (sda4): ino 0x21fcbaf leaf 0x129bf78 hdcount==0! Call Trace: dump_stack_lvl+0x34/0x44 xfs_attr3_leaf_create+0x187/0x230 xfs_attr_shortform_to_leaf+0xd1/0x2f0 xfs_attr_set_iter+0x73e/0xa90 xfs_xattri_finish_update+0x45/0x80 xfs_attr_finish_item+0x1b/0xd0 xfs_defer_finish_noroll+0x19c/0x770 __xfs_trans_commit+0x153/0x3e0 xfs_attr_set+0x36b/0x740 xfs_xattr_set+0x89/0xd0 __vfs_setxattr+0x67/0x80 __vfs_setxattr_noperm+0x6e/0x120 vfs_setxattr+0x97/0x180 setxattr+0x88/0xa0 path_setxattr+0xc3/0xe0 __x64_sys_setxattr+0x27/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 So now we know that someone is creating empty xattr leaf blocks as part of converting a sf xattr structure into a leaf xattr structure. The conversion routine logs any existing sf attributes in the same transaction that creates the leaf block, so we know this is a setxattr to a file that has no attributes at all. Next, g/388 calls the shutdown ioctl and cycles the mount to trigger log recovery. I also augmented buffer item recovery to call ->verify_struct on any attr leaf blocks and complain if it finds a failure: XFS (sda4): Unmounting Filesystem XFS (sda4): Mounting V5 Filesystem XFS (sda4): Starting recovery (logdev: internal) XFS (sda4): xattr leaf daddr 0x129bf78 hdrcount == 0! Call Trace: dump_stack_lvl+0x34/0x44 xfs_attr3_leaf_verify+0x3b8/0x420 xlog_recover_buf_commit_pass2+0x60a/0x6c0 xlog_recover_items_pass2+0x4e/0xc0 xlog_recover_commit_trans+0x33c/0x350 xlog_recovery_process_trans+0xa5/0xe0 xlog_recover_process_data+0x8d/0x140 xlog_do_recovery_pass+0x19b/0x720 xlog_do_log_recovery+0x62/0xc0 xlog_do_recover+0x33/0x1d0 xlog_recover+0xda/0x190 xfs_log_mount+0x14c/0x360 xfs_mountfs+0x517/0xa60 xfs_fs_fill_super+0x6bc/0x950 get_tree_bdev+0x175/0x280 vfs_get_tree+0x1a/0x80 path_mount+0x6f5/0xaa0 __x64_sys_mount+0x103/0x140 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fc61e241eae And a moment later, the _delwri_submit of the recovered buffers trips the same verifier and recovery fails: XFS (sda4): Metadata corruption detected at xfs_attr3_leaf_verify+0x393/0x420 [xfs], xfs_attr3_leaf block 0x129bf78 XFS (sda4): Unmount and run xfs_repair XFS (sda4): First 128 bytes of corrupted metadata buffer: 00000000: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00 ........;....... 00000010: 00 00 00 00 01 29 bf 78 00 00 00 00 00 00 00 00 .....).x........ 00000020: a5 1b d0 02 b2 9a 49 df 8e 9c fb 8d f8 31 3e 9d ......I......1>. 00000030: 00 00 00 00 02 1f cb af 00 00 00 00 10 00 00 00 ................ 00000040: 00 50 0f b0 00 00 00 00 00 00 00 00 00 00 00 00 .P.............. 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ XFS (sda4): Corruption of in-memory data (0x8) detected at _xfs_buf_ioapply+0x37f/0x3b0 [xfs] (fs/xfs/xfs_buf.c:1518). Shutting down filesystem. XFS (sda4): Please unmount the filesystem and rectify the problem(s) XFS (sda4): log mount/recovery failed: error -117 XFS (sda4): log mount failed I think I see what's going on here -- setxattr is racing with something that shuts down the filesystem: Thread 1 Thread 2 -------- -------- xfs_attr_sf_addname xfs_attr_shortform_to_leaf xfs_trans_bhold(leaf) xattri_dela_state = XFS_DAS_LEAF_ADD xfs_trans_bhold_release(leaf) Thread 3 -------- xlog_recover_buf_commit_pass2 xlog_recover_do_reg_buffer xfs_buf_delwri_queue(leaf) xfs_buf_delwri_submit _xfs_buf_ioapply(leaf) xfs_attr3_leaf_write_verify As you can see, the bhold keeps the leaf buffer locked and thus prevents the *AIL* from tripping over the ichdr.count==0 check in the write verifier. Unfortunately, it doesn't prevent the log from getting flushed to disk, which sets up log recovery to fail. So. It's clear that the kernel has always had the ability to persist attr leaf blocks with ichdr.count==0, which means that it's part of the ondisk format now. Unfortunately, this check has been added and removed multiple times throughout history. It first appeared in[1] kernel 3.10 as part of the early V5 format patches. The check was later discovered to break log recovery and hence disabled[2] during log recovery in kernel 4.10. Simultaneously, the check was added[3] to xfs_repair 4.9.0 to try to weed out the empty leaf blocks. This was still not correct because log recovery would recover an empty attr leaf block successfully only for regular xattr operations to trip over the empty block during of the block during regular operation. Therefore, the check was removed entirely[4] in kernel 5.7 but removal of the xfs_repair check was forgotten. The continued complaints from xfs_repair lead to us mistakenly re-adding[5] the verifier check for kernel 5.19. Remove it once again. [1] 517c22207b04 ("xfs: add CRCs to attr leaf blocks") [2] 2e1d23370e75 ("xfs: ignore leaf attr ichdr.count in verifier during log replay") [3] f7140161 ("xfs_repair: junk leaf attribute if count == 0") [4] f28cef9e4dac ("xfs: don't fail verifier on empty attr3 leaf block") [5] 51e6104fdb95 ("xfs: detect empty attr leaf blocks in xfs_attr3_leaf_verify") Looking at the rest of the xattr code, it seems that files with empty leaf blocks behave as expected -- listxattr reports no attributes; getxattr on any xattr returns nothing as expected; removexattr does nothing; and setxattr can add attributes just fine. Original-bug: 517c22207b04 ("xfs: add CRCs to attr leaf blocks") Still-not-fixed-by: 2e1d23370e75 ("xfs: ignore leaf attr ichdr.count in verifier during log replay") Removed-in: f28cef9e4dac ("xfs: don't fail verifier on empty attr3 leaf block") Fixes: 51e6104fdb95 ("xfs: detect empty attr leaf blocks in xfs_attr3_leaf_verify") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit f43b9876e857c739d407bc56df288b0ebe1a9164 Author: Peter Zijlstra Date: Mon Jun 27 22:21:17 2022 +0000 x86/retbleed: Add fine grained Kconfig knobs Do fine-grained Kconfig for all the various retbleed parts. NOTE: if your compiler doesn't support return thunks this will silently 'upgrade' your mitigation to IBPB, you might not like this. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit f7f70f4aa09dc43d7455c060143e86a017c30548 Author: Ruozhu Li Date: Thu Jun 23 14:45:39 2022 +0800 nvme: fix regression when disconnect a recovering ctrl We encountered a problem that the disconnect command hangs. After analyzing the log and stack, we found that the triggering process is as follows: CPU0 CPU1 nvme_rdma_error_recovery_work nvme_rdma_teardown_io_queues nvme_do_delete_ctrl nvme_stop_queues nvme_remove_namespaces --clear ctrl->namespaces nvme_start_queues --no ns in ctrl->namespaces nvme_ns_remove return(because ctrl is deleting) blk_freeze_queue blk_mq_freeze_queue_wait --wait for ns to unquiesce to clean infligt IO, hang forever This problem was not found in older kernels because we will flush err work in nvme_stop_ctrl before nvme_remove_namespaces.It does not seem to be modified for functional reasons, the patch can be revert to solve the problem. Revert commit 794a4cb3d2f7 ("nvme: remove the .stop_ctrl callout") Signed-off-by: Ruozhu Li Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 1629de0e0373e04d68e88e6d9d3071fbf70b7ea8 Author: Pablo Greco Date: Sat Jun 25 09:15:02 2022 -0300 nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G) ADATA XPG SPECTRIX S40G drives report bogus eui64 values that appear to be the same across drives in one system. Quirk them out so they are not marked as "non globally unique" duplicates. Before: [ 2.258919] nvme nvme1: pci function 0000:06:00.0 [ 2.264898] nvme nvme2: pci function 0000:05:00.0 [ 2.323235] nvme nvme1: failed to set APST feature (2) [ 2.326153] nvme nvme2: failed to set APST feature (2) [ 2.333935] nvme nvme1: allocated 64 MiB host memory buffer. [ 2.336492] nvme nvme2: allocated 64 MiB host memory buffer. [ 2.339611] nvme nvme1: 7/0/0 default/read/poll queues [ 2.341805] nvme nvme2: 7/0/0 default/read/poll queues [ 2.346114] nvme1n1: p1 [ 2.347197] nvme nvme2: globally duplicate IDs for nsid 1 After: [ 2.427715] nvme nvme1: pci function 0000:06:00.0 [ 2.427771] nvme nvme2: pci function 0000:05:00.0 [ 2.488154] nvme nvme2: failed to set APST feature (2) [ 2.489895] nvme nvme1: failed to set APST feature (2) [ 2.498773] nvme nvme2: allocated 64 MiB host memory buffer. [ 2.500587] nvme nvme1: allocated 64 MiB host memory buffer. [ 2.504113] nvme nvme2: 7/0/0 default/read/poll queues [ 2.507026] nvme nvme1: 7/0/0 default/read/poll queues [ 2.509467] nvme nvme2: Ignoring bogus Namespace Identifiers [ 2.512804] nvme nvme1: Ignoring bogus Namespace Identifiers [ 2.513698] nvme1n1: p1 Signed-off-by: Pablo Greco Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Cc: Signed-off-by: Christoph Hellwig commit 41d07df7de841bfbc32725ce21d933ad358f2844 Author: Sagi Grimberg Date: Sun Jun 26 12:24:51 2022 +0300 nvme-tcp: always fail a request when sending it failed queue stoppage and inflight requests cancellation is fully fenced from io_work and thus failing a request from this context. Hence we don't need to try to guess from the socket retcode if this failure is because the queue is about to be torn down or not. We are perfectly safe to just fail it, the request will not be cancelled later on. This solves possible very long shutdown delays when the users issues a 'nvme disconnect-all' Reported-by: Daniel Wagner Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit ed0691cf55140ce0f3fb100225645d902cce904b Author: Sagi Grimberg Date: Fri Jun 24 00:49:53 2022 +0300 nvmet-tcp: fix regression in data_digest calculation Data digest calculation iterates over command mapped iovec. However since commit bac04454ef9f we unmap the iovec before we handle the data digest, and since commit 69b85e1f1d1d we clear nr_mapped when we unmap the iov. Instead of open-coding the command iov traversal, simply call crypto_ahash_digest with the command sg that is already allocated (we already do that for the send path). Rename nvmet_tcp_send_ddgst to nvmet_tcp_calc_ddgst and call it from send and recv paths. Fixes: 69b85e1f1d1d ("nvmet-tcp: add an helper to free the cmd buffers") Fixes: bac04454ef9f ("nvmet-tcp: fix kmap leak when data digest in use") Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit a57f68ddc8865d59a19783080cc52fb4a11dc209 Author: Serge Semin Date: Fri Jun 24 17:18:45 2022 +0300 reset: Fix devm bulk optional exclusive control getter Most likely due to copy-paste mistake the device managed version of the denoted reset control getter has been implemented with invalid semantic, which can be immediately spotted by having "WARN_ON(shared && acquired)" warning in the system log as soon as the method is called. Anyway let's fix it by altering the boolean arguments passed to the __devm_reset_control_bulk_get() method from - shared = true, optional = false, acquired = true to + shared = false, optional = true, acquired = true That's what they were supposed to be in the first place (see the non-devm version of the same method: reset_control_bulk_get_optional_exclusive()). Fixes: 48d71395896d ("reset: Add reset_control_bulk API") Signed-off-by: Serge Semin Reviewed-by: Dmitry Osipenko Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220624141853.7417-2-Sergey.Semin@baikalelectronics.ru commit a5bdaae7ae596686b83a8a5038ee6d9afeb24531 Author: Lukas Bulwahn Date: Wed Jun 1 10:22:39 2022 +0200 MAINTAINERS: rectify entry for SYNOPSYS AXS10x RESET CONTROLLER DRIVER Commit 820f722c05dd ("dt-bindings: reset: snps,axs10x-reset: Convert to yaml") converts snps,axs10x-reset.txt to yaml, but misses to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in SYNOPSYS AXS10x RESET CONTROLLER DRIVER. Signed-off-by: Lukas Bulwahn Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220601082239.12009-1-lukas.bulwahn@gmail.com commit 9577fc5fdc8b07b891709af6453545db405e24ad Author: Michael Walle Date: Mon Jun 27 19:06:43 2022 +0200 NFC: nxp-nci: don't print header length mismatch on i2c error Don't print a misleading header length mismatch error if the i2c call returns an error. Instead just return the error code without any error message. Signed-off-by: Michael Walle Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit eddd95b9423946aaacb55cac6a9b2cea8ab944fc Author: Michael Walle Date: Mon Jun 27 19:06:42 2022 +0200 NFC: nxp-nci: Don't issue a zero length i2c_master_read() There are packets which doesn't have a payload. In that case, the second i2c_master_read() will have a zero length. But because the NFC controller doesn't have any data left, it will NACK the I2C read and -ENXIO will be returned. In case there is no payload, just skip the second i2c master read. Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") Signed-off-by: Michael Walle Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c Author: Hangyu Hua Date: Wed Jun 29 14:34:18 2022 +0800 net: tipc: fix possible refcount leak in tipc_sk_create() Free sk in case tipc_sk_insert() fails. Signed-off-by: Hangyu Hua Reviewed-by: Tung Nguyen Signed-off-by: David S. Miller commit ac790d09885d36143076e7e02825c541e8eee899 Author: Aneesh Kumar K.V Date: Wed Jun 29 10:39:25 2022 +0530 powerpc/memhotplug: Add add_pages override for PPC With commit ffa0b64e3be5 ("powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit") the kernel now validate the addr against high_memory value. This results in the below BUG_ON with dax pfns. [ 635.798741][T26531] kernel BUG at mm/page_alloc.c:5521! 1:mon> e cpu 0x1: Vector: 700 (Program Check) at [c000000007287630] pc: c00000000055ed48: free_pages.part.0+0x48/0x110 lr: c00000000053ca70: tlb_finish_mmu+0x80/0xd0 sp: c0000000072878d0 msr: 800000000282b033 current = 0xc00000000afabe00 paca = 0xc00000037ffff300 irqmask: 0x03 irq_happened: 0x05 pid = 26531, comm = 50-landscape-sy kernel BUG at :5521! Linux version 5.19.0-rc3-14659-g4ec05be7c2e1 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #625 SMP Thu Jun 23 00:35:43 CDT 2022 1:mon> t [link register ] c00000000053ca70 tlb_finish_mmu+0x80/0xd0 [c0000000072878d0] c00000000053ca54 tlb_finish_mmu+0x64/0xd0 (unreliable) [c000000007287900] c000000000539424 exit_mmap+0xe4/0x2a0 [c0000000072879e0] c00000000019fc1c mmput+0xcc/0x210 [c000000007287a20] c000000000629230 begin_new_exec+0x5e0/0xf40 [c000000007287ae0] c00000000070b3cc load_elf_binary+0x3ac/0x1e00 [c000000007287c10] c000000000627af0 bprm_execve+0x3b0/0xaf0 [c000000007287cd0] c000000000628414 do_execveat_common.isra.0+0x1e4/0x310 [c000000007287d80] c00000000062858c sys_execve+0x4c/0x60 [c000000007287db0] c00000000002c1b0 system_call_exception+0x160/0x2c0 [c000000007287e10] c00000000000c53c system_call_common+0xec/0x250 The fix is to make sure we update high_memory on memory hotplug. This is similar to what x86 does in commit 3072e413e305 ("mm/memory_hotplug: introduce add_pages") Fixes: ffa0b64e3be5 ("powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit") Signed-off-by: Aneesh Kumar K.V Reviewed-by: Kefeng Wang Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220629050925.31447-1-aneesh.kumar@linux.ibm.com commit b21bd5a4b130f8370861478d2880985daace5913 Author: Naveen N. Rao Date: Tue Jun 28 00:41:19 2022 +0530 powerpc/bpf: Fix use of user_pt_regs in uapi Trying to build a .c file that includes : $ cat test_bpf_headers.c #include throws the below error: /usr/include/linux/bpf_perf_event.h:14:28: error: field ‘regs’ has incomplete type 14 | bpf_user_pt_regs_t regs; | ^~~~ This is because we typedef bpf_user_pt_regs_t to 'struct user_pt_regs' in arch/powerpc/include/uaps/asm/bpf_perf_event.h, but 'struct user_pt_regs' is not exposed to userspace. Powerpc has both pt_regs and user_pt_regs structures. However, unlike arm64 and s390, we expose user_pt_regs to userspace as just 'pt_regs'. As such, we should typedef bpf_user_pt_regs_t to 'struct pt_regs' for userspace. Within the kernel though, we want to typedef bpf_user_pt_regs_t to 'struct user_pt_regs'. Remove arch/powerpc/include/uapi/asm/bpf_perf_event.h so that the uapi/asm-generic version of the header is exposed to userspace. Introduce arch/powerpc/include/asm/bpf_perf_event.h so that we can typedef bpf_user_pt_regs_t to 'struct user_pt_regs' for use within the kernel. Note that this was not showing up with the bpf selftest build since tools/include/uapi/asm/bpf_perf_event.h didn't include the powerpc variant. Fixes: a6460b03f945ee ("powerpc/bpf: Fix broken uapi for BPF_PROG_TYPE_PERF_EVENT") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Naveen N. Rao [mpe: Use typical naming for header include guard] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220627191119.142867-1-naveen.n.rao@linux.vnet.ibm.com commit 8d70f33ed7207e82e51d5a4436c8ba2268a83b14 Author: Vinayak Yadawad Date: Wed Jun 22 19:17:39 2022 +0530 wifi: cfg80211: Allow P2P client interface to indicate port authorization In case of 4way handshake offload, cfg80211_port_authorized enables driver to indicate successful 4way handshake to cfg80211 layer. Currently this path of port authorization is restricted to interface type NL80211_IFTYPE_STATION. This patch extends the use of port authorization API for P2P client as well. Signed-off-by: Vinayak Yadawad Link: https://lore.kernel.org/r/ef25cb49fcb921df2e5d99e574f65e8a009cc52c.1655905440.git.vinayak.yadawad@broadcom.com Signed-off-by: Johannes Berg commit f856373e2f31ffd340e47e2b00027bd4070f74b3 Author: Felix Fietkau Date: Tue May 31 21:08:24 2022 +0200 wifi: mac80211: do not wake queues on a vif that is being stopped When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs can still be called on it, which crashes as soon as sdata->bss is being dereferenced. To fix this properly, check for SDATA_STATE_RUNNING before waking queues, and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs observes the change when running on a different CPU) Signed-off-by: Felix Fietkau Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20220531190824.60019-1-nbd@nbd.name Signed-off-by: Johannes Berg commit a4926abb787e2ef3ee2997e6ca8844d859478647 Author: Ryder Lee Date: Thu May 26 21:35:32 2022 +0800 wifi: mac80211: check skb_shared in ieee80211_8023_xmit() Add a missing skb_shared check into 802.3 path to prevent potential use-after-free from happening. This also uses skb_share_check() instead of open-coding in tx path. Signed-off-by: Ryder Lee Link: https://lore.kernel.org/r/e7a73aaf7742b17e43421c56625646dfc5c4d2cb.1653571902.git.ryder.lee@mediatek.com Signed-off-by: Johannes Berg commit 03895c8414d748747900ede2cb603d0ed3eeae1c Author: Lorenzo Bianconi Date: Fri Jun 17 00:42:12 2022 +0200 wifi: mac80211: add gfp_t parameter to ieeee80211_obss_color_collision_notify Introduce the capability to specify gfp_t parameter to ieeee80211_obss_color_collision_notify routine since it runs in interrupt context in ieee80211_rx_check_bss_color_collision(). Fixes: 6d945a33f2b0a ("mac80211: introduce BSS color collision detection") Co-developed-by: Ryder Lee Signed-off-by: Ryder Lee Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/02c990fb3fbd929c8548a656477d20d6c0427a13.1655419135.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit 3f3558c8054f82950b6decf928738306f556edf3 Author: Johannes Berg Date: Mon Jun 13 23:04:01 2022 +0200 wifi: mac80211_hwsim: set virtio device ready in probe() Just like a similar commit to arch/um/drivers/virt-pci.c, call virtio_device_ready() to make this driver work after commit b4ec69d7e09 ("virtio: harden vring IRQ"), since the driver uses the virtqueues in the probe function. (The virtio core sets the device ready when probe returns.) Fixes: 8b4ec69d7e09 ("virtio: harden vring IRQ") Fixes: 5d44fe7c9808 ("mac80211_hwsim: add frame transmission support over virtio") Signed-off-by: Johannes Berg Acked-by: Jason Wang Link: https://lore.kernel.org/r/20220613210401.327958-1-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit ee7a69aa38d87a3bbced7b8245c732c05ed0c6ec Author: Javier Martinez Canillas Date: Tue Jun 7 20:23:36 2022 +0200 fbdev: Disable sysfb device registration when removing conflicting FBs The platform devices registered by sysfb match with firmware-based DRM or fbdev drivers, that are used to have early graphics using a framebuffer provided by the system firmware. DRM or fbdev drivers later are probed and remove conflicting framebuffers, leading to these platform devices for generic drivers to be unregistered. But the current solution has a race, since the sysfb_init() function could be called after a DRM or fbdev driver is probed and request to unregister the devices for drivers with conflicting framebuffes. To prevent this, disable any future sysfb platform device registration by calling sysfb_disable(), if a driver requests to remove the conflicting framebuffers. Suggested-by: Daniel Vetter Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220607182338.344270-4-javierm@redhat.com commit bde376e9de3c0bc55eedc8956b0f114c05531595 Author: Javier Martinez Canillas Date: Tue Jun 7 20:23:35 2022 +0200 firmware: sysfb: Add sysfb_disable() helper function This can be used by subsystems to unregister a platform device registered by sysfb and also to disable future platform device registration in sysfb. Suggested-by: Daniel Vetter Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220607182338.344270-3-javierm@redhat.com commit 9e121040e54abef9ed5542e5fdfa87911cd96204 Author: Javier Martinez Canillas Date: Tue Jun 7 20:23:34 2022 +0200 firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer This function just returned 0 on success or an errno code on error, but it could be useful for sysfb_init() callers to have a pointer to the device. Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Vetter Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20220607182338.344270-2-javierm@redhat.com commit e35f5718903b093be4b1d3833aa8a32f864a3ef1 Author: Vishal Verma Date: Tue Jun 28 16:01:09 2022 -0600 cxl/mbox: Fix missing variable payload checks in cmd size validation The conversion of command sizes to unsigned missed a couple of checks against variable size payloads during command validation, which made all variable payload commands unconditionally fail. Add the checks back using the new CXL_VARIABLE_PAYLOAD scheme. Fixes: 26f89535a5bb ("cxl/mbox: Use type __u32 for mailbox payload sizes") Cc: Cc: Ira Weiny Cc: Dan Williams Cc: Alison Schofield Reported-by: Abhi Cs Reviewed-by: Dan Williams Reviewed-by: Alison Schofield Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20220628220109.633564-1-vishal.l.verma@intel.com Signed-off-by: Dan Williams commit 5a478a653b4cca148d5c89832f007ec0809d7e6d Author: Krzysztof Kozlowski Date: Mon Jun 27 14:40:48 2022 +0200 nfc: nfcmrvl: Fix irq_of_parse_and_map() return value The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. Reported-by: Lv Ruyi Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220627124048.296253-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 53ad46169fe2996fe1b623ba6c9c4fa33847876f Author: YueHaibing Date: Tue Jun 28 11:31:34 2022 +0800 net: ipv6: unexport __init-annotated seg6_hmac_net_init() As of commit 5801f064e351 ("net: ipv6: unexport __init-annotated seg6_hmac_init()"), EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. This remove the EXPORT_SYMBOL to fix modpost warning: WARNING: modpost: vmlinux.o(___ksymtab+seg6_hmac_net_init+0x0): Section mismatch in reference from the variable __ksymtab_seg6_hmac_net_init to the function .init.text:seg6_hmac_net_init() The symbol seg6_hmac_net_init is exported and annotated __init Fix this by removing the __init annotation of seg6_hmac_net_init or drop the export. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Reported-by: Hulk Robot Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20220628033134.21088-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 76f0544428aced9e2f0d50ac7429e0f3064658cd Merge: 03c765b0e3b4c 08de214138cde Author: Dave Airlie Date: Wed Jun 29 14:16:46 2022 +1000 Merge tag 'drm-msm-fixes-2022-06-28' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v5.19-rc5 - Fix to increment vsync_cnt before calling drm_crtc_handle_vblank so that userspace sees the value *after* it is incremented if waiting for vblank events - Fix to reset drm_dev to NULL in dp_display_unbind to avoid a crash in probe/bind error paths - Fix to resolve the smatch error of de-referencing before NULL check in dpu_encoder_phys_wb.c - Fix error return to userspace if fence-id allocation fails in submit ioctl Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvswNKdd02EYKYv5Zjv7f+mcqeWC7hHQ1SBjqYzN_ZHnA@mail.gmail.com commit adabdd8f6acabc0c3fdbba2e7f5a2edd9c5ef22d Author: katrinzhou Date: Tue Jun 28 11:50:30 2022 +0800 ipv6/sit: fix ipip6_tunnel_get_prl return value When kcalloc fails, ipip6_tunnel_get_prl() should return -ENOMEM. Move the position of label "out" to return correctly. Addresses-Coverity: ("Unused value") Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.") Signed-off-by: katrinzhou Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220628035030.1039171-1-zys.zljxml@gmail.com Signed-off-by: Jakub Kicinski commit bce3bb30b266a12fa32d4f08bdaf59a03887f802 Merge: ab84db251c04d fd37c2ecb21f7 Author: Jakub Kicinski Date: Tue Jun 28 20:45:46 2022 -0700 Merge branch 'mptcp-fixes-for-5-19' Mat Martineau says: ==================== mptcp: Fixes for 5.19 Several categories of fixes from the mptcp tree: Patches 1-3 are fixes related to MP_FAIL and FASTCLOSE, to make sure MIBs are accurate, and to handle MP_FAIL transmission and responses at the correct times. sk_timer conflicts are also resolved. Patches 4 and 6 handle two separate race conditions, one at socket shutdown and one with unaccepted subflows. Patch 5 makes sure read operations are not blocked during fallback to TCP. Patch 7 improves the diag selftest, which were incorrectly failing on slow machines (like the VMs used for CI testing). Patch 8 avoids possible symbol redefinition errors in the userspace mptcp.h file. Patch 9 fixes a selftest build issue with gcc 12. ==================== Link: https://lore.kernel.org/r/20220628010243.166605-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit fd37c2ecb21f7aee04ccca5f561469f07d00063c Author: Mat Martineau Date: Mon Jun 27 18:02:43 2022 -0700 selftests: mptcp: Initialize variables to quiet gcc 12 warnings In a few MPTCP selftest tools, gcc 12 complains that the 'sock' variable might be used uninitialized. This is a false positive because the only code path that could lead to uninitialized access is where getaddrinfo() fails, but the local xgetaddrinfo() wrapper exits if such a failure occurs. Initialize the 'sock' variable anyway to allow the tools to build with gcc 12. Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Acked-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 06e445f740c1a0fe5d16b3dff8a4ef18e124e54e Author: Ossama Othman Date: Mon Jun 27 18:02:42 2022 -0700 mptcp: fix conflict with Including before the C library header causes symbol redefinition errors at compile-time due to duplicate declarations and definitions in the header included by . Explicitly include before in when __KERNEL__ is not defined so that the C library compatibility logic in is enabled when including in user space code. Fixes: c11c5906bc0a ("mptcp: add MPTCP_SUBFLOW_ADDRS getsockopt support") Signed-off-by: Ossama Othman Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 42fb6cddec3b306c9f6ef136b6438e0de1836431 Author: Paolo Abeni Date: Mon Jun 27 18:02:41 2022 -0700 selftests: mptcp: more stable diag tests The mentioned test-case still use an hard-coded-len sleep to wait for a relative large number of connection to be established. On very slow VM and with debug build such timeout could be exceeded, causing failures in our CI. Address the issue polling for the expected condition several times, up to an unreasonable high amount of time. On reasonably fast system the self-tests will be faster then before, on very slow one we will still catch the correct condition. Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 Author: Paolo Abeni Date: Mon Jun 27 18:02:40 2022 -0700 mptcp: fix race on unaccepted mptcp sockets When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP sockets. The mptcp socket's worker can run in the time interval between such delete operations. When that happens, any access to msk->first will cause an UaF access, as the subflow cleanup did not cleared such field in the mptcp socket. Address the issue explicitly traversing the listener socket accept queue at close time and performing the needed cleanup on the pending msk. Note that the locking is a bit tricky, as we need to acquire the msk socket lock, while still owning the subflow socket one. Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit f745a3ebdfb9041d3a55e66eb345895cd8ecc90c Author: Paolo Abeni Date: Mon Jun 27 18:02:39 2022 -0700 mptcp: consistent map handling on failure When the MPTCP receive path reach a non fatal fall-back condition, e.g. when the MPC sockets must fall-back to TCP, the existing code is a little self-inconsistent: it reports that new data is available - return true - but sets the MPC flag to the opposite value. As the consequence read operations in some exceptional scenario may block unexpectedly. Address the issue setting the correct MPC read status. Additionally avoid some code duplication in the fatal fall-back scenario. Fixes: 9c81be0dbc89 ("mptcp: add MP_FAIL response support") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit d51991e2e31477853e5b9c1005ac617707077286 Author: Paolo Abeni Date: Mon Jun 27 18:02:38 2022 -0700 mptcp: fix shutdown vs fallback race If the MPTCP socket shutdown happens before a fallback to TCP, and all the pending data have been already spooled, we never close the TCP connection. Address the issue explicitly checking for critical condition at fallback time. Fixes: 1e39e5a32ad7 ("mptcp: infinite mapping sending") Fixes: 0348c690ed37 ("mptcp: add the fallback check") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 76a13b315709b5b65a7b65caf9ede9a8a38d8930 Author: Geliang Tang Date: Mon Jun 27 18:02:37 2022 -0700 mptcp: invoke MP_FAIL response when needed mptcp_mp_fail_no_response shouldn't be invoked on each worker run, it should be invoked only when MP_FAIL response timeout occurs. This patch refactors the MP_FAIL response logic. It leverages the fact that only the MPC/first subflow can gracefully fail to avoid unneeded subflows traversal: the failing subflow can be only msk->first. A new 'fail_tout' field is added to the subflow context to record the MP_FAIL response timeout and use such field to reliably share the timeout timer between the MP_FAIL event and the MPTCP socket close timeout. Finally, a new ack is generated to send out MP_FAIL notification as soon as we hit the relevant condition, instead of waiting a possibly unbound time for the next data packet. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/281 Fixes: d9fb797046c5 ("mptcp: Do not traverse the subflow connection list without lock") Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 31bf11de146c3f8892093ff39f8f9b3069d6a852 Author: Paolo Abeni Date: Mon Jun 27 18:02:36 2022 -0700 mptcp: introduce MAPPING_BAD_CSUM This allow moving a couple of conditional out of the fast path, making the code more easy to follow and will simplify the next patch. Fixes: ae66fb2ba6c3 ("mptcp: Do TCP fallback on early DSS checksum failure") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 0c1f78a49af721490a5ad70b73e8b4d382465dae Author: Paolo Abeni Date: Mon Jun 27 18:02:35 2022 -0700 mptcp: fix error mibs accounting The current accounting for MP_FAIL and FASTCLOSE is not very accurate: both can be increased even when the related option is not really sent. Move the accounting into the correct place. Fixes: eb7f33654dc1 ("mptcp: add the mibs for MP_FAIL") Fixes: 1e75629cb964 ("mptcp: add the mibs for MP_FASTCLOSE") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit a4ab14e1d8fe83cc1ed8910b788117ec2ed25179 Author: John Hubbard Date: Mon Jun 27 18:23:53 2022 -0700 gen_compile_commands: handle multiple lines per .mod file scripts/clang-tools/gen_compile_commands.py incorrectly assumes that each .mod file only contains one line. That assumption was correct when the script was originally created, but commit 9413e7640564 ("kbuild: split the second line of *.mod into *.usyms") changed the .mod file format so that there is one entry per line, and potentially many lines. The problem can be reproduced by using Kbuild to generate compile_commands.json, like this: make CC=clang compile_commands.json In many cases, the problem might be overlooked because many subsystems only have one line anyway. However, in some subsystems (Nouveau, with 762 entries, is a notable example) it results in skipping most of the subsystem. Fix this by fully processing each .mod file. Fixes: 9413e7640564 ("kbuild: split the second line of *.mod into *.usyms") Signed-off-by: John Hubbard Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 512d1999b8e94a5d43fba3afc73e774849674742 Author: Ivan Malov Date: Tue Jun 28 12:18:48 2022 +0300 xsk: Clear page contiguity bit when unmapping pool When a XSK pool gets mapped, xp_check_dma_contiguity() adds bit 0x1 to pages' DMA addresses that go in ascending order and at 4K stride. The problem is that the bit does not get cleared before doing unmap. As a result, a lot of warnings from iommu_dma_unmap_page() are seen in dmesg, which indicates that lookups by iommu_iova_to_phys() fail. Fixes: 2b43470add8c ("xsk: Introduce AF_XDP buffer allocation API") Signed-off-by: Ivan Malov Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20220628091848.534803-1-ivan.malov@oktetlabs.ru commit 9ab762a84b8094540c18a170e5ddd6488632c456 Author: Kai-Heng Feng Date: Tue Jun 28 20:37:26 2022 +0800 platform/x86: hp-wmi: Ignore Sanitization Mode event After system resume the hp-wmi driver may complain: [ 702.620180] hp_wmi: Unknown event_id - 23 - 0x0 According to HP it means 'Sanitization Mode' and it's harmless to just ignore the event. Cc: Jorge Lopez Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20220628123726.250062-1-kai.heng.feng@canonical.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit bce6243f767f7da88aa4674d5d678f9f156eaba9 Author: Mark Pearson Date: Mon Jun 27 14:14:49 2022 -0400 platform/x86: thinkpad_acpi: do not use PSC mode on Intel platforms PSC platform profile mode is only supported on Linux for AMD platforms. Some older Intel platforms (e.g T490) are advertising it's capability as Windows uses it - but on Linux we should only be using MMC profile for Intel systems. Add a check to prevent it being enabled incorrectly. Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20220627181449.3537-1-markpearson@lenovo.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 42504af775361ca2330a2bfde496a5ebc5655c86 Author: Mark Pearson Date: Fri Jun 3 13:02:09 2022 -0400 platform/x86: thinkpad-acpi: profile capabilities as integer Currently the active mode (PSC/MMC) is stored in an enum and queried throughout the driver. Other driver changes will enumerate additional submodes that are relevant to be tracked, so instead track PSC/MMC in a single integer variable. Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20220603170212.164963-1-markpearson@lenovo.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit aacb455dfe01b7a24a792a2fbe7a04112ce8321d Author: Hans de Goede Date: Fri Jun 24 13:23:39 2022 +0200 platform/x86: panasonic-laptop: filter out duplicate volume up/down/mute keypresses On some Panasonic models the volume up/down/mute keypresses get reported both through the Panasonic ACPI HKEY interface as well as through the atkbd device. Filter out the atkbd scan-codes for these to avoid reporting presses twice. Note normally we would leave the filtering of these to userspace by mapping the scan-codes to KEY_UNKNOWN through /lib/udev/hwdb.d/60-keyboard.hwdb. However in this case that would cause regressions since we were filtering the Panasonic ACPI HKEY events before, so filter these in the kernel. Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Reported-and-tested-by: Stefan Seyfried Reported-and-tested-by: Kenneth Chan Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-7-hdegoede@redhat.com commit 1f2c9de83a50447a2d7166f6273ab0c0e97cd68e Author: Hans de Goede Date: Fri Jun 24 13:23:38 2022 +0200 platform/x86: panasonic-laptop: don't report duplicate brightness key-presses The brightness key-presses might also get reported by the ACPI video bus, check for this and in this case don't report the presses to avoid reporting 2 presses for a single key-press. Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Reported-and-tested-by: Stefan Seyfried Reported-and-tested-by: Kenneth Chan Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-6-hdegoede@redhat.com commit 83a5ddc3dc561c40d948b85553514aaba99123d8 Author: Hans de Goede Date: Fri Jun 24 13:23:37 2022 +0200 platform/x86: panasonic-laptop: revert "Resolve hotkey double trigger bug" In hindsight blindly throwing away most of the key-press events is not a good idea. So revert commit ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug"). Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Reported-and-tested-by: Stefan Seyfried Reported-and-tested-by: Kenneth Chan Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-5-hdegoede@redhat.com commit fe4326c8d18dc8a54affdc9ab269ad92dafef659 Author: Hans de Goede Date: Fri Jun 24 13:23:36 2022 +0200 platform/x86: panasonic-laptop: sort includes alphabetically Sort includes alphabetically, small cleanup patch in preparation of further changes. Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-4-hdegoede@redhat.com commit 65a3e6c8d3f7c346813a05f3d76fc46b640d76d6 Author: Stefan Seyfried Date: Fri Jun 24 13:23:35 2022 +0200 platform/x86: panasonic-laptop: de-obfuscate button codes In the definition of panasonic_keymap[] the key codes are given in decimal, later checks are done with hexadecimal values, which does not help in understanding the code. Additionally use two helper variables to shorten the code and make the logic more obvious. Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Signed-off-by: Stefan Seyfried Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-3-hdegoede@redhat.com commit 3a0cf7ab8df3878a7e2f3d29275b785cf4e7afb6 Author: Hans de Goede Date: Fri Jun 24 13:23:34 2022 +0200 ACPI: video: Change how we determine if brightness key-presses are handled Some systems have an ACPI video bus but not ACPI video devices with backlight capability. On these devices brightness key-presses are (logically) not reported through the ACPI video bus. Change how acpi_video_handles_brightness_key_presses() determines if brightness key-presses are handled by the ACPI video driver to avoid vendor specific drivers/platform/x86 drivers filtering out their brightness key-presses even though they are the only ones reporting these presses. Fixes: ed83c9171829 ("platform/x86: panasonic-laptop: Resolve hotkey double trigger bug") Reported-and-tested-by: Stefan Seyfried Reported-and-tested-by: Kenneth Chan Signed-off-by: Hans de Goede Acked-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220624112340.10130-2-hdegoede@redhat.com commit 7fe718fb8f3f543da1f04ca08bf652dd2afb55f8 Author: Arnaldo Carvalho de Melo Date: Sun May 9 09:39:02 2021 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: bfbab44568779e16 ("KVM: arm64: Implement PSCI SYSTEM_SUSPEND") 7b33a09d036ffd9a ("KVM: arm64: Add support for userspace to suspend a vCPU") ffbb61d09fc56c85 ("KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl.") 661a20fab7d156cf ("KVM: x86/xen: Advertise and document KVM_XEN_HVM_CONFIG_EVTCHN_SEND") fde0451be8fb3208 ("KVM: x86/xen: Support per-vCPU event channel upcall via local APIC") 28d1629f751c4a5f ("KVM: x86/xen: Kernel acceleration for XENVER_version") 536395260582be74 ("KVM: x86/xen: handle PV timers oneshot mode") 942c2490c23f2800 ("KVM: x86/xen: Add KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID") 2fd6df2f2b47d430 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") 35025735a79eaa89 ("KVM: x86/xen: Support direct injection of event channel events") That automatically adds support for this new ioctl: $ tools/perf/trace/beauty/kvm_ioctl.sh > before $ cp include/uapi/linux/kvm.h tools/include/uapi/linux/kvm.h $ tools/perf/trace/beauty/kvm_ioctl.sh > after $ diff -u before after --- before 2022-06-28 12:13:07.281150509 -0300 +++ after 2022-06-28 12:13:16.423392896 -0300 @@ -98,6 +98,7 @@ [0xcc] = "GET_SREGS2", [0xcd] = "SET_SREGS2", [0xce] = "GET_STATS_FD", + [0xd0] = "XEN_HVM_EVTCHN_SEND", [0xe0] = "CREATE_DEVICE", [0xe1] = "SET_DEVICE_ATTR", [0xe2] = "GET_DEVICE_ATTR", $ This silences these perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: David Woodhouse Cc: Ian Rogers Cc: Jiri Olsa Cc: Joao Martins Cc: Marc Zyngier Cc: Namhyung Kim Cc: Oliver Upton Cc: Paolo Bonzini Link: http://lore.kernel.org/lkml/Yrs4RE+qfgTaWdAt@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 32df6fe110c443763d6749a758f33a7117ec1270 Author: Alexei Starovoitov Date: Mon Jun 27 20:22:55 2022 +0200 bpf, docs: Better scale maintenance of BPF subsystem The BPF subsystem consists of a large number of pieces. There is not a single person that understands it all. Yet reviews are crucially important for the BPF community to provide productive quality feedback to contributors in a timely manner and therefore to ultimately expand the number of active developers in the community. So far, the BPF community had a two-stage review system, that is, a weekly rotation among 7 developers (Alexei, Daniel, Andrii, Martin, Song, Yonghong, John) as a first-level review of all inbound patches accompanied by a BPF CI system which runs the in-tree BPF selftests to check for regressions for every new patch, and then, a final check by Alexei, Daniel, Andrii to apply the patches to either bpf or bpf-next trees. This system worked well for the last ~3.5 years, but clearly reaches its limits these days as it does not scale enough. Especially, as we also need to allow enough room for every developer to contribute patches themselves, integrate with their day to day job, and in particular avoid burnout. We want to better scale both horizontally and vertically going forward. On the horizontal scale, we are adding more developers (KP, Stan, Hao, Jiri) to the overall core reviewer team, thus growing to 11 people in total. The weekly rotation for the horizontal oncall reviewer is shortened to 1/2 week (Mo - Wed and Thur - Fri). Instead of just patches, the coverage however extends also generally to triage and reply to mailing list traffic (e.g. RFCs, questions, etc). On the vertical scale, there is clearly a need for deep expertise areas to assign dedicated maintainer/reviewer teams that are responsible for code reviews and help with design of individual building blocks. To some degree we have been doing this implicitly, but the point is to formalize the teams and commitment. There is an overlap between areas and boundaries are intentionally grey. These additional entries provide a guidance on who has to look at the patches. The patch series which span multiple areas will be looked at by multiple people. The vertical review with areas of deep expertise are bundled at the same time with the horizontal side. This patch cleans up a bit the BPF entries, adds mentioned developers to the horizontal scale and creates new sub-entries with teams for developers committing to the above outlined vertical scale. Also, pw.git tools we use for BPF tree maintenance have been updated with a new pw-schedule script to semi-automate vertical oncall review rotation. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Song Liu Acked-by: Yonghong Song Acked-by: Mykola Lysenko Acked-by: John Fastabend Acked-by: Jiri Olsa Acked-by: KP Singh Acked-by: Stanislav Fomichev Acked-by: Hao Luo Acked-by: Quentin Monnet Link: https://git.kernel.org/pub/scm/linux/kernel/git/dborkman/pw.git Link: https://lore.kernel.org/bpf/5bdc73e7f5a087299589944fa074563cdf2c2c1a.1656353995.git.daniel@iogearbox.net commit 049b1ed9bef1e544ddca37e60debc809c3bd9f34 Merge: b376471fb47d4 be4b61ec45b3e Author: Rafael J. Wysocki Date: Tue Jun 28 17:56:57 2022 +0200 Merge tag 'cpufreq-arm-fixes-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq ARM fixes for 5.19-rc5 from Viresh Kumar: - Fix missing of_node_put for qoriq and pmac32 driver (Liang He). - Fix issues around throttle interrupt for qcom driver (Stephen Boyd). - Add MT8186 to cpufreq-dt-platdev blocklist (AngeloGioacchino Del Regno). * tag 'cpufreq-arm-fixes-5.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: Add MT8186 to cpufreq-dt-platdev blocklist cpufreq: pmac32-cpufreq: Fix refcount leak bug cpufreq: qcom-hw: Don't do lmh things without a throttle interrupt drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c commit 579d6c6d77a7b55d74db8a506d5fc0c77fb1a5e1 Author: Ian Rogers Date: Mon Jun 13 18:47:14 2022 -0700 perf bpf: 8 byte align bpil data bpil data is accessed assuming 64-bit alignment resulting in undefined behavior as the data is just byte aligned. With an -fsanitize=undefined build the following errors are observed: $ sudo perf record -a sleep 1 util/bpf-event.c:310:22: runtime error: load of misaligned address 0x55f61084520f for type '__u64', which requires 8 byte alignment 0x55f61084520f: note: pointer points here a8 fe ff ff 3c 51 d3 c0 ff ff ff ff 04 84 d3 c0 ff ff ff ff d8 aa d3 c0 ff ff ff ff a4 c0 d3 c0 ^ util/bpf-event.c:311:20: runtime error: load of misaligned address 0x55f61084522f for type '__u32', which requires 4 byte alignment 0x55f61084522f: note: pointer points here ff ff ff ff c7 17 00 00 f1 02 00 00 1f 04 00 00 58 04 00 00 00 00 00 00 0f 00 00 00 63 02 00 00 ^ util/bpf-event.c:198:33: runtime error: member access within misaligned address 0x55f61084523f for type 'const struct bpf_func_info', which requires 4 byte alignment 0x55f61084523f: note: pointer points here 58 04 00 00 00 00 00 00 0f 00 00 00 63 02 00 00 3b 00 00 00 ab 02 00 00 44 00 00 00 14 03 00 00 Correct this by rouding up the data sizes and aligning the pointers. Signed-off-by: Ian Rogers Acked-by: Andrii Nakryiko Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Dave Marchevsky Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stephane Eranian Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220614014714.1407239-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 117c49505b5918388157321c68c6e5a58b67f649 Author: Arnaldo Carvalho de Melo Date: Mon Dec 21 12:53:44 2020 -0300 tools kvm headers arm64: Update KVM headers from the kernel sources To pick the changes from: 2cde51f1e10f2600 ("KVM: arm64: Hide KVM_REG_ARM_*_BMAP_BIT_COUNT from userspace") b22216e1a617ca55 ("KVM: arm64: Add vendor hypervisor firmware register") 428fd6788d4d0e0d ("KVM: arm64: Add standard hypervisor firmware register") 05714cab7d63b189 ("KVM: arm64: Setup a framework for hypercall bitmap firmware registers") 18f3976fdb5da2ba ("KVM: arm64: uapi: Add kvm_debug_exit_arch.hsr_high") a5905d6af492ee6a ("KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated") That don't causes any changes in tooling (when built on x86), only addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Alexandru Elisei Cc: Catalin Marinas Cc: Ian Rogers Cc: James Morse Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Cc: Raghavendra Rao Ananta Link: https://lore.kernel.org/lkml/YrsWcDQyJC+xsfmm@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 49c692b7dfc9b6c06a1dc11359a8780575b16d4a Author: Namhyung Kim Date: Fri Jun 24 16:13:09 2022 -0700 perf offcpu: Accept allowed sample types only As offcpu-time event is synthesized at the end, it could not get the all the sample info. Define OFFCPU_SAMPLE_TYPES for allowed ones and mask out others in evsel__config() to prevent parse errors. Because perf sample parsing assumes a specific ordering with the sample types, setting unsupported one would make it fail to read data like perf record -d/--data. Fixes: edc41a1099c2d08c ("perf record: Enable off-cpu analysis with BPF") Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Jiri Olsa Cc: Milian Wolff Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220624231313.367909-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d6838ec44b4513280a3f43fcc402e246d543fb53 Author: Namhyung Kim Date: Fri Jun 24 16:13:08 2022 -0700 perf offcpu: Fix build failure on old kernels Old kernels have a 'struct task_struct' which contains a "state" field and newer kernels have "__state" instead. While the get_task_state() in the BPF code handles that in some way, it assumed the current kernel has the new definition and it caused a build error on old kernels. We should not assume anything and access them carefully. Do not use 'task struct' directly access it instead using new and old definitions in a row. Fixes: edc41a1099c2d08c ("perf record: Enable off-cpu analysis with BPF") Reported-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220624231313.367909-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a1d4ef1adf8bbd302067534ead671a94759687ed Author: Fabien Dessenne Date: Mon Jun 27 16:23:50 2022 +0200 pinctrl: stm32: fix optional IRQ support to gpios To act as an interrupt controller, a gpio bank relies on the "interrupt-parent" of the pin controller. When this optional "interrupt-parent" misses, do not create any IRQ domain. This fixes a "NULL pointer in stm32_gpio_domain_alloc()" kernel crash when the interrupt-parent = property is not declared in the Device Tree. Fixes: 0eb9f683336d ("pinctrl: Add IRQ support to STM32 gpios") Signed-off-by: Fabien Dessenne Link: https://lore.kernel.org/r/20220627142350.742973-1-fabien.dessenne@foss.st.com Signed-off-by: Linus Walleij commit 0fe3dbbefb74a8575f61d7801b08dbc50523d60d Author: Tao Liu Date: Mon Jun 27 22:00:04 2022 +0800 linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020 task: ffff880194b78000 task.stack: ffffc90006714000 RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202 RAX: 0000000000002710 RBX: ffff88096cd7f780 RCX: 0000000000000064 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000001d7c6c09 R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff880c10e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000a0965b00 CR3: 000000000200a003 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ib_poll_handler+0x43/0x80 [ib_core] irq_poll_softirq+0xae/0x110 __do_softirq+0xd1/0x28c irq_exit+0xde/0xf0 do_IRQ+0x54/0xe0 common_interrupt+0x8f/0x8f ? cpuidle_enter_state+0xd9/0x2a0 ? cpuidle_enter_state+0xc7/0x2a0 ? do_idle+0x170/0x1d0 ? cpu_startup_entry+0x6f/0x80 ? start_secondary+0x1b9/0x210 ? secondary_startup_64+0xa5/0xb0 Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <49> f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0 Fixes: f4915455dcf0 ("linux/dim: Implement RDMA adaptive moderation (DIM)") Link: https://lore.kernel.org/r/20220627140004.3099-1-thomas.liu@ucloud.cn Signed-off-by: Tao Liu Reviewed-by: Max Gurtovoy Acked-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit ab84db251c04d38b8dc7ee86e13d4050bedb1c88 Author: Eric Dumazet Date: Mon Jun 27 10:28:13 2022 +0000 net: bonding: fix possible NULL deref in rlb code syzbot has two reports involving the same root cause. bond_alb_initialize() must not set bond->alb_info.rlb_enabled if a memory allocation error is detected. Report 1: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 12276 Comm: kworker/u4:10 Not tainted 5.19.0-rc3-syzkaller-00132-g3b89b511ea0c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:rlb_clear_slave+0x10e/0x690 drivers/net/bonding/bond_alb.c:393 Code: 8e fc 83 fb ff 0f 84 74 02 00 00 e8 cc 2a 8e fc 48 8b 44 24 08 89 dd 48 c1 e5 06 4c 8d 34 28 49 8d 7e 14 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RSP: 0018:ffffc90018a8f678 EFLAGS: 00010203 RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88803375bb00 RSI: ffffffff84ec4ac4 RDI: 0000000000000014 RBP: 0000000000000000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880ac889000 R14: 0000000000000000 R15: ffff88815a668c80 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005597077e10b0 CR3: 0000000026668000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bond_alb_deinit_slave+0x43c/0x6b0 drivers/net/bonding/bond_alb.c:1663 __bond_release_one.cold+0x383/0xd53 drivers/net/bonding/bond_main.c:2370 bond_slave_netdev_event drivers/net/bonding/bond_main.c:3778 [inline] bond_netdev_event+0x993/0xad0 drivers/net/bonding/bond_main.c:3889 notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] unregister_netdevice_many+0x948/0x18b0 net/core/dev.c:10839 default_device_exit_batch+0x449/0x590 net/core/dev.c:11333 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Report 2: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 5206 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-12108-g58f9d52ff689 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:rlb_req_update_slave_clients+0x109/0x2f0 drivers/net/bonding/bond_alb.c:502 Code: 5d 18 8f fc 41 80 3e 00 0f 85 a5 01 00 00 89 d8 48 c1 e0 06 49 03 84 24 68 01 00 00 48 8d 78 30 49 89 c7 48 89 fa 48 c1 ea 03 <80> 3c 2a 00 0f 85 98 01 00 00 4d 39 6f 30 75 83 e8 22 18 8f fc 49 RSP: 0018:ffffc9000300ee80 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90016c11000 RDX: 0000000000000006 RSI: ffffffff84eb6bf3 RDI: 0000000000000030 RBP: dffffc0000000000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: ffff888027c80c80 R13: ffff88807d7ff800 R14: ffffed1004f901bd R15: 0000000000000000 FS: 00007f6f46c58700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 00000000516cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alb_fasten_mac_swap+0x886/0xa80 drivers/net/bonding/bond_alb.c:1070 bond_alb_handle_active_change+0x624/0x1050 drivers/net/bonding/bond_alb.c:1765 bond_change_active_slave+0xfa1/0x29b0 drivers/net/bonding/bond_main.c:1173 bond_select_active_slave+0x23f/0xa50 drivers/net/bonding/bond_main.c:1253 bond_enslave+0x3b34/0x53b0 drivers/net/bonding/bond_main.c:2159 do_set_master+0x1c8/0x220 net/core/rtnetlink.c:2577 rtnl_newlink_create net/core/rtnetlink.c:3380 [inline] __rtnl_newlink+0x13ac/0x17e0 net/core/rtnetlink.c:3580 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f6f45a89109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6f46c58168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6f45b9c030 RCX: 00007f6f45a89109 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000006 RBP: 00007f6f45ae308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffed99029af R14: 00007f6f46c58300 R15: 0000000000022000 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20220627102813.126264-1-edumazet@google.com Signed-off-by: Paolo Abeni commit fbc24ebc65507feb9728dc38197f90486148dda0 Author: Jacky Bai Date: Mon Jun 13 11:18:54 2022 +0800 pinctrl: imx: Add the zero base flag for imx93 On i.MX93, the pin mux reg offset is from 0x0, so need to add the 'ZERO_OFFSET_VALID' flag to make sure the pin at mux offset 0 can be found. Signed-off-by: Jacky Bai Link: https://lore.kernel.org/r/20220613031854.1571357-1-ping.bai@nxp.com Signed-off-by: Linus Walleij commit 91d60e259c0f58c855f88f3fe5b7909aec563525 Author: Fabio Estevam Date: Wed Jun 22 08:48:10 2022 -0300 ARM: at91: pm: Mark at91_pm_secure_init as __init at91_pm_secure_init() is used inside sama5d2_pm_init(), which has the __init notation. Pass the __init notation to at91_pm_secure_init() as well to fix the following section mismatch warning: WARNING: modpost: vmlinux.o(.text.unlikely+0x2138): Section mismatch in reference from the function at91_pm_secure_init() to the (unknown reference) .init.rodata:(unknown) Fixes: f2f5cf78a333 ("ARM: at91: pm: add support for sama5d2 secure suspend") Signed-off-by: Fabio Estevam Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220622114810.1186330-1-festevam@gmail.com commit 35074df65a8d8c5328a83e2eea948f7bbc8e6e08 Author: Mihai Sain Date: Thu Jun 16 11:13:44 2022 +0300 ARM: at91: fix soc detection for SAM9X60 SiPs Fix SoC detection for SAM9X60 SiPs: SAM9X60D5M SAM9X60D1G SAM9X60D6K Fixes: af3a10513cd6 ("drivers: soc: atmel: add per soc id and version match masks") Signed-off-by: Mihai Sain Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220616081344.1978664-1-claudiu.beznea@microchip.com commit 416ce193d73a734ded6d09fe141017b38af1c567 Author: Eugen Hristev Date: Tue Jun 7 12:04:55 2022 +0300 ARM: dts: at91: sama5d2_icp: fix eeprom compatibles The eeprom memories on the board are microchip 24aa025e48, which are 2 Kbits and are compatible with at24c02 not at24c32. Fixes: 68a95ef72cefe ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") Signed-off-by: Eugen Hristev Reviewed-by: Claudiu Beznea Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220607090455.80433-2-eugen.hristev@microchip.com commit f2cbbc3f926316ccf8ef9363d8a60c1110afc1c7 Author: Eugen Hristev Date: Tue Jun 7 12:04:54 2022 +0300 ARM: dts: at91: sam9x60ek: fix eeprom compatible and size The board has a microchip 24aa025e48 eeprom, which is a 2 Kbits memory, so it's compatible with at24c02 not at24c32. Also the size property is wrong, it's not 128 bytes, but 256 bytes. Thus removing and leaving it to the default (256). Fixes: 1e5f532c27371 ("ARM: dts: at91: sam9x60: add device tree for soc and board") Signed-off-by: Eugen Hristev Reviewed-by: Claudiu Beznea Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220607090455.80433-1-eugen.hristev@microchip.com commit 1c40169b35ad58906814d53a517ac92db3d20d5f Author: Claudiu Beznea Date: Mon May 23 12:24:21 2022 +0300 ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt Use proper compatible strings for SAMA7G5's RTC and RTT IPs. These are necessary for configuring wakeup sources for ULP1 PM mode. Fixes: 6501330f9f5e ("ARM: at91: pm: add pm support for SAMA7G5") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220523092421.317345-4-claudiu.beznea@microchip.com commit 641522665dbb25ce117c78746df1aad8b58c80e5 Author: Claudiu Beznea Date: Mon May 23 12:24:20 2022 +0300 ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt Use proper compatible strings for SAM9X60's RTC and RTT IPs. These are necessary for configuring wakeup sources for ULP1 PM mode. Fixes: eaedc0d379da ("ARM: at91: pm: add ULP1 support for SAM9X60") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220523092421.317345-3-claudiu.beznea@microchip.com commit ddc980da8043779119acaca106c6d9b445c9b65b Author: Claudiu Beznea Date: Mon May 23 12:24:19 2022 +0300 ARM: at91: pm: use proper compatible for sama5d2's rtc Use proper compatible strings for SAMA5D2's RTC IPs. This is necessary for configuring wakeup sources for ULP1 PM mode. Fixes: d7484f5c6b3b ("ARM: at91: pm: configure wakeup sources for ULP1 mode") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220523092421.317345-2-claudiu.beznea@microchip.com commit 8698e3bab4dd7968666e84e111d0bfd17c040e77 Author: Amir Goldstein Date: Mon Jun 27 20:47:19 2022 +0300 fanotify: refine the validation checks on non-dir inode mask Commit ceaf69f8eadc ("fanotify: do not allow setting dirent events in mask of non-dir") added restrictions about setting dirent events in the mask of a non-dir inode mark, which does not make any sense. For backward compatibility, these restictions were added only to new (v5.17+) APIs. It also does not make any sense to set the flags FAN_EVENT_ON_CHILD or FAN_ONDIR in the mask of a non-dir inode. Add these flags to the dir-only restriction of the new APIs as well. Move the check of the dir-only flags for new APIs into the helper fanotify_events_supported(), which is only called for FAN_MARK_ADD, because there is no need to error on an attempt to remove the dir-only flags from non-dir inode. Fixes: ceaf69f8eadc ("fanotify: do not allow setting dirent events in mask of non-dir") Link: https://lore.kernel.org/linux-fsdevel/20220627113224.kr2725conevh53u4@quack3.lan/ Link: https://lore.kernel.org/r/20220627174719.2838175-1-amir73il@gmail.com Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara commit 48bddb89d59eec27c3305d179b1832d5292e285d Author: Xiang wangx Date: Thu Jun 2 16:53:50 2022 +0800 openrisc: unwinder: Fix grammar issue in comment Delete the redundant word 'the'. Signed-off-by: Xiang wangx Signed-off-by: Stafford Horne commit 8520501346ed8d1c4a6dfa751cb57328a9c843f1 Author: Stafford Horne Date: Wed Jun 15 08:54:26 2022 +0900 irqchip: or1k-pic: Undefine mask_ack for level triggered hardware The mask_ack operation clears the interrupt by writing to the PICSR register. This we don't want for level triggered interrupt because it does not actually clear the interrupt on the source hardware. This was causing issues in qemu with multi core setups where interrupts would continue to fire even though they had been cleared in PICSR. Just remove the mask_ack operation. Acked-by: Marc Zyngier Signed-off-by: Stafford Horne commit be4b61ec45b3efe5e9077525fc92d544305eb2a6 Author: AngeloGioacchino Del Regno Date: Fri Jun 17 13:09:26 2022 +0200 cpufreq: Add MT8186 to cpufreq-dt-platdev blocklist This SoC shall use the mediatek-cpufreq driver, or the system will crash upon any clock scaling request: add it to the cpufreq-dt-platdev blocklist. Fixes: 39b360102f3a ("cpufreq: mediatek: Add support for MT8186") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Signed-off-by: Viresh Kumar commit ccd7567d4b6cf187fdfa55f003a9e461ee629e36 Author: Liang He Date: Sat Jun 18 10:25:45 2022 +0800 cpufreq: pmac32-cpufreq: Fix refcount leak bug In pmac_cpufreq_init_MacRISC3(), we need to add corresponding of_node_put() for the three node pointers whose refcount have been incremented by of_find_node_by_name(). Signed-off-by: Liang He Signed-off-by: Viresh Kumar commit 668a7a12ded7077d4fd7ad1305667e559907e5bb Author: Stephen Boyd Date: Thu Jun 16 15:45:31 2022 -0700 cpufreq: qcom-hw: Don't do lmh things without a throttle interrupt Offlining cpu6 and cpu7 and then onlining cpu6 hangs on sc7180-trogdor-lazor because the throttle interrupt doesn't exist. Similarly, things go sideways when suspend/resume runs. That's because the qcom_cpufreq_hw_cpu_online() and qcom_cpufreq_hw_lmh_exit() functions are calling genirq APIs with an interrupt value of '-6', i.e. -ENXIO, and that isn't good. Check the value of the throttle interrupt like we already do in other functions in this file and bail out early from lmh code to fix the hang. Reported-by: Rob Clark Cc: Vladimir Zapolskiy Cc: Bjorn Andersson Cc: Dmitry Baryshkov Fixes: a1eb080a0447 ("cpufreq: qcom-hw: provide online/offline operations") Signed-off-by: Stephen Boyd Reviewed-by: Vladimir Zapolskiy Signed-off-by: Viresh Kumar commit 4ff5a9b6d95f3524bf6d27147df497eb21968300 Author: Liang He Date: Wed Jun 15 17:48:07 2022 +0800 drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c In qoriq_cpufreq_probe(), of_find_matching_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Fixes: 157f527639da ("cpufreq: qoriq: convert to a platform driver") [ Viresh: Fixed Author's name in commit log ] Signed-off-by: Liang He Signed-off-by: Viresh Kumar commit 3b0dc529f56b5f2328244130683210be98f16f7f Author: Nicolas Dichtel Date: Thu Jun 23 14:00:15 2022 +0200 ipv6: take care of disable_policy when restoring routes When routes corresponding to addresses are restored by fixup_permanent_addr(), the dst_nopolicy parameter was not set. The typical use case is a user that configures an address on a down interface and then put this interface up. Let's take care of this flag in addrconf_f6i_alloc(), so that every callers benefit ont it. CC: stable@kernel.org CC: David Forster Fixes: df789fe75206 ("ipv6: Provide ipv6 version of "disable_policy" sysctl") Reported-by: Siwar Zitouni Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220623120015.32640-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit ce95ab775f8d8e89a038c0e5611a7381a2ef8e43 Author: Oleksij Rempel Date: Fri Jun 24 09:51:39 2022 +0200 net: usb: asix: do not force pause frames support We should respect link partner capabilities and not force flow control support on every link. Even more, in current state the MAC driver do not advertises pause support so we should not keep flow control enabled at all. Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support") Reported-by: Anton Lundin Signed-off-by: Oleksij Rempel Tested-by: Anton Lundin Link: https://lore.kernel.org/r/20220624075139.3139300-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 805206e66fab4ba1e0ebd19402006d62cd1d4902 Author: Oleksij Rempel Date: Fri Jun 24 09:51:38 2022 +0200 net: asix: fix "can't send until first packet is send" issue If cable is attached after probe sequence, the usbnet framework would not automatically start processing RX packets except at least one packet was transmitted. On systems with any kind of address auto configuration this issue was not detected, because some packets are send immediately after link state is changed to "running". With this patch we will notify usbnet about link status change provided by the PHYlib. Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support") Reported-by: Anton Lundin Signed-off-by: Oleksij Rempel Tested-by: Anton Lundin Link: https://lore.kernel.org/r/20220624075139.3139300-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 6b9f1d46fdada756294d2d5f04df613478386d34 Author: Michael Walle Date: Sun Jun 26 22:00:39 2022 +0200 MAINTAINERS: nfc: drop Charles Gorand from NXP-NCI Mails to Charles get an auto reply, that he is no longer working at Eff'Innov technologies. Drop the entry and mark the driver as orphaned. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220626200039.4062784-1-michael@walle.cc Signed-off-by: Jakub Kicinski commit 4bbfed9112ca9da88ac83d5ffe62c988f7169e9f Author: Shreenidhi Shedi Date: Sun Jun 26 18:59:47 2022 +0530 octeon_ep: use bitwise AND This should be bitwise operator not logical. Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") Signed-off-by: Shreenidhi Shedi Link: https://lore.kernel.org/r/20220626132947.3992423-1-sshedi@vmware.com Signed-off-by: Jakub Kicinski commit cce13b82cf97b26919144e01c49fbf3da61c9d6c Merge: 8ee9d82cd0a45 88153e29c1e0f Author: Jakub Kicinski Date: Mon Jun 27 21:51:29 2022 -0700 Merge branch 'notify-user-space-if-any-actions-were-flushed-before-error' Victor Nogueira says: ==================== Notify user space if any actions were flushed before error This patch series fixes the behaviour of actions flush so that the kernel always notifies user space whenever it deletes actions during a flush operation, even if it didn't flush all the actions. This series also introduces tdc tests to verify this new behaviour. ==================== Link: https://lore.kernel.org/r/20220623140742.684043-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 88153e29c1e0f3ace8c831b06f6cea9503f16cec Author: Victor Nogueira Date: Thu Jun 23 11:07:42 2022 -0300 selftests: tc-testing: Add testcases to test new flush behaviour Add tdc test cases to verify new flush behaviour is correct, which do the following: - Try to flush only one action which is being referenced by a filter - Try to flush three actions where the last one (index 3) is being referenced by a filter Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 76b39b94382f9e0a639e1c70c3253de248cc4c83 Author: Victor Nogueira Date: Thu Jun 23 11:07:41 2022 -0300 net/sched: act_api: Notify user space if any actions were flushed before error If during an action flush operation one of the actions is still being referenced, the flush operation is aborted and the kernel returns to user space with an error. However, if the kernel was able to flush, for example, 3 actions and failed on the fourth, the kernel will not notify user space that it deleted 3 actions before failing. This patch fixes that behaviour by notifying user space of how many actions were deleted before flush failed and by setting extack with a message describing what happened. Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 8ee9d82cd0a45e7d050ade598c9f33032a0f2891 Author: Tong Zhang Date: Sun Jun 26 21:33:48 2022 -0700 epic100: fix use after free on rmmod epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one() we already freed the dma buffer. To fix this issue, reorder function calls like in the .probe function. BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100] Call Trace: epic_rx+0xa6/0x7e0 [epic100] epic_close+0xec/0x2f0 [epic100] unregister_netdev+0x18/0x20 epic_remove_one+0xaa/0xf0 [epic100] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yilun Wu Signed-off-by: Tong Zhang Reviewed-by: Francois Romieu Link: https://lore.kernel.org/r/20220627043351.25615-1-ztong0001@gmail.com Signed-off-by: Jakub Kicinski commit a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 Author: Jakub Kicinski Date: Wed Jun 22 21:21:05 2022 -0700 net: tun: stop NAPI when detaching queues While looking at a syzbot report I noticed the NAPI only gets disabled before it's deleted. I think that user can detach the queue before destroying the device and the NAPI will never be stopped. Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") Acked-by: Petar Penkov Link: https://lore.kernel.org/r/20220623042105.2274812-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fce54ed027577517df1e74b7d54dc2b1bd536887 Author: John Garry Date: Thu Jun 23 20:41:59 2022 +0800 scsi: hisi_sas: Limit max hw sectors for v3 HW If the controller is behind an IOMMU then the IOMMU IOVA caching range can affect performance, as discussed in [0]. Limit the max HW sectors to not exceed this limit. We need to hardcode the value until a proper DMA mapping API is available. [0] https://lore.kernel.org/linux-iommu/20210129092120.1482-1-thunder.leizhen@huawei.com/ Link: https://lore.kernel.org/r/1655988119-223714-1-git-send-email-john.garry@huawei.com Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 332bd0778775d0cf105c4b9e03e460b590749916 Author: Heinz Mauelshagen Date: Tue Jun 28 00:37:22 2022 +0200 dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled). Cc: stable@vger.kernel.org Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 039d4ed3428cf9c2052048d177880ebd02104764 Author: Johan Hovold Date: Mon Jun 27 15:11:41 2022 -0700 Input: usbtouchscreen - add driver_info sanity check Add a sanity check on the device id-table driver_info field to make sure we never access a type structure (and function pointers) outside of the device info array (e.g. if someone fails to ifdef a device-id entry). Note that this also suppresses a compiler warning with -Warray-bounds (gcc-11.3.0) when compile-testing the driver without enabling any of the device type Kconfig options: drivers/input/touchscreen/usbtouchscreen.c: In function 'usbtouch_probe': drivers/input/touchscreen/usbtouchscreen.c:1668:16:warning: array subscript is outside array bounds of 'struct usbtouch_device_info[0]' [-Warray-bounds] 1668 | type = &usbtouch_dev_info[id->driver_info]; Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220623062446.16944-1-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 5fb779558f1c97e2bf2794cb59553e569c38e2f9 Author: Stephan Gerhold Date: Mon Jun 27 15:59:38 2022 +0200 arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo "make dtbs_check" complains about the missing "-supply" suffix for vdd_lvs1_2 which is clearly a typo, originally introduced in the msm8994-smd-rpm.dtsi file and apparently later copied to msm8992-xiaomi-libra.dts: msm8992-lg-bullhead-rev-10/101.dtb: pm8994-regulators: 'vdd_lvs1_2' does not match any of the regexes: '.*-supply$', '^((s|l|lvs|5vs)[0-9]*)|(boost-bypass)|(bob)$', 'pinctrl-[0-9]+' From schema: regulator/qcom,smd-rpm-regulator.yaml msm8992-xiaomi-libra.dtb: pm8994-regulators: 'vdd_lvs1_2' does not match any of the regexes: '.*-supply$', '^((s|l|lvs|5vs)[0-9]*)|(boost-bypass)|(bob)$', 'pinctrl-[0-9]+' From schema: regulator/qcom,smd-rpm-regulator.yaml Reported-by: Rob Herring Cc: Konrad Dybcio Fixes: f3b2c99e73be ("arm64: dts: Enable onboard SDHCI on msm8992") Fixes: 0f5cdb31e850 ("arm64: dts: qcom: Add Xiaomi Libra (Mi 4C) device tree") Signed-off-by: Stephan Gerhold Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220627135938.2901871-1-stephan.gerhold@kernkonzept.com commit 08de214138cdea438a0dfcb10d355a6650c6017c Author: Rob Clark Date: Fri Jun 24 11:45:28 2022 -0700 drm/msm/gem: Fix error return on fence id alloc fail This was a typo, we didn't actually want to return zero. Fixes: a61acbbe9cf8 ("drm/msm: Track "seqno" fences by idr") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/491145/ Link: https://lore.kernel.org/r/20220624184528.4036837-1-robdclark@gmail.com commit 96b80fcd2705fc50ebe1f7f3ce204e861b3099ab Author: Helge Deller Date: Mon Jun 27 01:39:11 2022 +0200 parisc/unaligned: Fix emulate_ldw() breakage The commit e8aa7b17fe41 broke the 32-bit load-word unalignment exception handler because it calculated the wrong amount of bits by which the value should be shifted. This patch fixes it. Signed-off-by: Helge Deller Fixes: e8aa7b17fe41 ("parisc/unaligned: Rewrite inline assembly of emulate_ldw()") Cc: stable@vger.kernel.org # v5.18 commit 941e3e7912696b9fbe3586083a7c2e102cee7a87 Merge: 2390095113e98 c7cc29aaebf9e Author: Linus Torvalds Date: Mon Jun 27 10:47:34 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Fixes all over the place, most notably we are disabling IRQ hardening (again!)" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_ring: make vring_create_virtqueue_split prettier vhost-vdpa: call vhost_vdpa_cleanup during the release virtio_mmio: Restore guest page size on resume virtio_mmio: Add missing PM calls to freeze/restore caif_virtio: fix race between virtio_device_ready() and ndo_open() virtio-net: fix race between ndo_open() and virtio_device_ready() virtio: disable notification hardening by default virtio: Remove unnecessary variable assignments virtio_ring : keep used_wrap_counter in vq->last_used_idx vduse: Tie vduse mgmtdev and its device vdpa/mlx5: Initialize CVQ vringh only once vdpa/mlx5: Update Control VQ callback information commit 2390095113e98fc52fffe35c5206d30d9efe3f78 Author: Masahiro Yamada Date: Mon Jun 27 12:22:09 2022 +0900 tick/nohz: unexport __init-annotated tick_nohz_full_setup() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it had been broken for a decade. Commit 28438794aba4 ("modpost: fix section mismatch check for exported init/exit sections") fixed it so modpost started to warn it again, then this showed up: MODPOST vmlinux.symvers WARNING: modpost: vmlinux.o(___ksymtab_gpl+tick_nohz_full_setup+0x0): Section mismatch in reference from the variable __ksymtab_tick_nohz_full_setup to the function .init.text:tick_nohz_full_setup() The symbol tick_nohz_full_setup is exported and annotated __init Fix this by removing the __init annotation of tick_nohz_full_setup or drop the export. Drop the export because tick_nohz_full_setup() is only called from the built-in code in kernel/sched/isolation.c. Fixes: ae9e557b5be2 ("time: Export tick start/stop functions for rcutorture") Reported-by: Linus Torvalds Signed-off-by: Masahiro Yamada Tested-by: Paul E. McKenney Signed-off-by: Linus Torvalds commit c2577862eeb0be94f151f2f1fff662b028061b00 Author: Florian Westphal Date: Tue Jun 21 18:26:03 2022 +0200 netfilter: br_netfilter: do not skip all hooks with 0 priority When br_netfilter module is loaded, skbs may be diverted to the ipv4/ipv6 hooks, just like as if we were routing. Unfortunately, bridge filter hooks with priority 0 may be skipped in this case. Example: 1. an nftables bridge ruleset is loaded, with a prerouting hook that has priority 0. 2. interface is added to the bridge. 3. no tcp packet is ever seen by the bridge prerouting hook. 4. flush the ruleset 5. load the bridge ruleset again. 6. tcp packets are processed as expected. After 1) the only registered hook is the bridge prerouting hook, but its not called yet because the bridge hasn't been brought up yet. After 2), hook order is: 0 br_nf_pre_routing // br_netfilter internal hook 0 chain bridge f prerouting // nftables bridge ruleset The packet is diverted to br_nf_pre_routing. If call-iptables is off, the nftables bridge ruleset is called as expected. But if its enabled, br_nf_hook_thresh() will skip it because it assumes that all 0-priority hooks had been called previously in bridge context. To avoid this, check for the br_nf_pre_routing hook itself, we need to resume directly after it, even if this hook has a priority of 0. Unfortunately, this still results in different packet flow. With this fix, the eval order after in 3) is: 1. br_nf_pre_routing 2. ip(6)tables (if enabled) 3. nftables bridge but after 5 its the much saner: 1. nftables bridge 2. br_nf_pre_routing 3. ip(6)tables (if enabled) Unfortunately I don't see a solution here: It would be possible to move br_nf_pre_routing to a higher priority so that it will be called later in the pipeline, but this also impacts ebtables evaluation order, and would still result in this very ordering problem for all nftables-bridge hooks with the same priority as the br_nf_pre_routing one. Searching back through the git history I don't think this has ever behaved in any other way, hence, no fixes-tag. Reported-by: Radim Hrazdil Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit e34b9ed96ce3b06c79bf884009b16961ca478f87 Author: Florian Westphal Date: Wed Jun 22 16:43:57 2022 +0200 netfilter: nf_tables: avoid skb access on nf_stolen When verdict is NF_STOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN. Avoid 2 by skipping skb->mark access if verdict is STOLEN. 3 is avoided by precomputing the trace id. Only dump the packet when verdict is not "STOLEN". Reported-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 05907f10e235680cc7fb196810e4ad3215d5e648 Author: Pablo Neira Ayuso Date: Tue Jun 21 14:01:41 2022 +0200 netfilter: nft_dynset: restore set element counter when failing to update This patch fixes a race condition. nft_rhash_update() might fail for two reasons: - Element already exists in the hashtable. - Another packet won race to insert an entry in the hashtable. In both cases, new() has already bumped the counter via atomic_add_unless(), therefore, decrement the set element counter. Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") Signed-off-by: Pablo Neira Ayuso commit 4ce7e51dc712f8a006ce6abcc49f788c79287c03 Author: Bo Liu Date: Thu Jun 16 01:50:52 2022 -0400 firmware: arm_scmi: Remove usage of the deprecated ida_simple_xxx API Replace the deprecated ida_simple_{get,remove} with ida_{alloc,free}. Link: https://lore.kernel.org/r/20220616055052.4559-1-liubo03@inspur.com Signed-off-by: Bo Liu [sudeep.holla: Replace ida_alloc_min with ida_alloc as suggested by Cristian] Signed-off-by: Sudeep Holla commit 79538490fd7ade244dba400923e792519a2bdfea Author: Matthew Auld Date: Wed Jun 22 16:59:19 2022 +0100 drm/i915: tweak the ordering in cpu_write_needs_clflush For imported dma-buf objects we leave the object as cache_coherent = 0 across all platforms, which is reasonable given that have no clue what the memory underneath is, and its not like the driver can ever manually clflush the pages anyway (like with i915_gem_clflush_object) for such objects. However on discrete we choose to treat cache_dirty = true as a programmer error, leading to a warning. The simplest fix looks to be to just change the ordering in cpu_write_needs_clflush to prevent ever setting cache_dirty for dma-buf objects on discrete. Fixes: d028a7690d87 ("drm/i915/dmabuf: Fix prime_mmap to work when using LMEM") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5266 Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Gwan-gyeong Mun Reviewed-by: Gwan-gyeong Mun Link: https://patchwork.freedesktop.org/patch/msgid/20220622155919.355081-1-matthew.auld@intel.com (cherry picked from commit 563aaf4a928def2d36d1b3de0a4b515e2477b4da) Signed-off-by: Jani Nikula commit 7d23a80dc9720a378707edc03a7275d5a372355f Author: Anshuman Gupta Date: Thu Jun 16 17:52:49 2022 +0530 drm/i915/dgfx: Disable d3cold at gfx root port Currently i915 disables d3cold for i915 pci dev. This blocks D3 for i915 gfx pci upstream bridge (VSP). Let's disable d3cold at gfx root port to make sure that i915 gfx VSP can transition to D3 to save some power. We don't need to disable/enable d3cold in rpm, s2idle suspend/resume handlers. Disabling/Enabling d3cold at gfx root port in probe/remove phase is sufficient. Fixes: 1a085e23411d ("drm/i915: Disable D3Cold in s2idle and runtime pm") Cc: Rodrigo Vivi Signed-off-by: Anshuman Gupta Reviewed-by: Badal Nilawar Acked-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20220616122249.5007-1-anshuman.gupta@intel.com (cherry picked from commit 138c2fca6f408f397ea8fbbbf33203f244d96e01) Signed-off-by: Jani Nikula commit 9efdd519d001ee3e761f6ff80d5eb123387421c1 Author: katrinzhou Date: Tue Jun 21 13:49:26 2022 +0100 drm/i915/gem: add missing else Add missing else in set_proto_ctx_param() to fix coverity issue. Addresses-Coverity: ("Unused value") Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Suggested-by: Tvrtko Ursulin Signed-off-by: katrinzhou [tursulin: fixup alignment] Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20220621124926.615884-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 7482a65664c16cc88eb84d2b545a1fed887378a1) Signed-off-by: Jani Nikula commit 8a9ffb8c857c2c99403bd6483a5a005fed5c0773 Author: Alexey Khoroshilov Date: Sat Jun 25 23:52:43 2022 +0300 NFSD: restore EINVAL error translation in nfsd_commit() commit 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t") incidentally broke translation of -EINVAL to nfserr_notsupp. The patch restores that. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexey Khoroshilov Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t") Signed-off-by: Chuck Lever commit 19e506b317497a8c2b3ec2f12314d355d2f00ad0 Author: Geert Uytterhoeven Date: Tue Jun 21 15:22:26 2022 +0200 eeprom: at25: Rework buggy read splitting The recent change to split reads into chunks has several problems: 1. If an SPI controller has no transfer size limit, max_chunk is SIZE_MAX, and num_msgs becomes zero, causing no data to be read into the buffer, and exposing the original contents of the buffer to userspace, 2. If the requested read size is not a multiple of the maximum transfer size, the last transfer reads too much data, overflowing the buffer, 3. The loop logic differs from the write case. Fix the above by: 1. Keeping track of the number of bytes that are still to be transferred, instead of precalculating the number of messages and keeping track of the number of bytes tranfered, 2. Calculating the transfer size of each individual message, taking into account the number of bytes left, 3. Switching from a "while"-loop to a "do-while"-loop, and renaming "msg_count" to "segment". While at it, drop the superfluous cast from "unsigned int" to "unsigned int", also from at25_ee_write(), where it was probably copied from. Fixes: 0a35780c755ccec0 ("eeprom: at25: Split reads into chunks and cap write size") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/7ae260778d2c08986348ea48ce02ef148100e088.1655817534.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 8853e8ce9b576e0a3aad8381e19a117964d445fa Author: Hans de Goede Date: Mon Jun 27 15:08:50 2022 +0200 platform/x86: ideapad-laptop: Add Ideapad 5 15ITL05 to ideapad_dytc_v4_allow_table[] The Ideapad 5 15ITL05 uses DYTC version 4 for platform-profile control. This has been tested successfully with the ideapad-laptop DYTC version 5 code; Add the Ideapad 5 15ITL05 to the ideapad_dytc_v4_allow_table[]. Fixes: 599482c58ebd ("platform/x86: ideapad-laptop: Add platform support for Ideapad 5 Pro 16ACH6-82L5") Link: https://bugzilla.kernel.org/show_bug.cgi?id=213297 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220627130850.313537-1-hdegoede@redhat.com commit a27a1e35f5c87463ba7c12d5b7d7cbafbefc9213 Author: Hans de Goede Date: Thu Jun 23 13:59:14 2022 +0200 platform/x86: ideapad-laptop: Add allow_v4_dytc module parameter Add an allow_v4_dytc module parameter to allow users to easily test if DYTC version 4 platform-profiles work on their laptop. Fixes: 599482c58ebd ("platform/x86: ideapad-laptop: Add platform support for Ideapad 5 Pro 16ACH6-82L5") Link: https://bugzilla.kernel.org/show_bug.cgi?id=213297 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220623115914.103001-1-hdegoede@redhat.com commit ec5ad331680c96ef3dd30dc297b206988023b9e1 Author: Max Staudt Date: Sat Jun 18 20:01:34 2022 +0200 tty: Add N_CAN327 line discipline ID for ELM327 based CAN driver The actual driver will be added via the CAN tree. Acked-by: Marc Kleine-Budde Signed-off-by: Max Staudt Link: https://lore.kernel.org/r/20220618180134.9890-1-max@enpas.org Signed-off-by: Greg Kroah-Hartman commit 5f701324c0fb6f9f5aaac3f8d1575321375f6d8f Author: Maxime Ripard Date: Wed Jun 22 10:02:43 2022 +0200 drm/vc4: perfmon: Fix variable dereferenced before check Commit 30f8c74ca9b7 ("drm/vc4: Warn if some v3d code is run on BCM2711") introduced a check in vc4_perfmon_get() that dereferences a pointer before we checked whether that pointer is valid or not. Let's rework that function a bit to do things in the proper order. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 30f8c74ca9b7 ("drm/vc4: Warn if some v3d code is run on BCM2711") Signed-off-by: Maxime Ripard Reviewed-by: José Expósito Link: https://patchwork.freedesktop.org/patch/msgid/20220622080243.22119-1-maxime@cerno.tech commit f8d6e9d3ca5c68e24dd485132a93d49abd444eaf Author: Ilpo Järvinen Date: Wed Jun 15 12:06:49 2022 +0300 serial: 8250: Fix __stop_tx() & DMA Tx restart races Commit e8ffbb71f783 ("serial: 8250: use THRE & __stop_tx also with DMA") changed __dma_tx_complete() to enable THRI that is cleared in __stop_tx() once THRE is asserted as UART runs out bits to transmit. It is possible, however, that more data arrives in between in which case serial8250_tx_dma() resumes Tx. THRI is not supposed to be on during DMA Tx because DMA is based on completion handler, therefore THRI must be cleared unconditionally in serial8250_tx_dma(). When Tx is about to start, another race window exists with serial8250_handle_irq() leading to a call into __stop_tx() while the Tx has already been resumed: __tx_complete(): -> spin_lock(port->lock) -> dma->tx_running = 0 -> serial8250_set_THRI() -> spin_unlock(port->lock) uart_start(): serial8250_handle_irq(): -> spin_lock(port->lock) -> serial8250_tx_dma(): -> dma->tx_running = 1 -> spin_unlock(port->lock) -> spin_lock(port->lock) -> __stop_tx() Close this race by checking !dma->tx_running before calling into __stop_tx(). Fixes: e8ffbb71f783 ("serial: 8250: use THRE & __stop_tx also with DMA") Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220615090651.15340-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 211565b100993c90b53bf40851eacaefc830cfe0 Author: Ilpo Järvinen Date: Tue Jun 14 10:56:37 2022 +0300 serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle The driver must provide throttle and unthrottle in uart_ops when it sets UPSTAT_AUTORTS. Add them using existing stop_rx & enable_interrupts functions. Fixes: 2a76fa283098 (serial: pl011: Adopt generic flag to store auto RTS status) Cc: stable Cc: Lukas Wunner Reported-by: Nuno Gonçalves Tested-by: Nuno Gonçalves Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220614075637.8558-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f7e35e4bf1e8dc2c8cbd5e0955dc1bd58558dae0 Author: Chanho Park Date: Mon Jun 27 15:51:13 2022 +0900 tty: serial: samsung_tty: set dma burst_size to 1 The src_maxburst and dst_maxburst have been changed to 1 but the settings of the UCON register aren't changed yet. They should be changed as well according to the dmaengine slave config. Fixes: aa2f80e752c7 ("serial: samsung: fix maxburst parameter for DMA transactions") Cc: stable Cc: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Chanho Park Link: https://lore.kernel.org/r/20220627065113.139520-1-chanho61.park@samsung.com Signed-off-by: Greg Kroah-Hartman commit cd16044d7c38d76fe2f9b71a06619e9590e3e401 Author: Marcin Wojtas Date: Mon Jun 20 14:10:46 2022 +0200 serial: 8250: dw: enable using pdata with ACPI Commit ffd381445eac ("serial: 8250: dw: Move the USR register to pdata") caused NULL-pointer dereference when booting with ACPI by unconditional usage of the recently added pdata. In order to fix that and prevent similar issues in future, hook the default version of this structure in dw8250_acpi_match table. While at it, sort all entries alphabetically. Fixes: ffd381445eac ("serial: 8250: dw: Move the USR register to pdata") Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Signed-off-by: Marcin Wojtas Link: https://lore.kernel.org/r/20220620121046.1307412-1-mw@semihalf.com Signed-off-by: Greg Kroah-Hartman commit c7cc29aaebf9eaa543b4c70801e0ecef1101b3c8 Author: Deming Wang Date: Wed Jun 22 15:23:06 2022 -0400 virtio_ring: make vring_create_virtqueue_split prettier Add some spaces to vring_alloc_queue(make it look prettier). Signed-off-by: Deming Wang Message-Id: <20220622192306.4371-1-wangdeming@inspur.com> Signed-off-by: Michael S. Tsirkin commit 037d4305569aacaa018a617771dccbb81cc60257 Author: Stefano Garzarella Date: Wed Jun 22 17:14:07 2022 +0200 vhost-vdpa: call vhost_vdpa_cleanup during the release Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we call vhost_vdpa_iotlb_free() during the release to clean all regions mapped in the iotlb. That commit removed vhost_vdpa_iotlb_free() and added vhost_vdpa_cleanup() to do some cleanup, including deleting all mappings, but we forgot to call it in vhost_vdpa_release(). This causes that if an application does not remove all mappings explicitly (or it crashes), the mappings remain in the iotlb and subsequent applications may fail if they map the same addresses. Calling vhost_vdpa_cleanup() also fixes a memory leak since we are not freeing `v->vdev.vqs` during the release from the same commit. Since vhost_vdpa_cleanup() calls vhost_dev_cleanup() we can remove its call from vhost_vdpa_release(). Fixes: 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") Cc: gautam.dawar@xilinx.com Signed-off-by: Stefano Garzarella Message-Id: <20220622151407.51232-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Eugenio Pérez Acked-by: Jason Wang commit e0c2ce8217955537dd5434baeba061f209797119 Author: Stephan Gerhold Date: Tue Jun 21 13:06:21 2022 +0200 virtio_mmio: Restore guest page size on resume Virtio devices might lose their state when the VMM is restarted after a suspend to disk (hibernation) cycle. This means that the guest page size register must be restored for the virtio_mmio legacy interface, since otherwise the virtio queues are not functional. This is particularly problematic for QEMU that currently still defaults to using the legacy interface for virtio_mmio. Write the guest page size register again in virtio_mmio_restore() to make legacy virtio_mmio devices work correctly after hibernation. Signed-off-by: Stephan Gerhold Message-Id: <20220621110621.3638025-3-stephan.gerhold@kernkonzept.com> Signed-off-by: Michael S. Tsirkin commit ed7ac37fde33ccd84e4bd2b9363c191f925364c7 Author: Stephan Gerhold Date: Tue Jun 21 13:06:20 2022 +0200 virtio_mmio: Add missing PM calls to freeze/restore Most virtio drivers provide freeze/restore callbacks to finish up device usage before suspend and to reinitialize the virtio device after resume. However, these callbacks are currently only called when using virtio_pci. virtio_mmio does not have any PM ops defined. This causes problems for example after suspend to disk (hibernation), since the virtio devices might lose their state after the VMM is restarted. Calling virtio_device_freeze()/restore() ensures that the virtio devices are re-initialized correctly. Fix this by implementing the dev_pm_ops for virtio_mmio, similar to virtio_pci_common. Signed-off-by: Stephan Gerhold Message-Id: <20220621110621.3638025-2-stephan.gerhold@kernkonzept.com> Signed-off-by: Michael S. Tsirkin commit 11a37eb66812ce6a06b79223ad530eb0e1d7294d Author: Jason Wang Date: Mon Jun 20 13:11:14 2022 +0800 caif_virtio: fix race between virtio_device_ready() and ndo_open() We currently depend on probe() calling virtio_device_ready() - which happens after netdev registration. Since ndo_open() can be called immediately after register_netdev, this means there exists a race between ndo_open() and virtio_device_ready(): the driver may start to use the device (e.g. TX) before DRIVER_OK which violates the spec. Fix this by switching to use register_netdevice() and protect the virtio_device_ready() with rtnl_lock() to make sure ndo_open() can only be called after virtio_device_ready(). Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang Message-Id: <20220620051115.3142-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 50c0ada627f56c92f5953a8bf9158b045ad026a1 Author: Jason Wang Date: Fri Jun 17 15:29:49 2022 +0800 virtio-net: fix race between ndo_open() and virtio_device_ready() We currently call virtio_device_ready() after netdev registration. Since ndo_open() can be called immediately after register_netdev, this means there exists a race between ndo_open() and virtio_device_ready(): the driver may start to use the device before DRIVER_OK which violates the spec. Fix this by switching to use register_netdevice() and protect the virtio_device_ready() with rtnl_lock() to make sure ndo_open() can only be called after virtio_device_ready(). Fixes: 4baf1e33d0842 ("virtio_net: enable VQs early") Signed-off-by: Jason Wang Message-Id: <20220617072949.30734-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 75c8f430d8596cf16634337fec8aec50e7b0feed Author: Vincent Guittot Date: Fri Jun 24 09:45:49 2022 +0200 firmware: arm_scmi: Fix response size warning for OPTEE transport Some protocols check the response size with the expected value but optee shared memory doesn't return such size whereas it is available in the optee output buffer. As an example, the base protocol compares the response size with the expected result when requesting the list of protocol which triggers a warning with optee shared memory: arm-scmi firmware:scmi0: Malformed reply - real_sz:116 calc_sz:4 (loop_num_ret:4) Save the output buffer length and use it when fetching the answer. Link: https://lore.kernel.org/r/20220624074549.3298-1-vincent.guittot@linaro.org Reviewed-by: Etienne Carriere Reviewed-by: Cristian Marussi Signed-off-by: Vincent Guittot Signed-off-by: Sudeep Holla commit cb8092d70a6f5f01ec1490fce4d35efed3ed996c Author: Xin Long Date: Fri Jun 24 12:24:31 2022 -0400 tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: [] [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x200 [tipc] [] tipc_rcv+0x3af/0x5b0 [tipc] [] tipc_udp_recv+0xc7/0x1e0 [tipc] It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it creates a node in tipc_node_check_dest(), after inserting the new node into hashtable in tipc_node_create(), it creates the bc link. However, there is a gap between this insert and bc link creation, a bc packet may come in and get the node from the hashtable then try to dereference its bc link, which is NULL. This patch is to fix it by moving the bc link creation before inserting into the hashtable. Note that for a preliminary node becoming "real", the bc link creation should also be called before it's rehashed, as we don't create it for preliminary nodes. Fixes: 4cbf8ac2fe5a ("tipc: enable creating a "preliminary" node") Reported-by: Shuang Li Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 853a7614880231747040cada91d2b8d2e995c51a Author: Eric Dumazet Date: Fri Jun 24 15:30:20 2022 +0000 tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() Recently added debug in commit f9aefd6b2aa3 ("net: warn if mac header was not set") caught a bug in skb_tunnel_check_pmtu(), as shown in this syzbot report [1]. In ndo_start_xmit() paths, there is really no need to use skb->mac_header, because skb->data is supposed to point at it. [1] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_mac_header_len include/linux/skbuff.h:2784 [inline] WARNING: CPU: 1 PID: 8604 at include/linux/skbuff.h:2784 skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413 Modules linked in: CPU: 1 PID: 8604 Comm: syz-executor.3 Not tainted 5.19.0-rc2-syzkaller-00443-g8720bd951b8e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_mac_header_len include/linux/skbuff.h:2784 [inline] RIP: 0010:skb_tunnel_check_pmtu+0x5de/0x2f90 net/ipv4/ip_tunnel_core.c:413 Code: 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 84 b9 fe ff ff 4c 89 ff e8 7c 0f d7 f9 e9 ac fe ff ff e8 c2 13 8a f9 <0f> 0b e9 28 fc ff ff e8 b6 13 8a f9 48 8b 54 24 70 48 b8 00 00 00 RSP: 0018:ffffc90002e4f520 EFLAGS: 00010212 RAX: 0000000000000324 RBX: ffff88804d5fd500 RCX: ffffc90005b52000 RDX: 0000000000040000 RSI: ffffffff87f05e3e RDI: 0000000000000003 RBP: ffffc90002e4f650 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: 000000000000ffff R13: 0000000000000000 R14: 000000000000ffcd R15: 000000000000001f FS: 00007f3babba9700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 0000000075319000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: geneve_xmit_skb drivers/net/geneve.c:927 [inline] geneve_xmit+0xcf8/0x35d0 drivers/net/geneve.c:1107 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] __dev_direct_xmit+0x500/0x730 net/core/dev.c:4309 dev_direct_xmit include/linux/netdevice.h:3007 [inline] packet_direct_xmit+0x1b8/0x2c0 net/packet/af_packet.c:282 packet_snd net/packet/af_packet.c:3073 [inline] packet_sendmsg+0x21f4/0x55d0 net/packet/af_packet.c:3104 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2489 ___sys_sendmsg+0xf3/0x170 net/socket.c:2543 __sys_sendmsg net/socket.c:2572 [inline] __do_sys_sendmsg net/socket.c:2581 [inline] __se_sys_sendmsg net/socket.c:2579 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3baaa89109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3babba9168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f3baab9bf60 RCX: 00007f3baaa89109 RDX: 0000000000000000 RSI: 0000000020000a00 RDI: 0000000000000003 RBP: 00007f3baaae305d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe74f2543f R14: 00007f3babba9300 R15: 0000000000022000 Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Stefano Brivio Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller commit cd4c1e65a32afd003b08ad4aafe1e4d3e4e8e61b Author: Andrei Lalaev Date: Wed May 25 22:04:25 2022 +0300 pinctrl: sunxi: sunxi_pconf_set: use correct offset Some Allwinner SoCs have 2 pinctrls (PIO and R_PIO). Previous implementation used absolute pin numbering and it was incorrect for R_PIO pinctrl. It's necessary to take into account the base pin number. Fixes: 90be64e27621 ("pinctrl: sunxi: implement pin_config_set") Signed-off-by: Andrei Lalaev Reviewed-by: Samuel Holland Link: https://lore.kernel.org/r/20220525190423.410609-1-andrey.lalaev@gmail.com Signed-off-by: Linus Walleij commit 26aae8ccbc1972233afd08fb3f368947c0314265 Author: Andrew Cooper Date: Fri Jun 24 14:41:21 2022 +0100 x86/cpu/amd: Enumerate BTC_NO BTC_NO indicates that hardware is not susceptible to Branch Type Confusion. Zen3 CPUs don't suffer BTC. Hypervisors are expected to synthesise BTC_NO when it is appropriate given the migration pool, to prevent kernels using heuristics. [ bp: Massage. ] Signed-off-by: Andrew Cooper Signed-off-by: Borislav Petkov commit 7a05bc95ed1c5a59e47aaade9fb4083c27de9e62 Author: Peter Zijlstra Date: Fri Jun 24 14:03:25 2022 +0200 x86/common: Stamp out the stepping madness The whole MMIO/RETBLEED enumeration went overboard on steppings. Get rid of all that and simply use ANY. If a future stepping of these models would not be affected, it had better set the relevant ARCH_CAP_$FOO_NO bit in IA32_ARCH_CAPABILITIES. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Acked-by: Dave Hansen Signed-off-by: Borislav Petkov commit 07853adc29a058c5fd143c14e5ac528448a72ed9 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:16 2022 +0200 KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns. For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter. [ bp: Fix 32-bit build. ] Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 9756bba28470722dacb79ffce554336dd1f6a6cd Author: Josh Poimboeuf Date: Tue Jun 14 23:16:15 2022 +0200 x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledge about RSB attacks and what exactly is being mitigated. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit bea7e31a5caccb6fe8ed989c065072354f0ecb52 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:14 2022 +0200 KVM: VMX: Fix IBRS handling after vmexit For legacy IBRS to work, the IBRS bit needs to be always re-written after vmexit, even if it's already on. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit fc02735b14fff8c6678b521d324ade27b1a3d4cf Author: Josh Poimboeuf Date: Tue Jun 14 23:16:13 2022 +0200 KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS On eIBRS systems, the returns in the vmexit return path from __vmx_vcpu_run() to vmx_vcpu_run() are exposed to RSB poisoning attacks. Fix that by moving the post-vmexit spec_ctrl handling to immediately after the vmexit. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit bb06650634d3552c0f8557e9d16aa1a408040e28 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:12 2022 +0200 KVM: VMX: Convert launched argument to flags Convert __vmx_vcpu_run()'s 'launched' argument to 'flags', in preparation for doing SPEC_CTRL handling immediately after vmexit, which will need another flag. This is much easier than adding a fourth argument, because this code supports both 32-bit and 64-bit, and the fourth argument on 32-bit would have to be pushed on the stack. Note that __vmx_vcpu_run_flags() is called outside of the noinstr critical section because it will soon start calling potentially traceable functions. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 8bd200d23ec42d66ccd517a72dd0b9cc6132d2fd Author: Josh Poimboeuf Date: Tue Jun 14 23:16:11 2022 +0200 KVM: VMX: Flatten __vmx_vcpu_run() Move the vmx_vm{enter,exit}() functionality into __vmx_vcpu_run(). This will make it easier to do the spec_ctrl handling before the first RET. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 8faea26e611189e933ea2281975ff4dc7c1106b6 Author: Josh Poimboeuf Date: Fri Jun 24 12:52:40 2022 +0200 objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} Commit c536ed2fffd5 ("objtool: Remove SAVE/RESTORE hints") removed the save/restore unwind hints because they were no longer needed. Now they're going to be needed again so re-add them. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit acac5e98ef8d638a411cfa2ee676c87e1973f126 Author: Josh Poimboeuf Date: Fri Jun 17 12:12:48 2022 -0700 x86/speculation: Remove x86_spec_ctrl_mask This mask has been made redundant by kvm_spec_ctrl_test_value(). And it doesn't even work when MSR interception is disabled, as the guest can just write to SPEC_CTRL directly. Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov Reviewed-by: Paolo Bonzini Signed-off-by: Borislav Petkov commit bbb69e8bee1bd882784947095ffb2bfe0f7c9470 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:08 2022 +0200 x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit There's no need to recalculate the host value for every entry/exit. Just use the cached value in spec_ctrl_current(). Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 56aa4d221f1ee2c3a49b45b800778ec6e0ab73c5 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:07 2022 +0200 x86/speculation: Fix SPEC_CTRL write on SMT state change If the SMT state changes, SSBD might get accidentally disabled. Fix that. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit e6aa13622ea8283cc699cac5d018cc40a2ba2010 Author: Josh Poimboeuf Date: Tue Jun 14 23:16:06 2022 +0200 x86/speculation: Fix firmware entry SPEC_CTRL handling The firmware entry code may accidentally clear STIBP or SSBD. Fix that. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit b2620facef4889fefcbf2e87284f34dcd4189bce Author: Josh Poimboeuf Date: Tue Jun 14 23:16:05 2022 +0200 x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n If a kernel is built with CONFIG_RETPOLINE=n, but the user still wants to mitigate Spectre v2 using IBRS or eIBRS, the RSB filling will be silently disabled. There's nothing retpoline-specific about RSB buffer filling. Remove the CONFIG_RETPOLINE guards around it. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit d7caac991feeef1b871ee6988fd2c9725df09039 Author: Peter Zijlstra Date: Tue Jun 14 23:16:04 2022 +0200 x86/cpu/amd: Add Spectral Chicken Zen2 uarchs have an undocumented, unnamed, MSR that contains a chicken bit for some speculation behaviour. It needs setting. Note: very belatedly AMD released naming; it's now officially called MSR_AMD64_DE_CFG2 and MSR_AMD64_DE_CFG2_SUPPRESS_NOBR_PRED_BIT but shall remain the SPECTRAL CHICKEN. Suggested-by: Andrew Cooper Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit a09a6e2399ba0595c3042b3164f3ca68a3cff33e Author: Peter Zijlstra Date: Tue Jun 14 23:16:03 2022 +0200 objtool: Add entry UNRET validation Since entry asm is tricky, add a validation pass that ensures the retbleed mitigation has been done before the first actual RET instruction. Entry points are those that either have UNWIND_HINT_ENTRY, which acts as UNWIND_HINT_EMPTY but marks the instruction as an entry point, or those that have UWIND_HINT_IRET_REGS at +0. This is basically a variant of validate_branch() that is intra-function and it will simply follow all branches from marked entry points and ensures that all paths lead to ANNOTATE_UNRET_END. If a path hits RET or an indirection the path is a fail and will be reported. There are 3 ANNOTATE_UNRET_END instances: - UNTRAIN_RET itself - exception from-kernel; this path doesn't need UNTRAIN_RET - all early exceptions; these also don't need UNTRAIN_RET Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 0fe4aeea9c01baabecc8c3afc7889c809d939bc2 Author: Josh Poimboeuf Date: Tue Jun 14 15:07:19 2022 -0700 x86/bugs: Do IBPB fallback check only once When booting with retbleed=auto, if the kernel wasn't built with CONFIG_CC_HAS_RETURN_THUNK, the mitigation falls back to IBPB. Make sure a warning is printed in that case. The IBPB fallback check is done twice, but it really only needs to be done once. Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 3ebc170068885b6fc7bedda6c667bb2c4d533159 Author: Peter Zijlstra Date: Tue Jun 14 23:16:02 2022 +0200 x86/bugs: Add retbleed=ibpb jmp2ret mitigates the easy-to-attack case at relatively low overhead. It mitigates the long speculation windows after a mispredicted RET, but it does not mitigate the short speculation window from arbitrary instruction boundaries. On Zen2, there is a chicken bit which needs setting, which mitigates "arbitrary instruction boundaries" down to just "basic block boundaries". But there is no fix for the short speculation window on basic block boundaries, other than to flush the entire BTB to evict all attacker predictions. On the spectrum of "fast & blurry" -> "safe", there is (on top of STIBP or no-SMT): 1) Nothing System wide open 2) jmp2ret May stop a script kiddy 3) jmp2ret+chickenbit Raises the bar rather further 4) IBPB Only thing which can count as "safe". Tentative numbers put IBPB-on-entry at a 2.5x hit on Zen2, and a 10x hit on Zen1 according to lmbench. [ bp: Fixup feature bit comments, document option, 32-bit build fix. ] Suggested-by: Andrew Cooper Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit d147553b64bad34d2f92cb7d8ba454ae95c3baac Author: Peter Zijlstra Date: Tue Jun 14 23:16:01 2022 +0200 x86/xen: Add UNTRAIN_RET Ensure the Xen entry also passes through UNTRAIN_RET. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit b75b7f8ef1148be1b9321ffc2f6c19238904b438 Author: Peter Zijlstra Date: Tue Jun 14 23:16:00 2022 +0200 x86/xen: Rename SYS* entry points Native SYS{CALL,ENTER} entry points are called entry_SYS{CALL,ENTER}_{64,compat}, make sure the Xen versions are named consistently. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 9bb2ec608a209018080ca262f771e6a9ff203b6f Author: Peter Zijlstra Date: Tue Jun 14 23:15:59 2022 +0200 objtool: Update Retpoline validation Update retpoline validation with the new CONFIG_RETPOLINE requirement of not having bare naked RET instructions. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit bf5835bcdb9635c97f85120dba9bfa21e111130f Author: Peter Zijlstra Date: Tue Jun 14 23:15:58 2022 +0200 intel_idle: Disable IBRS during long idle Having IBRS enabled while the SMT sibling is idle unnecessarily slows down the running sibling. OTOH, disabling IBRS around idle takes two MSR writes, which will increase the idle latency. Therefore, only disable IBRS around deeper idle states. Shallow idle states are bounded by the tick in duration, since NOHZ is not allowed for them by virtue of their short target residency. Only do this for mwait-driven idle, since that keeps interrupts disabled across idle, which makes disabling IBRS vs IRQ-entry a non-issue. Note: C6 is a random threshold, most importantly C1 probably shouldn't disable IBRS, benchmarking needed. Suggested-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 6ad0ad2bf8a67e27d1f9d006a1dabb0e1c360cc3 Author: Peter Zijlstra Date: Fri Jun 24 13:48:58 2022 +0200 x86/bugs: Report Intel retbleed vulnerability Skylake suffers from RSB underflow speculation issues; report this vulnerability and it's mitigation (spectre_v2=ibrs). [jpoimboe: cleanups, eibrs] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 166115c08a9b0b846b783088808a27d739be6e8d Author: Peter Zijlstra Date: Tue Jun 14 23:15:56 2022 +0200 x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() retbleed will depend on spectre_v2, while spectre_v2_user depends on retbleed. Break this cycle. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 7c693f54c873691a4b7da05c7e0f74e67745d144 Author: Pawan Gupta Date: Tue Jun 14 23:15:55 2022 +0200 x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS Extend spectre_v2= boot option with Kernel IBRS. [jpoimboe: no STIBP with IBRS] Signed-off-by: Pawan Gupta Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit c779bc1a9002fa474175b80e72b85c9bf628abb0 Author: Peter Zijlstra Date: Tue Jun 14 23:15:54 2022 +0200 x86/bugs: Optimize SPEC_CTRL MSR writes When changing SPEC_CTRL for user control, the WRMSR can be delayed until return-to-user when KERNEL_IBRS has been enabled. This avoids an MSR write during context switch. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 2dbb887e875b1de3ca8f40ddf26bcfe55798c609 Author: Peter Zijlstra Date: Tue Jun 14 23:15:53 2022 +0200 x86/entry: Add kernel IBRS implementation Implement Kernel IBRS - currently the only known option to mitigate RSB underflow speculation issues on Skylake hardware. Note: since IBRS_ENTER requires fuller context established than UNTRAIN_RET, it must be placed after it. However, since UNTRAIN_RET itself implies a RET, it must come after IBRS_ENTER. This means IBRS_ENTER needs to also move UNTRAIN_RET. Note 2: KERNEL_IBRS is sub-optimal for XenPV. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit caa0ff24d5d0e02abce5e65c3d2b7f20a6617be5 Author: Peter Zijlstra Date: Tue Jun 14 23:15:52 2022 +0200 x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value Due to TIF_SSBD and TIF_SPEC_IB the actual IA32_SPEC_CTRL value can differ from x86_spec_ctrl_base. As such, keep a per-CPU value reflecting the current task's MSR content. [jpoimboe: rename] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit e8ec1b6e08a2102d8755ccb06fa26d540f26a2fa Author: Kim Phillips Date: Tue Jun 14 23:15:51 2022 +0200 x86/bugs: Enable STIBP for JMP2RET For untrained return thunks to be fully effective, STIBP must be enabled or SMT disabled. Co-developed-by: Josh Poimboeuf Signed-off-by: Josh Poimboeuf Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 7fbf47c7ce50b38a64576b150e7011ae73d54669 Author: Alexandre Chartre Date: Tue Jun 14 23:15:50 2022 +0200 x86/bugs: Add AMD retbleed= boot parameter Add the "retbleed=" boot parameter to select a mitigation for RETBleed. Possible values are "off", "auto" and "unret" (JMP2RET mitigation). The default value is "auto". Currently, "retbleed=auto" will select the unret mitigation on AMD and Hygon and no mitigation on Intel (JMP2RET is not effective on Intel). [peterz: rebase; add hygon] [jpoimboe: cleanups] Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 6b80b59b3555706508008f1f127b5412c89c7fd8 Author: Alexandre Chartre Date: Tue Jun 14 23:15:49 2022 +0200 x86/bugs: Report AMD retbleed vulnerability Report that AMD x86 CPUs are vulnerable to the RETBleed (Arbitrary Speculative Code Execution with Return Instructions) attack. [peterz: add hygon] [kim: invert parity; fam15h] Co-developed-by: Kim Phillips Signed-off-by: Kim Phillips Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit a149180fbcf336e97ce4eb2cdc13672727feb94d Author: Peter Zijlstra Date: Tue Jun 14 23:15:48 2022 +0200 x86: Add magic AMD return-thunk Note: needs to be in a section distinct from Retpolines such that the Retpoline RET substitution cannot possibly use immediate jumps. ORC unwinding for zen_untrain_ret() and __x86_return_thunk() is a little tricky but works due to the fact that zen_untrain_ret() doesn't have any stack ops and as such will emit a single ORC entry at the start (+0x3f). Meanwhile, unwinding an IP, including the __x86_return_thunk() one (+0x40) will search for the largest ORC entry smaller or equal to the IP, these will find the one ORC entry (+0x3f) and all works. [ Alexandre: SVM part. ] [ bp: Build fix, massages. ] Suggested-by: Andrew Cooper Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 951ddecf435659553ed15a9214e153a3af43a9a1 Author: Peter Zijlstra Date: Tue Jun 14 23:15:47 2022 +0200 objtool: Treat .text.__x86.* as noinstr Needed because zen_untrain_ret() will be called from noinstr code. Also makes sense since the thunks MUST NOT contain instrumentation nor be poked with dynamic instrumentation. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 7c81c0c9210c9bfab2bae76aab2999de5bad27db Author: Peter Zijlstra Date: Tue Jun 14 23:15:46 2022 +0200 x86/entry: Avoid very early RET Commit ee774dac0da1 ("x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()") manages to introduce a CALL/RET pair that is before SWITCH_TO_KERNEL_CR3, which means it is before RETBleed can be mitigated. Revert to an earlier version of the commit in Fixes. Down side is that this will bloat .text size somewhat. The alternative is fully reverting it. The purpose of this patch was to allow migrating error_entry() to C, including the whole of kPTI. Much care needs to be taken moving that forward to not re-introduce this problem of early RETs. Fixes: ee774dac0da1 ("x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit aa3d480315ba6c3025a60958e1981072ea37c3df Author: Peter Zijlstra Date: Tue Jun 14 23:15:45 2022 +0200 x86: Use return-thunk in asm code Use the return thunk in asm code. If the thunk isn't needed, it will get patched into a RET instruction during boot by apply_returns(). Since alternatives can't handle relocations outside of the first instruction, putting a 'jmp __x86_return_thunk' in one is not valid, therefore carve out the memmove ERMS path into a separate label and jump to it. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 0ee9073000e8791f8b134a8ded31bcc767f7f232 Author: Kim Phillips Date: Tue Jun 14 23:15:44 2022 +0200 x86/sev: Avoid using __x86_return_thunk Specifically, it's because __enc_copy() encrypts the kernel after being relocated outside the kernel in sme_encrypt_execute(), and the RET macro's jmp offset isn't amended prior to execution. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 15583e514eb16744b80be85dea0774ece153177d Author: Peter Zijlstra Date: Tue Jun 14 23:15:43 2022 +0200 x86/vsyscall_emu/64: Don't use RET in vsyscall emulation This is userspace code and doesn't play by the normal kernel rules. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit af2e140f34208a5dfb6b7a8ad2d56bda88f0524d Author: Peter Zijlstra Date: Tue Jun 14 23:15:42 2022 +0200 x86/kvm: Fix SETcc emulation for return thunks Prepare the SETcc fastop stuff for when RET can be larger still. The tricky bit here is that the expressions should not only be constant C expressions, but also absolute GAS expressions. This means no ?: and 'true' is ~0. Also ensure em_setcc() has the same alignment as the actual FOP_SETCC() ops, this ensures there cannot be an alignment hole between em_setcc() and the first op. Additionally, add a .skip directive to the FOP_SETCC() macro to fill any remaining space with INT3 traps; however the primary purpose of this directive is to generate AS warnings when the remaining space goes negative. Which is a very good indication the alignment magic went side-ways. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit d77cfe594ad50e0bf95d457e02ccd578791b2a15 Author: Peter Zijlstra Date: Tue Jun 14 23:15:41 2022 +0200 x86/bpf: Use alternative RET encoding Use the return thunk in eBPF generated code, if needed. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 1f001e9da6bbf482311e45e48f53c2bd2179e59c Author: Peter Zijlstra Date: Tue Jun 14 23:15:40 2022 +0200 x86/ftrace: Use alternative RET encoding Use the return thunk in ftrace trampolines, if needed. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit ee88d363d15617ff50ac24fab0ffec11113b2aeb Author: Peter Zijlstra Date: Tue Jun 14 23:15:39 2022 +0200 x86,static_call: Use alternative RET encoding In addition to teaching static_call about the new way to spell 'RET', there is an added complication in that static_call() is allowed to rewrite text before it is known which particular spelling is required. In order to deal with this; have a static_call specific fixup in the apply_return() 'alternative' patching routine that will rewrite the static_call trampoline to match the definite sequence. This in turn creates the problem of uniquely identifying static call trampolines. Currently trampolines are 8 bytes, the first 5 being the jmp.d32/ret sequence and the final 3 a byte sequence that spells out 'SCT'. This sequence is used in __static_call_validate() to ensure it is patching a trampoline and not a random other jmp.d32. That is, false-positives shouldn't be plenty, but aren't a big concern. OTOH the new __static_call_fixup() must not have false-positives, and 'SCT' decodes to the somewhat weird but semi plausible sequence: push %rbx rex.XB push %r12 Additionally, there are SLS concerns with immediate jumps. Combined it seems like a good moment to change the signature to a single 3 byte trap instruction that is unique to this usage and will not ever get generated by accident. As such, change the signature to: '0x0f, 0xb9, 0xcc', which decodes to: ud1 %esp, %ecx Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit d9e9d2300681d68a775c28de6aa6e5290ae17796 Author: Peter Zijlstra Date: Tue Jun 14 23:15:38 2022 +0200 x86,objtool: Create .return_sites Find all the return-thunk sites and record them in a .return_sites section such that the kernel can undo this. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 15e67227c49a57837108acfe1c80570e1bd9f962 Author: Peter Zijlstra Date: Tue Jun 14 23:15:37 2022 +0200 x86: Undo return-thunk damage Introduce X86_FEATURE_RETHUNK for those afflicted with needing this. [ bp: Do only INT3 padding - simpler. ] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 0b53c374b9eff2255a386f1f1cfb9a928e52a5ae Author: Peter Zijlstra Date: Tue Jun 14 23:15:36 2022 +0200 x86/retpoline: Use -mfunction-return Utilize -mfunction-return=thunk-extern when available to have the compiler replace RET instructions with direct JMPs to the symbol __x86_return_thunk. This does not affect assembler (.S) sources, only C sources. -mfunction-return=thunk-extern has been available since gcc 7.3 and clang 15. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Nick Desaulniers Reviewed-by: Josh Poimboeuf Tested-by: Nick Desaulniers Signed-off-by: Borislav Petkov commit 00e1533325fd1fb5459229fe37f235462649f668 Author: Peter Zijlstra Date: Tue Jun 14 23:15:35 2022 +0200 x86/retpoline: Swizzle retpoline thunk Put the actual retpoline thunk as the original code so that it can become more complicated. Specifically, it allows RET to be a JMP, which can't be .altinstr_replacement since that doesn't do relocations (except for the very first instruction). Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 369ae6ffc41a3c1137cab697635a84d0cc7cdcea Author: Peter Zijlstra Date: Tue Jun 14 23:15:34 2022 +0200 x86/retpoline: Cleanup some #ifdefery On it's own not much of a cleanup but it prepares for more/similar code. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit a883d624aed463c84c22596006e5a96f5b44db31 Author: Peter Zijlstra Date: Tue Jun 14 23:15:33 2022 +0200 x86/cpufeatures: Move RETPOLINE flags to word 11 In order to extend the RETPOLINE features to 4, move them to word 11 where there is still room. This mostly keeps DISABLE_RETPOLINE simple. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Reviewed-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit 742ab6df974ae8384a2dd213db1a3a06cf6d8936 Author: Peter Zijlstra Date: Tue Jun 14 23:15:32 2022 +0200 x86/kvm/vmx: Make noinstr clean The recent mmio_stale_data fixes broke the noinstr constraints: vmlinux.o: warning: objtool: vmx_vcpu_enter_exit+0x15b: call to wrmsrl.constprop.0() leaves .noinstr.text section vmlinux.o: warning: objtool: vmx_vcpu_enter_exit+0x1bf: call to kvm_arch_has_assigned_device() leaves .noinstr.text section make it all happy again. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov commit 8630354f42bef90f51e003a7ce62b69aceb735ca Author: Peng Fan Date: Wed Jun 22 14:14:10 2022 +0800 arm64: dts: imx8mp-icore-mx8mp-edim2.2: correct pad settings BIT3 and BIT0 are reserved bits, should not touch. Fixes: aec8ad34f7f2 ("arm64: dts: imx8mp: Add Engicam i.Core MX8M Plus EDIMM2.2 Starter Kit") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 242d8ee9111171a6e68249aaff62643c513be6ec Author: Peng Fan Date: Wed Jun 22 14:14:09 2022 +0800 arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings BIT3 and BIT0 are reserved bits, should not touch. Fixes: 88f7f6bcca37 ("arm64: dts: freescale: Add support for phyBOARD-Pollux-i.MX8MP") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit bae4de618efe1c41d34aa2e6cef8b08e46256667 Author: Peng Fan Date: Wed Jun 22 14:14:08 2022 +0800 arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings BIT3 and BIT0 are reserved bits, should not touch. Fixes: 6f96852619d5 ("arm64: dts: freescale: Add support EQOS MAC on phyBOARD-Pollux-i.MX8MP") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit e266c155bd88e95f9b86379d6b0add6ac6e5452e Author: Peng Fan Date: Wed Jun 22 14:14:07 2022 +0800 arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings BIT3 and BIT0 are reserved bits, should not touch. Fixes: 846f752866bd ("arm64: dts: imx8mp-phyboard-pollux-rdk: Change debug UART") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 843af59e577021bd9c975b7a17c237394f26b929 Author: Peng Fan Date: Wed Jun 22 14:14:06 2022 +0800 arm64: dts: imx8mp-venice-gw74xx: correct pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Should not set reserved bit. Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 0836de513ebaae5f03014641eac996290d67493d Author: Peng Fan Date: Wed Jun 22 14:14:05 2022 +0800 arm64: dts: imx8mp-evk: correct I2C3 pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Although function is not broken, we should not set reserved bit. Fixes: 5e4a67ff7f69 ("arm64: dts: imx8mp-evk: Add i2c3 support") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 05a7f43478e890513d571f36660bfedc1482a588 Author: Peng Fan Date: Wed Jun 22 14:14:04 2022 +0800 arm64: dts: imx8mp-evk: correct I2C1 pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Although function is not broken, we should not set reserved bit. Fixes: 5497bc2a2bff ("arm64: dts: imx8mp-evk: Add PMIC device") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 8c214b78e149dc7209e38a031292fe21d7017561 Author: Peng Fan Date: Wed Jun 22 14:14:03 2022 +0800 arm64: dts: imx8mp-evk: correct I2C5 pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Although function is not broken, we should not set reserved bit. Fixes: 8134822db08d ("arm64: dts: imx8mp-evk: add support for I2C5") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 95587ecfcf25e1b9e7810ed91df084d823ee8023 Author: Peng Fan Date: Wed Jun 22 14:14:02 2022 +0800 arm64: dts: imx8mp-evk: correct vbus pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Not set reserved bit. Fixes: 9e847693c6f3 ("arm64: dts: freescale: Add i.MX8MP EVK board support") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit e6e1bc0ec9e8ad212fa46d8878a6e17cd31fdf7b Author: Peng Fan Date: Wed Jun 22 14:14:01 2022 +0800 arm64: dts: imx8mp-evk: correct eqos pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Although function is not broken, we should not set reserved bit. Fixes: dc6d5dc89bad ("arm64: dts: imx8mp-evk: enable EQOS ethernet") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit e2c00820a99c55c9bb40642d5818a904a1e0d664 Author: Peng Fan Date: Wed Jun 22 14:14:00 2022 +0800 arm64: dts: imx8mp-evk: correct vbus pad settings 0x19 is not a valid setting. According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Not set reserved bit. Fixes: 43da4f92a611 ("arm64: dts: imx8mp-evk: enable usb1 as host mode") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit b838582ab8d5fb11b2c0275056a9f34e1d94fece Author: Peng Fan Date: Wed Jun 22 14:13:59 2022 +0800 arm64: dts: imx8mp-evk: correct gpio-led pad settings 0x19 is not a valid setting. According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Correct setting with PE PUE set, DSE set to 0. Fixes: 50d336b12f34 ("arm64: dts: imx8mp-evk: Add GPIO LED support") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 2d4fb72b681205eed4553d8802632bd3270be3ba Author: Sherry Sun Date: Wed Jun 22 14:13:58 2022 +0800 arm64: dts: imx8mp-evk: correct the uart2 pinctl value According to the IOMUXC_SW_PAD_CTL_PAD_UART2_RXD/TXD register define in imx8mp RM, bit0 and bit3 are reserved, and the uart2 rx/tx pin should enable the pull up, so need to set bit8 to 1. The original pinctl value 0x49 is incorrect and needs to be changed to 0x140, same as uart1 and uart3. Fixes: 9e847693c6f3 ("arm64: dts: freescale: Add i.MX8MP EVK board support") Reviewed-by: Haibo Chen Signed-off-by: Sherry Sun Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit 01785f1f156511c4f285786b4192245d4f476bf1 Author: Peng Fan Date: Wed Jun 22 14:13:57 2022 +0800 arm64: dts: imx8mp-evk: correct mmc pad settings According to RM bit layout, BIT3 and BIT0 are reserved. 8 7 6 5 4 3 2 1 0 PE HYS PUE ODE FSEL X DSE X Not set reserved bit. Fixes: 9e847693c6f3 ("arm64: dts: freescale: Add i.MX8MP EVK board support") Signed-off-by: Peng Fan Reviewed-by: Rasmus Villemoes Signed-off-by: Shawn Guo commit b10ef5f2ddb3a5a22ac0936c8d91a50ac5e55e77 Author: Fabio Estevam Date: Tue Jun 21 13:45:05 2022 -0300 ARM: mxs_defconfig: Enable the framebuffer Currently, when booting Linux on a imx28-evk board there is no display activity. Enable CONFIG_FB which is nowadays required for CONFIG_DRM_PANEL_LVDS, CONFIG_DRM_PANEL_SIMPLE, CONFIG_DRM_PANEL_SEIKO_43WVF1G, CONFIG_FB_MODE_HELPERS, CONFIG_BACKLIGHT_PWM, CONFIG_BACKLIGHT_GPIO, CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_LOGO, CONFIG_FONTS, CONFIG_FONT_8x8 and CONFIG_FONT_8x16. Based on commit c54467482ffd ("ARM: imx_v6_v7_defconfig: enable fb"). Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit d2f33f0c3ad7b0d5262d9b986f1353265fad7a08 Author: Jean Delvare Date: Tue Jun 21 15:55:11 2022 +0200 platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource Unlike release_mem_region(), a call to release_resource() does not free the resource, so it has to be freed explicitly to avoid a memory leak. Signed-off-by: Jean Delvare Fixes: 455cd867b85b ("platform/x86: thinkpad_acpi: Add a s2idle resume quirk for a number of laptops") Cc: Mario Limonciello Cc: Henrique de Moraes Holschuh Cc: Hans de Goede Cc: Mark Gross Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20220621155511.5b266395@endymion.delvare Signed-off-by: Hans de Goede commit 79e90ca02d7d45898c52fd8523cd4a2a304e409c Author: Dan Carpenter Date: Wed Jun 15 11:11:07 2022 +0300 platform/mellanox: nvsw-sn2201: fix error code in nvsw_sn2201_create_static_devices() This should return PTR_ERR() instead of IS_ERR(). Also "dev->client" has been set to NULL by this point so it returns 0/success so preserve the error code earlier. Fixes: 662f24826f95 ("platform/mellanox: Add support for new SN2201 system") Signed-off-by: Dan Carpenter Acked-by: Michael Shych Link: https://lore.kernel.org/r/YqmUGwmPK7cPolk/@kili Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit d63eae6747eb8b3192e89712f6553c6aa162f872 Author: Gayatri Kammela Date: Tue Jun 14 17:27:51 2022 -0700 platform/x86: intel/pmc: Add Alder Lake N support to PMC core driver Add Alder Lake N (ADL-N) to the list of the platforms that Intel's PMC core driver supports. Alder Lake N reuses all the TigerLake PCH IPs. Cc: Srinivas Pandruvada Cc: Andy Shevchenko Cc: David E. Box Signed-off-by: Gayatri Kammela Reviewed-by: Rajneesh Bhardwaj Link: https://lore.kernel.org/r/20220615002751.3371730-1-gayatri.kammela@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3fdd4ef444f99d25f524e68777d210d453757698 Author: Peng Fan Date: Mon Jun 20 11:20:44 2022 +0800 arm64: dts: imx8mp: correct clock of pgc_ispdwp The deprecated DIV clk is previously part of the ISP composite clk, but there is still one child clk(IMX8MP_CLK_MEDIA_ISP_ROOT) sourcing from IMX8MP_CLK_MEDIA_ISP( previously IMX8MP_CLK_MEDIA_ISP_DIV) So IMX8MP_CLK_MEDIA_ISP_ROOT should be used, not IMX8MP_CLK_MEDIA_ISP_DIV. Fixes: 9d89189d5227 ("arm64: dts: imx8mp: Add MEDIAMIX power domains") Signed-off-by: Peng Fan Reviewed-by: Laurent Pinchart Tested-by: Laurent Pinchart Signed-off-by: Shawn Guo commit f94e08b602d45ec8ea69fb0aa1c85b712a6a4558 Author: Darrick J. Wong Date: Thu Jun 23 09:26:38 2022 -0700 xfs: clean up the end of xfs_attri_item_recover The end of this function could use some cleanup -- the EAGAIN conditionals make it harder to figure out what's going on with the disposal of xattri_leaf_bp, and the dual error/ret variables aren't needed. Turn the EAGAIN case into a separate block documenting all the subtleties of recovering in the middle of an xattr update chain, which makes the rest of the prologue much simpler. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit b822ea17fd15659b92cb86c48d018c9e43d0fd98 Author: Darrick J. Wong Date: Wed Jun 22 16:57:07 2022 -0700 xfs: always free xattri_leaf_bp when cancelling a deferred op While running the following fstest with logged xattrs DISabled, I noticed the following: # FSSTRESS_AVOID="-z -f unlink=1 -f rmdir=1 -f creat=2 -f mkdir=2 -f getfattr=3 -f listfattr=3 -f attr_remove=4 -f removefattr=4 -f setfattr=20 -f attr_set=60" ./check generic/475 INFO: task u9:1:40 blocked for more than 61 seconds. Tainted: G O 5.19.0-rc2-djwx #rc2 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:u9:1 state:D stack:12872 pid: 40 ppid: 2 flags:0x00004000 Workqueue: xfs-cil/dm-0 xlog_cil_push_work [xfs] Call Trace: __schedule+0x2db/0x1110 schedule+0x58/0xc0 schedule_timeout+0x115/0x160 __down_common+0x126/0x210 down+0x54/0x70 xfs_buf_lock+0x2d/0xe0 [xfs 0532c1cb1d67dd81d15cb79ac6e415c8dec58f73] xfs_buf_item_unpin+0x227/0x3a0 [xfs 0532c1cb1d67dd81d15cb79ac6e415c8dec58f73] xfs_trans_committed_bulk+0x18e/0x320 [xfs 0532c1cb1d67dd81d15cb79ac6e415c8dec58f73] xlog_cil_committed+0x2ea/0x360 [xfs 0532c1cb1d67dd81d15cb79ac6e415c8dec58f73] xlog_cil_push_work+0x60f/0x690 [xfs 0532c1cb1d67dd81d15cb79ac6e415c8dec58f73] process_one_work+0x1df/0x3c0 worker_thread+0x53/0x3b0 kthread+0xea/0x110 ret_from_fork+0x1f/0x30 This appears to be the result of shortform_to_leaf creating a new leaf buffer as part of adding an xattr to a file. The new leaf buffer is held and attached to the xfs_attr_intent structure, but then the filesystem shuts down. Instead of the usual path (which adds the attr to the held leaf buffer which releases the hold), we instead cancel the entire deferred operation. Unfortunately, xfs_attr_cancel_item doesn't release any attached leaf buffers, so we leak the locked buffer. The CIL cannot do anything about that, and hangs. Fix this by teaching it to release leaf buffers, and make XFS a little more careful about not leaving a dangling reference. The prologue of xfs_attri_item_recover is (in this author's opinion) a little hard to figure out, so I'll clean that up in the next patch. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 82af88063961da9425924d9aec3fb67a4ebade3e Author: Kaixu Xia Date: Sun Jun 19 14:53:43 2022 -0700 xfs: use invalidate_lock to check the state of mmap_lock We should use invalidate_lock and XFS_MMAPLOCK_SHARED to check the state of mmap_lock rw_semaphore in xfs_isilocked(), rather than i_rwsem and XFS_IOLOCK_SHARED. Fixes: 2433480a7e1d ("xfs: Convert to use invalidate_lock") Signed-off-by: Kaixu Xia Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit ca76a761ea2497a250988fd67f12fd93524e611e Author: Kaixu Xia Date: Sun Jun 19 14:53:42 2022 -0700 xfs: factor out the common lock flags assert There are similar lock flags assert in xfs_ilock(), xfs_ilock_nowait(), xfs_iunlock(), thus we can factor it out into a helper that is clear. Signed-off-by: Kaixu Xia Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 03c765b0e3b4cb5063276b086c76f7a612856a9a Author: Linus Torvalds Date: Sun Jun 26 14:22:10 2022 -0700 Linux 5.19-rc4 commit 1709b887397cb371ed149560a48d24b232c53ccd Merge: 413c1f14919b3 7f058112873e8 Author: Linus Torvalds Date: Sun Jun 26 14:12:56 2022 -0700 Merge tag 'soc-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "A number of fixes have accumulated, but they are largely for harmless issues: - Several OF node leak fixes - A fix to the Exynos7885 UART clock description - DTS fixes to prevent boot failures on TI AM64 and J721s2 - Bus probe error handling fixes for Baikal-T1 - A fixup to the way STM32 SoCs use separate dts files for different firmware stacks - Multiple code fixes for Arm SCMI firmware, all dealing with robustness of the implementation - Multiple NXP i.MX devicetree fixes, addressing incorrect data in DT nodes - Three updates to the MAINTAINERS file, including Florian Fainelli taking over BCM283x/BCM2711 (Raspberry Pi) from Nicolas Saenz Julienne" * tag 'soc-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (29 commits) ARM: dts: aspeed: nuvia: rename vendor nuvia to qcom arm: mach-spear: Add missing of_node_put() in time.c ARM: cns3xxx: Fix refcount leak in cns3xxx_init MAINTAINERS: Update email address arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode arm64: dts: ti: k3-j721s2: Fix overlapping GICD memory region ARM: dts: bcm2711-rpi-400: Fix GPIO line names bus: bt1-axi: Don't print error on -EPROBE_DEFER bus: bt1-apb: Don't print error on -EPROBE_DEFER ARM: Fix refcount leak in axxia_boot_secondary ARM: dts: stm32: move SCMI related nodes in a dedicated file for stm32mp15 soc: imx: imx8m-blk-ctrl: fix display clock for LCDIF2 power domain ARM: dts: imx6qdl-colibri: Fix capacitive touch reset polarity ARM: dts: imx6qdl: correct PU regulator ramp delay firmware: arm_scmi: Fix incorrect error propagation in scmi_voltage_descriptors_get firmware: arm_scmi: Avoid using extended string-buffers sizes if not necessary firmware: arm_scmi: Fix SENSOR_AXIS_NAME_GET behaviour when unsupported ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe MAINTAINERS: Update BCM2711/BCM2835 maintainer ... commit 413c1f14919b3efee05eb79d2e913663e964abda Merge: 893d1eaa56e8e e67679cc4264c Author: Linus Torvalds Date: Sun Jun 26 14:00:55 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Minor things, mainly - mailmap updates, MAINTAINERS updates, etc. Fixes for this merge window: - fix for a damon boot hang, from SeongJae - fix for a kfence warning splat, from Jason Donenfeld - fix for zero-pfn pinning, from Alex Williamson - fix for fallocate hole punch clearing, from Mike Kravetz Fixes for previous releases: - fix for a performance regression, from Marcelo - fix for a hwpoisining BUG from zhenwei pi" * tag 'mm-hotfixes-stable-2022-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: add entry for Christian Marangi mm/memory-failure: disable unpoison once hw error happens hugetlbfs: zero partial pages during fallocate hole punch mm: memcontrol: reference to tools/cgroup/memcg_slabinfo.py mm: re-allow pinning of zero pfns mm/kfence: select random number before taking raw lock MAINTAINERS: add maillist information for LoongArch MAINTAINERS: update MM tree references MAINTAINERS: update Abel Vesa's email MAINTAINERS: add MEMORY HOT(UN)PLUG section and add David as reviewer MAINTAINERS: add Miaohe Lin as a memory-failure reviewer mailmap: add alias for jarkko@profian.com mm/damon/reclaim: schedule 'damon_reclaim_timer' only after 'system_wq' is initialized kthread: make it clear that kthread_create_on_node() might be terminated by any fatal signal mm: lru_cache_disable: use synchronize_rcu_expedited mm/page_isolation.c: fix one kernel-doc comment commit 893d1eaa56e8ed8ebf0726556454c9e53c0bf047 Merge: 82708bb1eb9eb f8d866194082e Author: Linus Torvalds Date: Sun Jun 26 12:12:25 2022 -0700 Merge tag 'perf-tools-fixes-for-v5.19-2022-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Enable ignore_missing_thread in 'perf stat', enabling counting with '--pid' when threads disappear during counting session setup - Adjust output data offset for backward compatibility in 'perf inject' - Fix missing free in copy_kcore_dir() in 'perf inject' - Fix caching files with a wrong build ID - Sync drm, cpufeatures, vhost and svn headers with the kernel * tag 'perf-tools-fixes-for-v5.19-2022-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: tools headers UAPI: Synch KVM's svm.h header with the kernel tools include UAPI: Sync linux/vhost.h with the kernel sources perf stat: Enable ignore_missing_thread perf inject: Adjust output data offset for backward compatibility perf trace beauty: Fix generation of errno id->str table on ALT Linux perf build-id: Fix caching files with a wrong build ID tools headers cpufeatures: Sync with the kernel sources tools headers UAPI: Sync drm/i915_drm.h with the kernel sources perf inject: Fix missing free in copy_kcore_dir() commit 82708bb1eb9ebc2d1e296f2c919685761f2fa8dd Merge: c898c67db6d7d 037e127452b97 Author: Linus Torvalds Date: Sun Jun 26 10:11:36 2022 -0700 Merge tag 'for-5.19-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - zoned relocation fixes: - fix critical section end for extent writeback, this could lead to out of order write - prevent writing to previous data relocation block group if space gets low - reflink fixes: - fix race between reflinking and ordered extent completion - proper error handling when block reserve migration fails - add missing inode iversion/mtime/ctime updates on each iteration when replacing extents - fix deadlock when running fsync/fiemap/commit at the same time - fix false-positive KCSAN report regarding pid tracking for read locks and data race - minor documentation update and link to new site * tag 'for-5.19-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Documentation: update btrfs list of features and link to readthedocs.io btrfs: fix deadlock with fsync+fiemap+transaction commit btrfs: don't set lock_owner when locking extent buffer for reading btrfs: zoned: fix critical section of relocation inode writeback btrfs: zoned: prevent allocation from previous data relocation BG btrfs: do not BUG_ON() on failure to migrate space when replacing extents btrfs: add missing inode updates on each iteration when replacing extents btrfs: fix race between reflinking and ordered extent completion commit c898c67db6d7de1b1e7970cd16c45eaa46bd231b Merge: be129fab66f28 3be4562584bba Author: Linus Torvalds Date: Sun Jun 26 10:01:40 2022 -0700 Merge tag 'dma-mapping-5.19-2022-06-26' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: - pass the correct size to dma_set_encrypted() when freeing memory (Dexuan Cui) * tag 'dma-mapping-5.19-2022-06-26' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: use the correct size for dma_set_encrypted() commit be129fab66f284c239251ec5b6e30c6e903d8881 Merge: c0c6a7bd4c6f8 cb5177336ecb0 Author: Linus Torvalds Date: Sun Jun 26 09:13:51 2022 -0700 Merge tag 'for-5.19/fbdev-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "Two bug fixes for the pxa3xx and intelfb drivers: - pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write - intelfb: Initialize value of stolen size The other changes are small cleanups, simplifications and documentation updates to the cirrusfb, skeletonfb, omapfb, intelfb, au1100fb and simplefb drivers" * tag 'for-5.19/fbdev-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: video: fbdev: omap: Remove duplicate 'the' in comment video: fbdev: omapfb: Align '*' in comment video: fbdev: simplefb: Check before clk_put() not needed video: fbdev: au1100fb: Drop unnecessary NULL ptr check video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write video: fbdev: skeletonfb: Convert to generic power management video: fbdev: cirrusfb: Remove useless reference to PCI power management video: fbdev: intelfb: Initialize value of stolen size video: fbdev: intelfb: Use aperture size from pci_resource_len video: fbdev: skeletonfb: Fix syntax errors in comments commit c0c6a7bd4c6f87d6d3621fd58c94110bf2404e12 Merge: e963d685dda05 0a1355db36718 Author: Linus Torvalds Date: Sun Jun 26 09:08:30 2022 -0700 Merge tag 'for-5.19/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - enable ARCH_HAS_STRICT_MODULE_RWX to prevent a boot crash on c8000 machines - flush all mappings of a shared anonymous page on PA8800/8900 machines via flushing the whole data cache. This may slow down such machines but makes sure that the cache is consistent - Fix duplicate definition build error regarding fb_is_primary_device() * tag 'for-5.19/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Enable ARCH_HAS_STRICT_MODULE_RWX parisc: Fix flush_anon_page on PA8800/PA8900 parisc: align '*' in comment in math-emu code parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI commit e963d685dda05b978cf6bcab74b3a0ad6199327a Merge: 8100775d59a67 a2d9b75b19dc8 Author: Linus Torvalds Date: Sun Jun 26 08:59:21 2022 -0700 Merge tag 'xtensa-20220626' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix OF reference leaks in xtensa arch code - replace '.bss' with '.section .bss' to fix entry.S build with old assembler * tag 'xtensa-20220626' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: change '.bss' to '.section .bss' xtensa: xtfpga: Fix refcount leak bug in setup xtensa: Fix refcount leak bug in time.c commit 8100775d59a6789c3c6c309de26fac52f129cba8 Merge: 393ed5d85e8e0 f3eac426657d9 Author: Linus Torvalds Date: Sun Jun 26 08:53:20 2022 -0700 Merge tag 'powerpc-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - A fix for a CMA change that broke booting guests with > 2G RAM on Power8 hosts. - Fix the RTAS call filter to allow a special case that applications rely on. - A change to our execve path, to make the execve syscall exit tracepoint work. - Three fixes to wire up our various RNGs earlier in boot so they're available for use in the initial seeding in random_init(). - A build fix for when KASAN is enabled along with STRUCTLEAK_BYREF_ALL. Thanks to Andrew Donnellan, Aneesh Kumar K.V, Christophe Leroy, Jason Donenfeld, Nathan Lynch, Naveen N. Rao, Sathvika Vasireddy, Sumit Dubey2, Tyrel Datwyler, and Zi Yan. * tag 'powerpc-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/powernv: wire up rng during setup_arch powerpc/prom_init: Fix build failure with GCC_PLUGIN_STRUCTLEAK_BYREF_ALL and KASAN powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address powerpc: Enable execve syscall exit tracepoint powerpc/pseries: wire up rng during setup_arch() powerpc/microwatt: wire up rng during setup_arch() powerpc/mm: Move CMA reservations after initmem_init() commit 393ed5d85e8e07021d8db07d7c8348dd928349d7 Merge: 97d4d0269706c ff13976676467 Author: Linus Torvalds Date: Sun Jun 26 08:47:28 2022 -0700 Merge tag 'kbuild-fixes-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix modpost to detect EXPORT_SYMBOL marked as __init or__exit - Update the supported arch list in the LLVM document - Avoid the second link of vmlinux for CONFIG_TRIM_UNUSED_KSYMS - Avoid false __KSYM___this_module define in include/generated/autoksyms.h * tag 'kbuild-fixes-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: Ignore __this_module in gen_autoksyms.sh kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt) Documentation/llvm: Update Supported Arch table modpost: fix section mismatch check for exported init/exit sections commit 97d4d0269706c468ec57cbb95a79f1a5c8fd1892 Merge: 918c30dffd14c 204e6ceaa1035 Author: Linus Torvalds Date: Sun Jun 26 08:41:04 2022 -0700 Merge tag 'exfat-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat fix from Namjae Jeon: - Use updated exfat_chain directly instead of snapshot values in rename. * tag 'exfat-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: use updated exfat_chain directly during renaming commit 918c30dffd14cd3f4af1e67cb40db91a008fc4fe Merge: 0840a7914caa1 af3a6d1018f02 Author: Linus Torvalds Date: Sun Jun 26 08:34:52 2022 -0700 Merge tag '5.19-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Fixes addressing important multichannel, and reconnect issues. Multichannel mounts when the server network interfaces changed, or ip addresses changed, uncovered problems, especially in reconnect, but the patches for this were held up until recently due to some lock conflicts that are now addressed. Included in this set of fixes: - three fixes relating to multichannel reconnect, dynamically adjusting the list of server interfaces to avoid problems during reconnect - a lock conflict fix related to the above - two important fixes for negotiate on secondary channels (null netname can unintentionally cause multichannel to be disabled to some servers) - a reconnect fix (reporting incorrect IP address in some cases)" * tag '5.19-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update cifs_ses::ip_addr after failover cifs: avoid deadlocks while updating iface cifs: periodically query network interfaces from server cifs: during reconnect, update interface if necessary cifs: change iface_list from array to sorted linked list smb3: use netname when available on secondary channels smb3: fix empty netname context on secondary channels commit f8d866194082e703c86751cceb07f6243cde96d2 Author: Arnaldo Carvalho de Melo Date: Mon Dec 21 20:04:45 2020 -0300 tools headers UAPI: Synch KVM's svm.h header with the kernel To pick up the changes from: d5af44dde5461d12 ("x86/sev: Provide support for SNP guest request NAEs") 0afb6b660a6b58cb ("x86/sev: Use SEV-SNP AP creation to start secondary CPUs") dc3f3d2474b80eae ("x86/mm: Validate memory when changing the C-bit") cbd3d4f7c4e5a93e ("x86/sev: Check SEV-SNP features support") That gets these new SVM exit reasons: + { SVM_VMGEXIT_PSC, "vmgexit_page_state_change" }, \ + { SVM_VMGEXIT_GUEST_REQUEST, "vmgexit_guest_request" }, \ + { SVM_VMGEXIT_EXT_GUEST_REQUEST, "vmgexit_ext_guest_request" }, \ + { SVM_VMGEXIT_AP_CREATION, "vmgexit_ap_creation" }, \ + { SVM_VMGEXIT_HV_FEATURES, "vmgexit_hypervisor_feature" }, \ Addressing this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/svm.h' differs from latest version at 'arch/x86/include/uapi/asm/svm.h' diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h This causes these changes: CC /tmp/build/perf-urgent/arch/x86/util/kvm-stat.o LD /tmp/build/perf-urgent/arch/x86/util/perf-in.o LD /tmp/build/perf-urgent/arch/x86/perf-in.o LD /tmp/build/perf-urgent/arch/perf-in.o LD /tmp/build/perf-urgent/perf-in.o LINK /tmp/build/perf-urgent/perf Cc: Adrian Hunter Cc: Borislav Petkov Cc: Brijesh Singh Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Tom Lendacky Signed-off-by: Arnaldo Carvalho de Melo commit e2213a2dc63e1b2941728a9a938c2196548e980f Author: Arnaldo Carvalho de Melo Date: Tue Apr 14 09:12:55 2020 -0300 tools include UAPI: Sync linux/vhost.h with the kernel sources To get the changes in: 84d7c8fd3aade2fe ("vhost-vdpa: introduce uAPI to set group ASID") 2d1fcb7758e49fd9 ("vhost-vdpa: uAPI to get virtqueue group id") a0c95f201170bd55 ("vhost-vdpa: introduce uAPI to get the number of address spaces") 3ace88bd37436abc ("vhost-vdpa: introduce uAPI to get the number of virtqueue groups") 175d493c3c3e09a3 ("vhost: move the backend feature bits to vhost_types.h") Silencing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/vhost.h' differs from latest version at 'include/uapi/linux/vhost.h' diff -u tools/include/uapi/linux/vhost.h include/uapi/linux/vhost.h To pick up these changes and support them: $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > before $ cp include/uapi/linux/vhost.h tools/include/uapi/linux/vhost.h $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > after $ diff -u before after --- before 2022-06-26 12:04:35.982003781 -0300 +++ after 2022-06-26 12:04:43.819972476 -0300 @@ -28,6 +28,7 @@ [0x74] = "VDPA_SET_CONFIG", [0x75] = "VDPA_SET_VRING_ENABLE", [0x77] = "VDPA_SET_CONFIG_CALL", + [0x7C] = "VDPA_SET_GROUP_ASID", }; static const char *vhost_virtio_ioctl_read_cmds[] = { [0x00] = "GET_FEATURES", @@ -39,5 +40,8 @@ [0x76] = "VDPA_GET_VRING_NUM", [0x78] = "VDPA_GET_IOVA_RANGE", [0x79] = "VDPA_GET_CONFIG_SIZE", + [0x7A] = "VDPA_GET_AS_NUM", + [0x7B] = "VDPA_GET_VRING_GROUP", [0x80] = "VDPA_GET_VQS_COUNT", + [0x81] = "VDPA_GET_GROUP_NUM", }; $ Cc: Adrian Hunter Cc: Gautam Dawar Cc: Jiri Olsa Cc: Michael S. Tsirkin Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/Yrh3xMYbfeAD0MFL@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 448ce0e6ea93ae99e0b36055e5f5a3f723fe3665 Author: Gang Li Date: Wed Jun 22 11:00:37 2022 +0800 perf stat: Enable ignore_missing_thread perf already support ignore_missing_thread for -p, but not yet applied to `perf stat -p `. This patch enables ignore_missing_thread for `perf stat -p `. Committer notes: And here is a refresher about the 'ignore_missing_thread' knob, from a previous patch using it: ca8000684ec4e66f ("perf evsel: Enable ignore_missing_thread for pid option") --- While monitoring a multithread process with pid option, perf sometimes may return sys_perf_event_open failure with 3(No such process) if any of the process's threads die before we open the event. However, we want perf continue monitoring the remaining threads and do not exit with error. --- Signed-off-by: Gang Li Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220622030037.15005-1-ligang.bdlg@bytedance.com Signed-off-by: Arnaldo Carvalho de Melo commit 37ed2cddcbf1b52b03b9b2344c752ed867fa3539 Author: Raul Silvera Date: Tue Jun 21 15:27:25 2022 +0000 perf inject: Adjust output data offset for backward compatibility When 'perf inject' creates a new file, it reuses the data offset from the input file. If there has been a change on the size of the header, as happened in v5.12 -> v5.13, the new offsets will be wrong, resulting in a corrupted output file. This change adds the function perf_session__data_offset to compute the data offset based on the current header size, and uses that instead of the offset from the original input file. Signed-off-by: Raul Silvera Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Jajeev Cc: Colin Ian King Cc: Dave Marchevsky Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220621152725.2668041-1-rsilvera@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3713e2494b6ab98f0476bb575b22323775f7d77a Author: Arnaldo Carvalho de Melo Date: Tue Jun 21 12:34:37 2022 -0300 perf trace beauty: Fix generation of errno id->str table on ALT Linux For some reason using: cat < Signed-off-by: Arnaldo Carvalho de Melo commit ab66fdace8581ef3b4e7cf5381a168ed4058d779 Author: Adrian Hunter Date: Tue Jun 21 15:51:44 2022 +0300 perf build-id: Fix caching files with a wrong build ID Build ID events associate a file name with a build ID. However, when using perf inject, there is no guarantee that the file on the current machine at the current time has that build ID. Fix by comparing the build IDs and skip adding to the cache if they are different. Example: $ echo "int main() {return 0;}" > prog.c $ gcc -o prog prog.c $ perf record --buildid-all ./prog [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.019 MB perf.data ] $ file-buildid() { file $1 | awk -F= '{print $2}' | awk -F, '{print $1}' ; } $ file-buildid prog 444ad9be165d8058a48ce2ffb4e9f55854a3293e $ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf 444ad9be165d8058a48ce2ffb4e9f55854a3293e $ echo "int main() {return 1;}" > prog.c $ gcc -o prog prog.c $ file-buildid prog 885524d5aaa24008a3e2b06caa3ea95d013c0fc5 Before: $ perf buildid-cache --purge $(pwd)/prog $ perf inject -i perf.data -o junk $ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf 885524d5aaa24008a3e2b06caa3ea95d013c0fc5 $ After: $ perf buildid-cache --purge $(pwd)/prog $ perf inject -i perf.data -o junk $ file-buildid ~/.debug/$(pwd)/prog/444ad9be165d8058a48ce2ffb4e9f55854a3293e/elf $ Fixes: 454c407ec17a0c63 ("perf: add perf-inject builtin") Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Tom Zanussi Link: https://lore.kernel.org/r/20220621125144.5623-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 4b3f7644ae84bcf785cc88d35327227cb2fb6b82 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: d6d0c7f681fda1d0 ("x86/cpufeatures: Add PerfMonV2 feature bit") 296d5a17e793956f ("KVM: SEV-ES: Use V_TSC_AUX if available instead of RDTSC/MSR_TSC_AUX intercepts") f30903394eb62316 ("x86/cpufeatures: Add virtual TSC_AUX feature bit") 8ad7e8f696951f19 ("x86/fpu/xsave: Support XSAVEC in the kernel") 59bd54a84d15e933 ("x86/tdx: Detect running as a TDX guest in early boot") a77d41ac3a0f41c8 ("x86/cpufeatures: Add AMD Fam19h Branch Sampling feature") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Cc: Peter Zijlstra Cc: Sandipan Das Cc: Babu Moger Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Dave Hansen Cc: Kuppuswamy Sathyanarayanan Cc: Stephane Eranian Cc: Peter Zijlstra Link: https://lore.kernel.org/lkml/YrDkgmwhLv+nKeOo@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0fdd435cb4f873b5602913db4f2ba497a5443daf Author: Arnaldo Carvalho de Melo Date: Sat Nov 13 11:08:31 2021 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick up the changes in: ecf8eca51f33dbfd ("drm/i915/xehp: Add compute engine ABI") 991b4de3275728fd ("drm/i915/uapi: Add kerneldoc for engine class enum") c94fde8f516610b0 ("drm/i915/uapi: Add DRM_I915_QUERY_GEOMETRY_SUBSLICES") 1c671ad753dbbf5f ("drm/i915/doc: Link query items to their uapi structs") a2e5402691e23269 ("drm/i915/doc: Convert perf UAPI comments to kerneldoc") 462ac1cdf4d7acf1 ("drm/i915/doc: Convert drm_i915_query_topology_info comment to kerneldoc") 034d47b25b2ce627 ("drm/i915/uapi: Document DRM_I915_QUERY_HWCONFIG_BLOB") 78e1fb3112c0ac44 ("drm/i915/uapi: Add query for hwconfig blob") That don't add any new ioctl, so no changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: John Harrison Cc: Matt Atwood Cc: Matt Roper Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Link: http://lore.kernel.org/lkml/YrDi4ALYjv9Mdocq@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 342cb0d80613719c5e5ac30619e54b9a3fd83625 Author: Adrian Hunter Date: Mon Jun 20 13:39:04 2022 +0300 perf inject: Fix missing free in copy_kcore_dir() Free string allocated by asprintf(). Fixes: d8fc08550929bb84 ("perf inject: Keep a copy of kcore_dir") Signed-off-by: Adrian Hunter Cc: Adrian Hunter Cc: Jiri Olsa Link: https://lore.kernel.org/r/20220620103904.7960-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 0a1355db36718178becd2bfe728a023933d73123 Author: Helge Deller Date: Sun Jun 26 11:50:43 2022 +0200 parisc: Enable ARCH_HAS_STRICT_MODULE_RWX Fix a boot crash on a c8000 machine as reported by Dave. Basically it changes patch_map() to return an alias mapping to the to-be-patched code in order to prevent writing to write-protected memory. Signed-off-by: Helge Deller Suggested-by: John David Anglin Cc: stable@vger.kernel.org # v5.2+ Link: https://lore.kernel.org/all/e8ec39e8-25f8-e6b4-b7ed-4cb23efc756e@bell.net/ commit e9ed22e6e5010997a2f922eef61ca797d0a2a246 Author: John David Anglin Date: Sat Jun 18 15:14:34 2022 +0000 parisc: Fix flush_anon_page on PA8800/PA8900 Anonymous pages are allocated with the shared mappings colouring, SHM_COLOUR. Since the alias boundary on machines with PA8800 and PA8900 processors is unknown, flush_user_cache_page() might not flush all mappings of a shared anonymous page. Flushing the whole data cache flushes all mappings. This won't fix all coherency issues with shared mappings but it seems to work well in practice. I haven't seen any random memory faults in almost a month on a rp3440 running as a debian buildd machine. There is a small preformance hit. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.18+ commit d640974d1c4ee510fcc8f05f0ddaaf9d17b47643 Author: Konrad Dybcio Date: Mon May 23 23:03:04 2022 +0200 MAINTAINERS: Add myself as a reviewer for Qualcomm ARM/64 support Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220523210304.19125-1-konrad.dybcio@somainline.org commit 3ba500dee327e0261e728edec8a4f2f563d2760c Author: Dmitry Baryshkov Date: Tue May 31 15:47:35 2022 +0300 arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node It was noticed that on sdm845 after an MDSS suspend/resume cycle the driver can not read HW_REV registers properly (they will return 0 instead). Chaning the "iface" clock from <&gcc GCC_DISP_AHB_CLK> to <&dispcc DISP_CC_MDSS_AHB_CLK> fixes the issue. Fixes: 08c2a076d18f ("arm64: dts: qcom: sdm845: Add dpu to sdm845 dts file") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220531124735.1165582-1-dmitry.baryshkov@linaro.org commit 067baa9a37b32b95fdeabccde4b0cb6a2cf95f96 Author: Jason A. Donenfeld Date: Sat Jun 25 13:01:08 2022 +0200 ksmbd: use vfs_llseek instead of dereferencing NULL By not checking whether llseek is NULL, this might jump to NULL. Also, it doesn't check FMODE_LSEEK. Fix this by using vfs_llseek(), which always does the right thing. Fixes: f44158485826 ("cifsd: add file operations") Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: Ronnie Sahlberg Cc: Hyunchul Lee Cc: Sergey Senozhatsky Reviewed-by: Namjae Jeon Acked-by: Al Viro Signed-off-by: Jason A. Donenfeld Signed-off-by: Steve French commit d16c5c7c925658ea94689dfe4469441f7fd59f00 Author: Jiang Jian Date: Tue Jun 21 14:38:23 2022 +0800 parisc: align '*' in comment in math-emu code Signed-off-by: Jiang Jian Reviewed-by: Kees Cook Signed-off-by: Helge Deller commit ff139766764675b9df12bcbc8928a02149b7ba95 Author: Sami Tolvanen Date: Thu Jun 16 19:57:59 2022 +0000 kbuild: Ignore __this_module in gen_autoksyms.sh Module object files can contain an undefined reference to __this_module, which isn't resolved until we link the final .ko. The kernel doesn't export this symbol, so ignore it in gen_autoksyms.sh. Signed-off-by: Sami Tolvanen Tested-by: Steve Muckle Reviewed-by: Nick Desaulniers Tested-by: Ramji Jiyani commit 53632ba87d9f302a8d97a11ec2f4f4eec7bb75ea Author: Masahiro Yamada Date: Fri Jun 24 04:11:47 2022 +0900 kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt) If CONFIG_TRIM_UNUSED_KSYMS is enabled and the kernel is built from a pristine state, the vmlinux is linked twice. Commit 3fdc7d3fe4c0 ("kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS") explains why this happens, but it did not fix the issue at all. Now I realized I had applied a wrong patch. In v1 patch [1], the autoksyms_recursive target correctly recurses to "$(MAKE) -f $(srctree)/Makefile autoksyms_recursive". In v2 patch [2], I accidentally dropped the diff line, and it recurses to "$(MAKE) -f $(srctree)/Makefile vmlinux". Restore the code I intended in v1. [1]: https://lore.kernel.org/linux-kbuild/1521045861-22418-8-git-send-email-yamada.masahiro@socionext.com/ [2]: https://lore.kernel.org/linux-kbuild/1521166725-24157-8-git-send-email-yamada.masahiro@socionext.com/ Fixes: 3fdc7d3fe4c0 ("kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS") Signed-off-by: Masahiro Yamada Tested-by: Sami Tolvanen Reviewed-by: Nick Desaulniers commit fc8b0b9b630df6de7415f527fe27c0c441b5dc70 Author: Dmitry Baryshkov Date: Mon May 2 22:26:04 2022 +0300 arm64: dts: qcom: sm8450 add ITS device tree node Add device tree node corresponding to the ITS part of GICv3. Reviewed-by: Vinod Koul Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220502192604.272686-1-dmitry.baryshkov@linaro.org commit 47bf59c4755930f616dd90c8c6a85f40a6d347ea Author: Konrad Dybcio Date: Sun May 1 20:40:16 2022 +0200 arm64: dts: qcom: msm8994: Fix CPU6/7 reg values CPU6 and CPU7 were mistakengly pointing to CPU5 reg. Fix it. Fixes: 02d8091bbca0 ("arm64: dts: qcom: msm8994: Add a proper CPU map") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220501184016.64138-1-konrad.dybcio@somainline.org commit 0840a7914caa14315a3191178a9f72c742477860 Merge: c24eb8d6a5b2d 315f7e15c2611 Author: Linus Torvalds Date: Sat Jun 25 10:07:36 2022 -0700 Merge tag 'char-misc-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull IIO driver fixes from Greg KH: "Here are a set of IIO driver fixes for 5.19-rc4. Jonathan said it best in his pull request to me, so I'll just quote it here below, as that's the only changes we have right now for the char-misc driver tree: testing: - Fix a missing MODULE_LICENSE() warning by restricting possible build configs. Various drivers: - Fix ordering of iio_get_trigger() being called before iio_trigger_register() adi,admv1014: - Fix dubious x & !y warning. adi,axi-adc: - Fix missing of_node_put() in error and normal paths. aspeed,adc: - Add missing of_node_put() fsl,mma8452: - Fix broken probing from device tree. - Drop check on return value of i2c write to device to cause reset as ACK will be missing (device reset before sending it). fsl,vf610: - Fix documentation of in_conversion_mode ABI. iio-trig-sysfs: - Ensure irq work has finished before freeing the trigger. invensense,mpu3050: - Disable regulators in error path. invensense,icm42600: - Fix collision of enum value of 0 with error path where 0 is no match. renesas,rzg2l_Adc: - Add missing fwnode_handle_put() in error path. rescale: - Fix a boolean logic bug for detection of raw + scale affecting an obscure corner case. semtech,sx9324: - Check return value of read of pin_defs st,stm32-adc: - Fix interaction across ADC instances for some supported devices. - Drop false spurious IRQ messages. - Fix calibration value handling. If we can't calibrate don't expose the vref_int channel. - Fix maximum clock rate for stm32pm15x ti,ads131e08: - Add missing fwnode_handle_put() in error paths. xilinx,ams: - Fix variable checked for error from platform_get_irq() x-powers,axp288: - Overide TS_PIN bias current for boards where it is not correctly initialized. yamaha,yas530: - Fix inverted check on calibration data being all zeros. All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (26 commits) iio:proximity:sx9324: Check ret value of device_property_read_u32_array() iio: accel: mma8452: ignore the return value of reset operation iio: adc: stm32: fix maximum clock rate for stm32mp15x iio: adc: stm32: fix vrefint wrong calibration value handling iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) iio: adc: vf610: fix conversion mode sysfs node name iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client iio: test: fix missing MODULE_LICENSE for IIO_RESCALE=m iio:humidity:hts221: rearrange iio trigger get and register iio:chemical:ccs811: rearrange iio trigger get and register iio:accel:mxc4005: rearrange iio trigger get and register iio:accel:kxcjk-1013: rearrange iio trigger get and register iio:accel:bma180: rearrange iio trigger get and register iio: afe: rescale: Fix boolean logic bug iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message iio: adc: stm32: Fix ADCs iteration in irq handler iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels() iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties() iio: trigger: sysfs: fix use-after-free on remove ... commit c24eb8d6a5b2da4cbef6a053f58ea9818c6dd659 Merge: cb84318baa063 b24346a240b36 Author: Linus Torvalds Date: Sat Jun 25 10:02:05 2022 -0700 Merge tag 'usb-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 5.19-rc4 for a few small reported issues. They include: - new usb-serial driver ids - MAINTAINERS file update to properly catch the USB dts files - dt-bindings fixes for reported build warnings - xhci driver fixes for reported problems - typec Kconfig dependancy fix - raw_gadget fuzzing fixes found by syzbot - chipidea driver bugfix - usb gadget uvc bugfix All of these have been in linux-next with no reported issues" * tag 'usb-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: chipidea: udc: check request status before setting device address USB: gadget: Fix double-free bug in raw_gadget driver xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI xhci: turn off port power in shutdown xhci: Keep interrupt disabled in initialization until host is running. USB: serial: option: add Quectel RM500K module support USB: serial: option: add Quectel EM05-G modem USB: serial: pl2303: add support for more HXN (G) types usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC usb: gadget: uvc: fix list double add in uvcg_video_pump dt-bindings: usb: ehci: Increase the number of PHYs dt-bindings: usb: ohci: Increase the number of PHYs usb: gadget: Fix non-unique driver names in raw-gadget driver MAINTAINERS: add include/dt-bindings/usb to USB SUBSYSTEM USB: serial: option: add Telit LE910Cx 0x1250 composition commit fbb564a557809466c171b95f8d593a0972450ff2 Author: wuchi Date: Sun Jun 5 22:58:35 2022 +0800 lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() 1. Getting next index before continue branch. 2. Checking free bits when setting the target bits. Otherwise, it may reuse the busying bits. Signed-off-by: wuchi Reviewed-by: Martin Wilck Link: https://lore.kernel.org/r/20220605145835.26916-1-wuchi.zero@gmail.com Fixes: 9672b0d43782 ("sbitmap: add __sbitmap_queue_get_batch()") Signed-off-by: Jens Axboe commit cb84318baa063ffd11d4c5eec5c429c85855504a Merge: 29eeafc661f28 ea18d43478110 Author: Linus Torvalds Date: Sat Jun 25 09:24:59 2022 -0700 Merge tag 'loongarch-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Some bug fixes and a trivial cleanup" * tag 'loongarch-fixes-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Make compute_return_era() return void LoongArch: Fix wrong fpu version LoongArch: Fix EENTRY/MERRENTRY setting in setup_tlb_handler() LoongArch: Fix sleeping in atomic context in setup_tlb_handler() LoongArch: Fix the _stext symbol address LoongArch: Fix the !THP build commit 29eeafc661f283a7412ecf8d9899a5ffd0c80f59 Merge: 8c23f235a6a8a 82c7863ed95d0 Author: Linus Torvalds Date: Sat Jun 25 09:19:51 2022 -0700 Merge tag 'f2fs-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: "Some urgent fixes to avoid generating corrupted inodes caused by compressed and inline_data files. In addition, avoid a wrong error report which prevents a roll-forward recovery" * tag 'f2fs-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: do not count ENOENT for error case f2fs: fix iostat related lock protection f2fs: attach inline_data after setting compression commit ea18d434781105ce61ff3ef7f74c9e51812f0580 Author: Tiezhu Yang Date: Sat Jun 18 16:39:11 2022 +0800 LoongArch: Make compute_return_era() return void compute_return_era() always returns 0, make it return void, and then no need to check its return value for its callers. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit ad82eef3cebf8cd4f67e20b902e6d02e679e2ef1 Author: Tiezhu Yang Date: Sat Jun 18 12:50:31 2022 +0800 LoongArch: Fix wrong fpu version According to the configuration information accessible by the CPUCFG instruction in LoongArch Reference Manual [1], FP_ver is stored in bit [5: 3] of CPUCFG2, the current code to get fpu version is wrong, use CPUCFG2_FPVERS to fix it. [1] https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html Fixes: 628c3bb40e9a ("LoongArch: Add boot and setup routines") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 26808cebf14cdf1d835ae256188ece116d2ab377 Author: Huacai Chen Date: Thu Jun 23 16:11:54 2022 +0800 LoongArch: Fix EENTRY/MERRENTRY setting in setup_tlb_handler() setup_tlb_handler() is expected to set per-cpu exception handlers, but it only set the TLBRENTRY successfully because of copy & paste errors, so fix it. Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit bab1c299f3945ffe7934c05f3c50377ca4b291b4 Author: Huacai Chen Date: Thu Jun 23 09:55:42 2022 +0800 LoongArch: Fix sleeping in atomic context in setup_tlb_handler() Since setup_tlb_handler() is executed in atomic context, we should use GFP_ATOMIC instead of GFP_KERNEL to alloc pages. Otherwise we will get a "sleeping in atomic context" error: [ 0.013118] BUG: sleeping function called from invalid context at mm/page_alloc.c:5158 [ 0.013126] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.013131] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.19-rc3+ #1008 1a223086d14d07967cc427f15d52139422271360 [ 0.013136] Hardware name: Loongson Loongson-3A5000-7A1000-1w-V0.1-CRB/Loongson-LS3A5000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27 [ 0.013140] Stack : 90000000015fc990 9000000100493c18 9000000000df3370 9000000100490000 [ 0.013151] 9000000100493b50 0000000000000000 9000000100493b58 9000000001417ef0 [ 0.013160] 900000000199e54e 0000000000000040 9000000100493c18 90000000015f7a98 [ 0.013168] ffffffffffffffff 6de72f8b42179d1e 9000000100403b80 90000000015f7890 [ 0.013176] 0000000000000001 00000000fffff175 9000000000eb9860 9000000001530b4b [ 0.013184] 9000000000e99e60 0000000000000013 0000000006ecc000 0000000000000001 [ 0.013193] 90000000015f7a98 9000000001417ef0 0000000000000004 0000000000000000 [ 0.013201] 0000000000000cc0 0000000000000000 0000000000000001 90000000015fc990 [ 0.013209] 9000000000217e74 9000000001603b6b 9000000000208640 0000000000000000 [ 0.013217] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.013225] ... [ 0.013229] Call Trace: [ 0.013230] [<9000000000208640>] show_stack+0x4c/0x14c [ 0.013240] [<9000000000df3370>] dump_stack_lvl+0x70/0xac [ 0.013246] [<9000000000270c8c>] ___might_sleep+0x104/0x124 [ 0.013253] [<9000000000477e84>] __alloc_pages+0x240/0x464 [ 0.013260] [<9000000000214214>] setup_tlb_handler+0x104/0x1e8 [ 0.013265] [<9000000000214324>] tlb_init+0x2c/0x3c [ 0.013270] [<9000000000208b74>] per_cpu_trap_init+0xec/0x108 [ 0.013275] [<9000000000202850>] cpu_probe+0x400/0x8a4 [ 0.013279] [<900000000020d160>] start_secondary+0x5c/0x3d4 Signed-off-by: Huacai Chen commit 92264f2dae7324f3189d22c0a0f0cb4e5d30d617 Author: Huacai Chen Date: Sat Jun 25 16:55:41 2022 +0800 LoongArch: Fix the _stext symbol address _stext means the start of .text section (see __is_kernel_text()), but we put its definition in .ref.text by mistake. Fix it by defining it in the vmlinux.lds.S. Signed-off-by: Huacai Chen commit 501dcbe495c0484a8f7954f1b24d2002dc6cb2d2 Author: Huacai Chen Date: Wed Jun 22 21:56:16 2022 +0800 LoongArch: Fix the !THP build Fix the !THP build by making pmd_pfn() available in all configurations. Because pmd_pfn() is used in mm/page_vma_mapped.c whether or not THP is configured. Signed-off-by: Huacai Chen commit 8c23f235a6a8ae43abea215812eb9d8cf4dd165e Merge: 6a0a17e6c6d10 b0d473185ba88 Author: Linus Torvalds Date: Fri Jun 24 17:01:31 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - make the irqchip immutable in gpio-realtek-otto - fix error code propagation in gpio-winbond - fix device removing in gpio-grgpio - fix a typo in gpio-mxs which indicates the driver is for a different model - documentation fixes - MAINTAINERS file updates * tag 'gpio-fixes-for-v5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mxs: Fix header comment gpio: Fix kernel-doc comments to nested union gpio: grgpio: Fix device removing gpio: winbond: Fix error code in winbond_gpio_get() gpio: realtek-otto: Make the irqchip immutable docs: driver-api: gpio: Fix filename mismatch MAINTAINERS: add include/dt-bindings/gpio to GPIO SUBSYSTEM commit 3b89b511ea0c705cc418440e2abf9d692a556d84 Author: Dan Carpenter Date: Thu Jun 23 16:32:32 2022 +0300 net: fix IFF_TX_SKB_NO_LINEAR definition The "1<<31" shift has a sign extension bug so IFF_TX_SKB_NO_LINEAR is 0xffffffff80000000 instead of 0x0000000080000000. Fixes: c2ff53d8049f ("net: Add priv_flags for allow tx skb without linear") Signed-off-by: Dan Carpenter Reviewed-by: Xuan Zhuo Link: https://lore.kernel.org/r/YrRrcGttfEVnf85Q@kili Signed-off-by: Jakub Kicinski commit 8cc683833726912498130a0130fc3bd0d169ef59 Merge: 3b9bc84d31110 0e597e2affb90 Author: Jakub Kicinski Date: Fri Jun 24 16:33:44 2022 -0700 Merge branch 'net-dp83822-fix-interrupt-floods' Enguerrand de Ribaucourt says: ==================== net: dp83822: fix interrupt floods The false carrier and RX error counters, once half full, produce interrupt floods. Since we do not use these counters, these interrupts should be disabled. ==================== Link: https://lore.kernel.org/r/20220623134645.1858361-1-enguerrand.de-ribaucourt@savoirfairelinux.com Signed-off-by: Jakub Kicinski commit 0e597e2affb90d6ea48df6890d882924acf71e19 Author: Enguerrand de Ribaucourt Date: Thu Jun 23 15:46:45 2022 +0200 net: dp83822: disable rx error interrupt Some RX errors, notably when disconnecting the cable, increase the RCSR register. Once half full (0x7fff), an interrupt flood is generated. I measured ~3k/s interrupts even after the RX errors transfer was stopped. Since we don't read and clear the RCSR register, we should disable this interrupt. Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") Signed-off-by: Enguerrand de Ribaucourt Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski commit c96614eeab663646f57f67aa591e015abd8bd0ba Author: Enguerrand de Ribaucourt Date: Thu Jun 23 15:46:44 2022 +0200 net: dp83822: disable false carrier interrupt When unplugging an Ethernet cable, false carrier events were produced by the PHY at a very high rate. Once the false carrier counter full, an interrupt was triggered every few clock cycles until the cable was replugged. This resulted in approximately 10k/s interrupts. Since the false carrier counter (FCSCR) is never used, we can safely disable this interrupt. In addition to improving performance, this also solved MDIO read timeouts I was randomly encountering with an i.MX8 fec MAC because of the interrupt flood. The interrupt count and MDIO timeout fix were tested on a v5.4.110 kernel. Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") Signed-off-by: Enguerrand de Ribaucourt Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski commit 3b9bc84d311104906d2b4995a9a02d7b7ddab2db Author: Jakub Kicinski Date: Wed Jun 22 21:20:39 2022 -0700 net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first. Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220623042039.2274708-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6f0012e35160cd08a53e46e3b3bbf724b92dfe68 Author: Eric Dumazet Date: Thu Jun 23 05:04:36 2022 +0000 tcp: add a missing nf_reset_ct() in 3WHS handling When the third packet of 3WHS connection establishment contains payload, it is added into socket receive queue without the XFRM check and the drop of connection tracking context. This means that if the data is left unread in the socket receive queue, conntrack module can not be unloaded. As most applications usually reads the incoming data immediately after accept(), bug has been hiding for quite a long time. Commit 68822bdf76f1 ("net: generalize skb freeing deferral to per-cpu lists") exposed this bug because even if the application reads this data, the skb with nfct state could stay in a per-cpu cache for an arbitrary time, if said cpu no longer process RX softirqs. Many thanks to Ilya Maximets for reporting this issue, and for testing various patches: https://lore.kernel.org/netdev/20220619003919.394622-1-i.maximets@ovn.org/ Note that I also added a missing xfrm4_policy_check() call, although this is probably not a big issue, as the SYN packet should have been dropped earlier. Fixes: b59c270104f0 ("[NETFILTER]: Keep conntrack reference until IPsec policy checks are done") Reported-by: Ilya Maximets Signed-off-by: Eric Dumazet Cc: Florian Westphal Cc: Pablo Neira Ayuso Cc: Steffen Klassert Tested-by: Ilya Maximets Reviewed-by: Ilya Maximets Link: https://lore.kernel.org/r/20220623050436.1290307-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 179a93f74b29d0f37871d7afe826292cda90f113 Author: Masami Hiramatsu (Google) Date: Fri Jun 24 07:31:35 2022 +0900 fprobe, samples: Add module parameter descriptions Add module parameter descriptions for the fprobe_example module. Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/165602349520.56016.1314423560740428008.stgit@devnote2 commit 6a0a17e6c6d1091ada18d43afd87fb26a82a9823 Merge: 4039974f3b39a 06781a5026350 Author: Linus Torvalds Date: Fri Jun 24 14:04:08 2022 -0700 Merge tag 'mtd/fixes-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel RAynal: "NAND controller fix: - gpmi: Fix busy timeout setting (wrong calculation) NAND chip driver fix: - Thoshiba: Revert the commit introducing support for a chip that might have been counterfeit" * tag 'mtd/fixes-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: gpmi: Fix setting busy timeout setting Revert "mtd: rawnand: add support for Toshiba TC58NVG0S3HTA00 NAND flash" commit 4039974f3b39abcdc1b7662489157914fd6613bf Merge: bed051817cb38 419bc8f681a0d Author: Linus Torvalds Date: Fri Jun 24 13:54:16 2022 -0700 Merge tag 'spi-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A bunch of driver specific fixes, plus a fix for spi-mem's status polling for devices that use GPIO chip selects and a DT bindings examples fix that helps with the validation work" * tag 'spi-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: rockchip: Unmask IRQ at the final to avoid preemption spi: dt-bindings: Fix unevaluatedProperties warnings in examples spi: spi-mem: Fix spi_mem_poll_status() spi: cadence: Detect transmit FIFO depth spi: spi-cadence: Fix SPI CS gets toggling sporadically commit bed051817cb38eda5f80201956a2500b4e88cd14 Merge: 7bc83546079a3 122e951eb8045 Author: Linus Torvalds Date: Fri Jun 24 13:51:07 2022 -0700 Merge tag 'regulator-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One fix for an incorrect device description for MP5496" * tag 'regulator-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom_smd: correct MP5496 ranges commit 7bc83546079a378ce91ef83fc2c6da195e9df0cf Merge: bc3b8977e3747 3f05010f243be Author: Linus Torvalds Date: Fri Jun 24 13:49:13 2022 -0700 Merge tag 'regmap-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "Two sets of fixes - one for things that were missed with the support for custom bulk I/O operations introduced in the last merge window, and another for some long standing issues with regmap-irq which affect a fairly small subset of devices" * tag 'regmap-fix-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-irq: Fix offset/index mismatch in read_sub_irq_data() regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips regmap: Wire up regmap_config provided bulk write in missed functions regmap: Make regmap_noinc_read() return -ENOTSUPP if map->read isn't set regmap: Re-introduce bulk read support check in regmap_bulk_read() commit bc3b8977e3747ab8aa54a0760dce5cdfa37ad4d6 Merge: 70d605cbeecb4 c242507c1b895 Author: Linus Torvalds Date: Fri Jun 24 13:41:47 2022 -0700 Merge tag 'iommu-fixes-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Add a new IOMMU mailing list to the MAINTAINERS file to prepare for the a list migration happening on July 5th. The old list needs to stay in place until the switch happens to guarantee seemless archiving of list email. - Fix compatible device-tree string for rcar-gen4 in Renesas IOMMU driver. * tag 'iommu-fixes-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: MAINTAINERS: Add new IOMMU development mailing list iommu/ipmmu-vmsa: Fix compatible for rcar-gen4 commit 2990f223ffa7bb25422956b9f79f9176a5b38346 Author: Miaoqian Lin Date: Tue Jun 21 09:25:44 2022 +0400 RDMA/cm: Fix memory leak in ib_cm_insert_listen cm_alloc_id_priv() allocates resource for the cm_id_priv. When cm_init_listen() fails it doesn't free it, leading to memory leak. Add the missing error unwind. Fixes: 98f67156a80f ("RDMA/cm: Simplify establishing a listen cm_id") Link: https://lore.kernel.org/r/20220621052546.4821-1-linmq006@gmail.com Signed-off-by: Miaoqian Lin Signed-off-by: Jason Gunthorpe commit 70d605cbeecb408dd884b1f0cd3963eeeaac144c Merge: f6e9d01468087 e83031564137c Author: Linus Torvalds Date: Fri Jun 24 12:34:13 2022 -0700 Merge tag 'riscv-for-linus-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Palmer Dabbelt: - fix the T-Head memory type errata workaround to avoid behavior that is unsupported in the LLVM assembler * tag 'riscv-for-linus-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix ALT_THEAD_PMA's asm parameters commit f6e9d01468087e41c0905a60bba6a451882dd3b8 Merge: 2c39d612aa5f3 21e876448792a Author: Linus Torvalds Date: Fri Jun 24 12:27:24 2022 -0700 Merge tag 's390-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix perf stat accounting for cryptography counters when multiple events are installed concurrently. - Prevent installation of unsupported perf events for cryptography counters. - Treat perf events cpum_cf/CPU_CYCLES/ and cpu_cf/INSTRUCTIONS/ identical to basic events CPU_CYCLES" and INSTRUCTIONS, since they address the same hardware. - Restore kcrash operation which was broken by commit 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter"). * tag 's390-5.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pai: Fix multiple concurrent event installation s390/pai: Prevent invalid event number for pai_crypto PMU s390/cpumf: Handle events cycles and instructions identical s390/crash: make copy_oldmem_page() return number of bytes copied s390/crash: add missing iterator advance in copy_oldmem_page() commit 2c39d612aa5f34d63d264598692a7e6cd4fb34eb Merge: e946554905c1d dbe97cff7dd9f Author: Linus Torvalds Date: Fri Jun 24 12:22:11 2022 -0700 Merge tag 'for-linus-5.19a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - A rare deadlock in Qubes-OS between the i915 driver and Xen grant unmapping, solved by making the unmapping fully asynchronous - A bug in the Xen blkfront driver caused by incomplete error handling - A fix for undefined behavior (shifting a signed int by 31 bits) - A fix in the Xen drmfront driver avoiding a WARN() * tag 'for-linus-5.19a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/gntdev: Avoid blocking in unmap_grant_pages() drm/xen: Add missing VM_DONTEXPAND flag in mmap callback x86/xen: Remove undefined behavior in setup_features() xen-blkfront: Handle NULL gendisk commit e946554905c1d04da2a094ce4fdf47708f570bef Merge: 38bc4ac431684 6defa24d3b12b Author: Linus Torvalds Date: Fri Jun 24 12:17:47 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM64: - Fix a regression with pKVM when kmemleak is enabled - Add Oliver Upton as an official KVM/arm64 reviewer selftests: - deal with compiler optimizations around hypervisor exits x86: - MAINTAINERS reorganization - Two SEV fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SEV: Init target VMCBs in sev_migrate_from KVM: x86/svm: add __GFP_ACCOUNT to __sev_dbg_{en,de}crypt_user() MAINTAINERS: Reorganize KVM/x86 maintainership selftests: KVM: Handle compiler optimizations in ucall KVM: arm64: Add Oliver as a reviewer KVM: arm64: Prevent kmemleak from accessing pKVM memory tools/kvm_stat: fix display of error when multiple processes are found commit ef9102004a87cb3f8b26e000a095a261fc0467d3 Author: Chris Ye Date: Tue May 31 17:09:54 2022 -0700 nvdimm: Fix badblocks clear off-by-one error nvdimm_clear_badblocks_region() validates badblock clearing requests against the span of the region, however it compares the inclusive badblock request range to the exclusive region range. Fix up the off-by-one error. Fixes: 23f498448362 ("libnvdimm: rework region badblocks clearing") Cc: Signed-off-by: Chris Ye Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/165404219489.2445897.9792886413715690399.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 38bc4ac431684498126f9baa3a530e5a132f0173 Merge: cbe232ab07ab7 1e9124df8be0a Author: Linus Torvalds Date: Fri Jun 24 11:43:49 2022 -0700 Merge tag 'drm-fixes-2022-06-24' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Fixes for this week, bit larger than normal, but I think the last couple have been quieter, and it's only rc4. There are a lot of small msm fixes, and a slightly larger set of vc4 fixes. The vc4 fixes clean up a lot of crashes around the rPI4 hardware differences from earlier ones, and problems in the page flip and modeset code which assumed earlier hw, so I thought it would be okay to keep them in. Otherwise, it's a few amdgpu, i915, sun4i and a panel quirk. amdgpu: - Adjust GTT size logic - eDP fix for RMB - DCN 3.15 fix - DP training fix - Color encoding fix for DCN2+ sun4i: - multiple suspend fixes vc4: - rework driver split for rpi4, fixes mulitple crashers. panel: - quirk for Aya Neo Next i915: - Revert low voltage SKU check removal to fix display issues - Apply PLL DCO fraction workaround for ADL-S - Don't show engine classes not present in client fdinfo msm: - Workaround for parade DSI bridge power sequencing - Fix for multi-planar YUV format offsets - Limiting WB modes to max sspp linewidth - Fixing the supported rotations to add 180 back for IGT - Fix to handle pm_runtime_get_sync() errors to avoid unclocked access in the bind() path for dpu driver - Fix the irq_free() without request issue which was a being hit frequently in CI. - Fix to add minimum ICC vote in the msm_mdss pm_resume path to address bootup splats - Fix to avoid dereferencing without checking in WB encoder - Fix to avoid crash during suspend in DP driver by ensuring interrupt mask bits are updated - Remove unused code from dpu_encoder_virt_atomic_check() - Fix to remove redundant init of dsc variable - Fix to ensure mmap offset is initialized to avoid memory corruption from unpin/evict - Fix double runpm disable in probe-defer path - VMA fenced-unpin fixes - Fix for WB max-width - Fix for rare dp resolution change issue" * tag 'drm-fixes-2022-06-24' of git://anongit.freedesktop.org/drm/drm: (41 commits) amd/display/dc: Fix COLOR_ENCODING and COLOR_RANGE doing nothing for DCN20+ drm/amd/display: Fix typo in override_lane_settings drm/amd/display: Fix DC warning at driver load drm/amd: Revert "drm/amd/display: keep eDP Vdd on when eDP stream is already enabled" drm/amdgpu: Adjust logic around GTT size (v3) drm/sun4i: Return if frontend is not present drm/vc4: fix error code in vc4_check_tex_size() drm/sun4i: Add DMA mask and segment size drm/vc4: hdmi: Fixed possible integer overflow drm/i915/display: Re-add check for low voltage sku for max dp source rate drm/i915/fdinfo: Don't show engine classes not present drm/i915: Implement w/a 22010492432 for adl-s drm: panel-orientation-quirks: Add quirk for Aya Neo Next drm/msm/dp: force link training for display resolution change drm/msm/dpu: limit wb modes based on max_mixer_width drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind() drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf drm/msm: Don't overwrite hw fence in hw_init drm/msm: Drop update_fences() drm/vc4: Warn if some v3d code is run on BCM2711 ... commit af3a6d1018f02c6dc8388f1f3785a559c7ab5961 Author: Paulo Alcantara Date: Fri Jun 24 15:01:43 2022 -0300 cifs: update cifs_ses::ip_addr after failover cifs_ses::ip_addr wasn't being updated in cifs_session_setup() when reconnecting SMB sessions thus returning wrong value in /proc/fs/cifs/DebugData. Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@kernel.org Signed-off-by: Steve French commit 935336c191040809bf5739654ea337c13fe8f9af Author: Jakub Sitnicki Date: Thu Jun 23 11:12:31 2022 +0200 selftests/bpf: Test sockmap update when socket has ULP Cover the scenario when we cannot insert a socket into the sockmap, because it has it is using ULP. Failed insert should not have any effect on the ULP state. This is a regression test. Signed-off-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20220623091231.417138-1-jakub@cloudflare.com Signed-off-by: Jakub Kicinski commit cbe232ab07ab7a1c7743c94c53d0e0d50c3d1b88 Merge: 43627618a0dff 90736eb3232d2 Author: Linus Torvalds Date: Fri Jun 24 11:16:27 2022 -0700 Merge tag 'for-5.19/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM era to commit metadata during suspend using drain_workqueue instead of flush_workqueue. - Fix DM core's dm_io_complete to not return early if io error is BLK_STS_AGAIN but bio polling is not in use. - Fix DM core's dm_io_complete BLK_STS_DM_REQUEUE handling when dm_io represents a split bio. - Fix recent DM mirror log regression by clearing bits up to BITS_PER_LONG boundary. * tag 'for-5.19/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm mirror log: clear log bits up to BITS_PER_LONG boundary dm: fix BLK_STS_DM_REQUEUE handling when dm_io represents split bio dm: do not return early from dm_io_complete if BLK_STS_AGAIN without polling dm era: commit metadata in postsuspend after worker stops commit 43627618a0dff4d7b2d743c2b57e0130f3fa6a7e Merge: a237cfd6b7469 540a92bfe6dab Author: Linus Torvalds Date: Fri Jun 24 11:12:34 2022 -0700 Merge tag 'ata-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fix from Damien Le Moal: - a single patch to fix tracing of command completion (Edward) * tag 'ata-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata: add qc->flags in ata_qc_complete_template tracepoint commit a237cfd6b7469d6f5eeaa45f30128ab78b5281a5 Merge: 598f240487933 e531485a0a0e0 Author: Linus Torvalds Date: Fri Jun 24 11:07:54 2022 -0700 Merge tag 'block-5.19-2022-06-24' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Series fixing issues with sysfs locking and name reuse (Christoph) - NVMe pull request via Christoph: - Fix the mixed up CRIMS/CRWMS constants (Joel Granados) - Add another broken identifier quirk (Leo Savernik) - Fix up a quirk because Samsung reuses PCI IDs over different products (Christoph Hellwig) - Remove old WARN_ON() that doesn't apply anymore (Li) - Fix for using a stale cached request value for rq-qos throttling mechanisms that may schedule(), like iocost (me) - Remove unused parameter to blk_independent_access_range() (Damien) * tag 'block-5.19-2022-06-24' of git://git.kernel.dk/linux-block: block: remove WARN_ON() from bd_link_disk_holder nvme: move the Samsung X5 quirk entry to the core quirks nvme: fix the CRIMS and CRWMS definitions to match the spec nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH block: pop cached rq before potentially blocking rq_qos_throttle() block: remove queue from struct blk_independent_access_range block: freeze the queue earlier in del_gendisk block: remove per-disk debugfs files in blk_unregister_queue block: serialize all debugfs operations using q->debugfs_mutex block: disable the elevator int del_gendisk commit 598f2404879336277a4320ac5000394b873e049a Merge: 9d882352bac8f 386e4fb6962b9 Author: Linus Torvalds Date: Fri Jun 24 11:02:26 2022 -0700 Merge tag 'io_uring-5.19-2022-06-24' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "A few fixes that should go into the 5.19 release. All are fixing issues that either happened in this release, or going to stable. In detail: - A small series of fixlets for the poll handling, all destined for stable (Pavel) - Fix a merge error from myself that caused a potential -EINVAL for the recv/recvmsg flag setting (me) - Fix a kbuf recycling issue for partial IO (me) - Use the original request for the inflight tracking (me) - Fix an issue introduced this merge window with trace points using a custom decoder function, which won't work for perf (Dylan)" * tag 'io_uring-5.19-2022-06-24' of git://git.kernel.dk/linux-block: io_uring: use original request task for inflight tracking io_uring: move io_uring_get_opcode out of TP_printk io_uring: fix double poll leak on repolling io_uring: fix wrong arm_poll error handling io_uring: fail links when poll fails io_uring: fix req->apoll_events io_uring: fix merge error in checking send/recv addr2 flags io_uring: mark reissue requests with REQ_F_PARTIAL_IO commit 9d882352bac8f2ff3753d691e2dc65fcaf738729 Merge: 92f20ff72066d 51889d225ce2c Author: Linus Torvalds Date: Fri Jun 24 10:54:07 2022 -0700 Merge tag 'printk-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk kernel thread revert from Petr Mladek: "Revert printk console kthreads. The testing of 5.19 release candidates revealed issues that did not happen when all consoles were serialized using the console semaphore. More time is needed to check expectations of the existing console drivers and be confident that they can be safely used in parallel" * tag 'printk-for-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: Revert "printk: add functions to prefer direct printing" Revert "printk: add kthread console printers" Revert "printk: extend console_lock for per-console locking" Revert "printk: remove @console_locked" Revert "printk: Block console kthreads when direct printing will be required" Revert "printk: Wait for the global console lock when the system is going down" commit de9b3d9616078f1d1d0d51b01cdafa101733f935 Author: Vladimir Zapolskiy Date: Fri Mar 11 00:19:34 2022 +0200 arm64: dts: qcom: sm8450: fix interconnects property of UFS node All interconnect device tree nodes on sm8450 are 2-cells, however in UFS node they are handled as 1-cells, fix it. Fixes: aa2d0bf04a3c ("arm64: dts: qcom: sm8450: add interconnect nodes") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Reviewed-by: Vinod Koul Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220310221934.1560729-1-vladimir.zapolskiy@linaro.org commit 7f058112873e86ca760f2d2b0e1ccc2ab111f418 Author: Jae Hyun Yoo Date: Fri Jun 24 16:35:11 2022 +0930 ARM: dts: aspeed: nuvia: rename vendor nuvia to qcom Nuvia has been acquired by Qualcomm and the vendor name 'nuvia' will not be used anymore so rename aspeed-bmc-nuvia-dc-scm.dts to aspeed-bmc-qcom-dc-scm-v1.dts and change 'nuvia' to 'qcom' as its vendor name in the file. Fixes: 7b46aa7c008d ("ARM: dts: aspeed: Add Nuvia DC-SCM BMC") Signed-off-by: Jae Hyun Yoo Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20220523175640.60155-1-quic_jaehyoo@quicinc.com Link: https://lore.kernel.org/r/20220624070511.4070659-1-joel@jms.id.au' Signed-off-by: Arnd Bergmann commit 980555e95f7cabdc9c80a07107622b097ba23703 Author: Charles Keepax Date: Thu Jun 23 11:51:19 2022 +0100 ASoC: madera: Fix event generation for rate controls madera_adsp_rate_put always returns zero regardless of if the control value was updated. This results in missing notifications to user-space of the control change. Update the handling to return 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220623105120.1981154-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit e3cabbef3db8269207a6b8808f510137669f8deb Author: Charles Keepax Date: Thu Jun 23 11:51:18 2022 +0100 ASoC: madera: Fix event generation for OUT1 demux madera_out1_demux_put returns the value of snd_soc_dapm_mux_update_power, which returns a 1 if a path was found for the kcontrol. This is obviously different to the expected return a 1 if the control was updated value. This results in spurious notifications to user-space. Update the handling to only return a 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220623105120.1981154-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7f103af4a10f375b9b346b4d0b730f6a66b8c451 Author: Charles Keepax Date: Thu Jun 23 11:51:17 2022 +0100 ASoC: cs47l15: Fix event generation for low power mux control cs47l15_in1_adc_put always returns zero regardless of if the control value was updated. This results in missing notifications to user-space of the control change. Update the handling to return 1 when the value is changed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220623105120.1981154-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 46b0d050c8c7df6dfb2c376aaa149bf2cfc5ca3e Author: Charles Keepax Date: Thu Jun 23 11:51:16 2022 +0100 ASoC: cs35l41: Add ASP TX3/4 source to register patch The mixer controls for ASP TX3/4 are set to values that are not included in their enumeration control. This will cause spurious event notifications when the controls are first changed, as the register value changes whilst the actual visible enumeration value does not. Use the register patch to set them to a known value, zero, which equates to zero fill, thereby avoiding the spurious notifications. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220623105120.1981154-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 11d7a12f7f50baa5af9090b131c9b03af59503e7 Author: Charles Keepax Date: Thu Jun 23 11:51:15 2022 +0100 ASoC: dapm: Initialise kcontrol data for mux/demux controls DAPM keeps a copy of the current value of mux/demux controls, however this value is only initialised in the case of autodisable controls. This leads to false notification events when first modifying a DAPM kcontrol that has a non-zero default. Autodisable controls are left as they are, since they already initialise the value, and there would be more work required to support autodisable muxes where the first option isn't disabled and/or that isn't the default. Technically this issue could affect mixer/switch elements as well, although not on any of the devices I am currently running. There is also a little more work to do to address the issue there due to that side supporting stereo controls, so that has not been tackled in this patch. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220623105120.1981154-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 1df793d479bef546569fc2e409ff8bb3f0fb8e99 Author: Shuming Fan Date: Tue Jun 21 17:07:19 2022 +0800 ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error The initial settings will be written before the codec probe function. But, the rt711->component doesn't be assigned yet. If IO error happened during initial settings operations, it will cause the kernel panic. This patch changed component->dev to slave->dev to fix this issue. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20220621090719.30558-1-shumingf@realtek.com Signed-off-by: Mark Brown commit c6a5f22f9b4fd5f21414be690ce34046d9712f05 Author: Charles Keepax Date: Tue Jun 21 11:20:40 2022 +0100 ASoC: cs35l41: Correct some control names Various boolean controls on cs35l41 are missing the required "Switch" in the name, add these. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220621102041.1713504-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 0bc0ae9a5938d512fd5d44f11c9c04892dcf4961 Author: Charles Keepax Date: Tue Jun 21 11:20:39 2022 +0100 ASoC: wm5110: Fix DRE control The DRE controls on wm5110 should return a value of 1 if the DRE state is actually changed, update to fix this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220621102041.1713504-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 9896c029f0df628c6cb108253d09b1d61f1d4a88 Author: Charles Keepax Date: Tue Jun 21 11:20:38 2022 +0100 ASoC: wm_adsp: Fix event for preloader The preloader controls on ADSP should return a value of 1 if the preloader value was changed, update to correct this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220621102041.1713504-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit f2c2f31f00ce48d96dec28b9f8d70f73213ed4af Author: Srinivas Kandagatla Date: Fri Jun 17 14:02:30 2022 -0700 MAINTAINERS: update ASoC Qualcomm maintainer email-id Update Banajit's email address from codeaurora.org to quicinc.com, as codeaurora.org is not in use anymore. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220617210230.7685-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit a5450aba737dae3ee1a64b282e609d8375d6700c Author: Judy Hsiao Date: Wed Jun 15 04:56:43 2022 +0000 ASoC: rockchip: i2s: switch BCLK to GPIO We discoverd that the state of BCLK on, LRCLK off and SD_MODE on may cause the speaker melting issue. Removing LRCLK while BCLK is present can cause unexpected output behavior including a large DC output voltage as described in the Max98357a datasheet. In order to: 1. prevent BCLK from turning on by other component. 2. keep BCLK and LRCLK being present at the same time This patch switches BCLK to GPIO func before LRCLK output, and configures BCLK func back during LRCLK is output. Without this fix, BCLK is turned on 11 ms earlier than LRCK by the da7219. With this fix, BCLK is turned on only 0.4 ms earlier than LRCK by the rockchip codec. Signed-off-by: Judy Hsiao Link: https://lore.kernel.org/r/20220615045643.3137287-1-judyhsiao@chromium.org Signed-off-by: Mark Brown commit 391153522d186f19a008d824bb3a05950351ce6c Author: Pierre-Louis Bossart Date: Thu Jun 16 15:18:18 2022 -0500 ASoC: SOF: Intel: disable IMR boot when resuming from ACPI S4 and S5 states The IMR was assumed to be preserved when suspending to S4 and S5 states, but community reports invalidate that assumption, the hardware seems to be powered off and the IMR memory content cleared. Make sure regular boot with firmware download is used for S4 and S5. BugLink: https://github.com/thesofproject/sof/issues/5892 Fixes: 5fb5f51185126 ("ASoC: SOF: Intel: hda-loader: add IMR restore support") Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220616201818.130802-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 9d2d462713384538477703e68577b05131c7d97d Author: Pierre-Louis Bossart Date: Thu Jun 16 15:18:17 2022 -0500 ASoC: SOF: pm: add definitions for S4 and S5 states We currently don't have a means to differentiate between S3, S4 and S5. Add definitions so that we have select different code paths depending on the target state in follow-up patches. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220616201818.130802-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit a933084558c61cac8c902d2474b39444d87fba46 Author: Pierre-Louis Bossart Date: Thu Jun 16 15:18:16 2022 -0500 ASoC: SOF: pm: add explicit behavior for ACPI S1 and S2 The existing code only deals with S0 and S3, let's start adding S1 and S2. No functional change. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220616201818.130802-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ca7ab1dcf58dfce5bc851bf7e50fd94822c24665 Author: Peter Ujfalusi Date: Thu Jun 16 15:19:53 2022 -0500 ASoC: SOF: Intel: hda: Fix compressed stream position tracking Commit 288fad2f71fa ("ASoC: SOF: Intel: hda: add quirks for HDAudio DMA position information") modified the PCM path only, but left the compressed data patch using an obsolete option. Move the functionality in a helper that can be called for both PCM and compressed data. Reviewed-by: Ranjani Sridharan Fixes: 288fad2f71fa ("ASoC: SOF: Intel: hda: add quirks for HDAudio DMA position information") Signed-off-by: Peter Ujfalusi Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220616201953.130876-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 427eb3e1ed530792231bc5bbee6dec99fc57aeb7 Author: Dan Carpenter Date: Wed Jun 15 11:19:44 2022 +0300 ASoC: SOF: mediatek: Fix error code in probe This should return PTR_ERR() instead of IS_ERR(). Fixes: e0100bfd383c ("ASoC: SOF: mediatek: Add mt8186 ipc support") Signed-off-by: Dan Carpenter Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/YqmWIK8sTj578OJP@kili Signed-off-by: Mark Brown commit 4e07479eab8a044cc9542414ccb4aeb8eb033bde Author: Hans de Goede Date: Sun Jun 12 17:56:52 2022 +0200 ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem The "wlf,spkvdd-ena" GPIO needed by the bytcr_wm5102 driver is made available through a gpio-lookup table. This gpio-lookup table is registered by drivers/mfd/arizona-spi.c, which may get probed after the bytcr_wm5102 driver. If the gpio-lookup table has not registered yet then the gpiod_get() will return -ENOENT. Treat -ENOENT as -EPROBE_DEFER to still keep things working in this case. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220612155652.107310-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit a7d9391dc3d570aed87ed764db95b16760c898e4 Author: Pierre-Louis Bossart Date: Fri Jun 10 16:43:13 2022 -0500 MAINTAINERS: update ASoC/Intel/SOF maintainers Keyon Jie was a key contributor to the Intel ASoC and SOF Intel drivers, but he's moved on to a different role within Intel. We wish him all the best in his new endeavors. Bard Liao, Kai Vehmanen, Ranjani Sridharan and Peter Ujfalusi have been involved in the Intel multi-maintainer team, it's time to update the MAINTAINERS entry to reflect their contributions and clarify their role. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220610214313.42903-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 10e7ff0047921e32b919ecee7be706dd33c107f8 Author: Mark Brown Date: Fri Jun 3 14:25:26 2022 +0200 ASoC: wcd938x: Fix event generation for some controls Currently wcd938x_*_put() unconditionally report that the value of the control changed, resulting in spurious events being generated. Return 0 in that case instead as we should. There is still an issue in the compander control which is a bit more complex. Signed-off-by: Mark Brown Reported-by: kernel test robot Link: https://lore.kernel.org/r/20220603122526.3914942-1-broonie@kernel.org Signed-off-by: Mark Brown commit a7786cbae4b2732815da98efa39df96746b5bd0d Author: Mark Brown Date: Fri Jun 3 14:46:09 2022 +0200 ASoC: wcd9335: Fix spurious event generation The slimbus mux put operation unconditionally reports a change in value which means that spurious events are generated. Fix this by exiting early in that case. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220603124609.4024666-1-broonie@kernel.org Signed-off-by: Mark Brown commit be6dd72edb216f20fc80e426ece9fe9b8aabf033 Author: Yassine Oudjana Date: Mon Jun 6 19:22:26 2022 +0400 ASoC: wcd9335: Remove RX channel from old list before adding it to a new one Currently in slim_rx_mux_put, an RX channel gets added to a new list even if it is already in one. This can mess up links and make either it, the new list head, or both, get linked to the wrong entries. This can cause an entry to link to itself which in turn ends up making list_for_each_entry in other functions loop infinitely. To avoid issues, always remove the RX channel from any list it's in before adding it to a new list. Signed-off-by: Yassine Oudjana Link: https://lore.kernel.org/r/20220606152226.149164-1-y.oudjana@protonmail.com Signed-off-by: Mark Brown commit 58136d93d4e2c1207a5e4f3044815cd40b1d95fd Author: Srinivas Kandagatla Date: Fri Jun 10 15:48:18 2022 +0100 ASoC: qdsp6: q6apm-dai: unprepare stream if its already prepared prepare callback can be called multiple times, so unprepare the stream if its already prepared. Without this DSP is not happy to setting the params on a already prepared graph. Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") Reported-by: Srinivasa Rao Mandadapu Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220610144818.511797-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 12abc4d10d5502e4f3d8f1c6f9e8245747a44708 Author: Amadeusz Sławiński Date: Fri Jun 10 14:44:20 2022 +0200 ASoC: Remove unused hw_write_t type Commit 81da8a0b7975 ("ASoC: remove codec hw_write/control_data") removed use of hw_write_t in struct snd_soc_codec, but it left type definition. Fully clean it up. Fixes: 81da8a0b7975 ("ASoC: remove codec hw_write/control_data") Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Link: https://lore.kernel.org/r/20220610124420.4160986-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit af2d146a8041c67efdd620c9463973ce0650b7b7 Author: Amadeusz Sławiński Date: Fri Jun 10 14:42:57 2022 +0200 ASoC: Intel: avs: Fix parsing UUIDs in topology Use correct type for parsing UUIDs, this eliminates warning present, when compiling with W=1. Fixes: 34ae2cd53673 ("ASoC: Intel: avs: Add topology parsing infrastructure") Reported-by: Pierre-Louis Bossart Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Link: https://lore.kernel.org/r/20220610124257.4160658-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit c2d1aec3f5da2475aa13a487d329823b7d27d499 Author: Peter Ujfalusi Date: Fri Jun 10 11:47:35 2022 +0300 ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() Move the size checks prior to allocating memory as these checks do not need the data to be allocated and in case of an error we would not need to free the allocation. The max size must not be less than the size of struct sof_ipc_ctrl_data + struct sof_abi_hdr as the ABI header needs to be present under all circumstances. The check was incorrectly used or between the two size checks. Fixes: b5cee8feb1d4 ("ASoC: SOF: topology: Make control parsing IPC agnostic") Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220610084735.19397-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit bbfef046c6613404c01aeb9e9928bebb78dd327a Author: Peter Ujfalusi Date: Thu Jun 9 11:59:49 2022 +0300 ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow Update the comment for the cl_dsp_init() to clarify what is done by the function and use the chip->init_core_mask instead of BIT(0) when unstalling/running the init core. Complements: 2a68ff846164 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence") Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220609085949.29062-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c31691e0d126ec5d60d2b6b03f699c11b613b219 Author: Peter Ujfalusi Date: Thu Jun 9 11:59:48 2022 +0300 ASoC: SOF: Intel: hda-loader: Make sure that the fw load sequence is followed The hda_dsp_enable_core() is powering up _and_ unstall the core in one call while the first step of the firmware loading must not unstall the core. The core can be unstalled only after the set cpb_cfp and the configuration of the IPC register for the ROM_CONTROL message. Complements: 2a68ff846164 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence") Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220609085949.29062-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 08f8a93198e300dff9649bbae424cd805d313326 Author: Peter Ujfalusi Date: Thu Jun 9 11:59:47 2022 +0300 ASoC: SOF: Intel: hda-dsp: Expose hda_dsp_core_power_up() The hda_dsp_core_power_up() needs to be exposed so that it can be used in hda-loader.c to correct the boot flow. The first step must not unstall the core, it should only power up the core(s). Add sanity check for the core_mask while exposing it to be safe. Complements: 2a68ff846164 ("ASoC: SOF: Intel: hda: Revisit IMR boot sequence") Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220609085949.29062-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ed0073bd0fccec459b526918be70bf9dc551581a Author: Kuninori Morimoto Date: Wed Jun 8 02:09:16 2022 +0000 ASoC: ak4613: cares Simple-Audio-Card case for TDM Renesas is the only user of ak4613 on upstream for now, and commit f28dbaa958fbd8 ("ASoC: ak4613: add TDM256 support") added TDM256 support. Renesas tested part of it, because of board connection. It was assuming ak4613 is probed via Audio-Graph-Card, but it might be probed via Simple-Audio-Card either. It will indicates WARNING in such case. This patch fixup it. Reported-by: Geert Uytterhoeven Signed-off-by: Kuninori Morimoto Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/87h74v29f7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 40737057b48f1b4db67b0d766b95c87ba8fc5e03 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:52 2022 -0500 ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect The .set_jack_detect() codec component callback is invoked during card registration, which happens when the machine driver is probed. The issue is that this callback can race with the bus suspend/resume, and IO timeouts can happen. This can be reproduced very easily if the machine driver is 'blacklisted' and manually probed after the bus suspends. The bus and codec need to be re-initialized using pm_runtime helpers. Previous contributions tried to make sure accesses to the bus during the .set_jack_detect() component callback only happen when the bus is active. This was done by changing the regcache status on a component remove. This is however a layering violation, the regcache status should only be modified on device probe, suspend and resume. The component probe/remove should not modify how the device regcache is handled. This solution also didn't handle all the possible race conditions, and the RT700 headset codec was not handled. This patch tries to resume the codec device before handling the jack initializations. In case the codec has not yet been initialized, pm_runtime may not be enabled yet, so we don't squelch the -EACCES error code and only stop the jack information. When the codec reports as attached, the jack initialization will proceed as usual. BugLink: https://github.com/thesofproject/linux/issues/3643 Fixes: 7ad4d237e7c4a ('ASoC: rt711-sdca: Add RT711 SDCA vendor-specific driver') Fixes: 899b12542b089 ('ASoC: rt711: add snd_soc_component remove callback') Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-8-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ba98d7d8b60ba410aa03834f6aa48fd3b2e68478 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:51 2022 -0500 ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe The workqueues are initialized in the io_init functions, which isn't quite right. In some tests, this leads to warnings throw from __queue_delayed_work() WARN_ON_FUNCTION_MISMATCH(timer->function, delayed_work_timer_fn); Move all the initializations to the probe functions. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-7-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 0484271ab0ce50649329fa9dc23c50853c5b26a4 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:50 2022 -0500 ASoC: rt7*-sdw: harden jack_detect_handler Realtek headset codec drivers typically check if the card is instantiated before proceeding with the jack detection. The rt700, rt711 and rt711-sdca are however missing a check on the card pointer, which can lead to NULL dereferences encountered in driver bind/unbind tests. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-6-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 08bb5dc6ce02374169213cea772b1c297eaf32d5 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:49 2022 -0500 ASoC: rt711: fix calibrate mutex initialization Follow the same flow as rt711-sdca and initialize all mutexes at probe time. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-5-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit fe154c4ff376bc31041c6441958a08243df09c99 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:48 2022 -0500 ASoC: Intel: sof_sdw: handle errors on card registration If the card registration fails, typically because of deferred probes, the device properties added for headset codecs are not removed, which leads to kernel oopses in driver bind/unbind tests. We already clean-up the device properties when the card is removed, this code can be moved as a helper and called upon card registration errors. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ed0a7fb29c9fd4f53eeb37d1fe2354df7a038047 Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:47 2022 -0500 ASoC: rt711-sdca-sdw: fix calibrate mutex initialization In codec driver bind/unbind test, the following warning is thrown: DEBUG_LOCKS_WARN_ON(lock->magic != lock) ... [ 699.182495] rt711_sdca_jack_init+0x1b/0x1d0 [snd_soc_rt711_sdca] [ 699.182498] rt711_sdca_set_jack_detect+0x3b/0x90 [snd_soc_rt711_sdca] [ 699.182500] snd_soc_component_set_jack+0x24/0x50 [snd_soc_core] A quick check in the code shows that the 'calibrate_mutex' used by this driver are not initialized at probe time. Moving the initialization to the probe removes the issue. BugLink: https://github.com/thesofproject/linux/issues/3644 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ac63716da3070f8cb6baaba3a058a0c7f22aeb5b Author: Pierre-Louis Bossart Date: Mon Jun 6 15:37:46 2022 -0500 ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove When binding/unbinding codec drivers, the following warnings are thrown: [ 107.266879] rt715-sdca sdw:3:025d:0714:01: Unbalanced pm_runtime_enable! [ 306.879700] rt711-sdca sdw:0:025d:0711:01: Unbalanced pm_runtime_enable! Add a remove callback for all Realtek/Maxim SoundWire codecs and remove this warning. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220606203752.144159-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 60192dd85c3ca24fe0a66be939bba68c13f440aa Merge: 416e95a4798e0 1332661e09304 Author: Arnd Bergmann Date: Fri Jun 24 17:21:23 2022 +0200 Merge tag 'memory-controller-drv-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v5.19 Broken in current cycle: 1. OMAP GPMC: fix Kconfig dependency for OMAP_GPMC, so it will not be visible for everyone (driver is specific to OMAP). Broken before: 1. Mediatek SMI: fix missing put_device() in error paths. 2. Exynos DMC: fix OF node leaks in error paths. * tag 'memory-controller-drv-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common memory: omap-gpmc: OMAP_GPMC should depend on ARCH_OMAP2PLUS || ARCH_KEYSTONE || ARCH_K3 Link: https://lore.kernel.org/r/20220624081819.33617-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 416e95a4798e0504492f2645265f61e5dd0c0bcd Merge: b262b3b571bc5 c4c79525042a4 Author: Arnd Bergmann Date: Fri Jun 24 17:20:23 2022 +0200 Merge tag 'samsung-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes Samsung fixes for v5.19 Both fixes are for issues present before v5.19 merge window: 1. Correct UART clocks on Exynos7885. Although the initial, fixed DTS commit is from v5.18, the issue will be exposed with a upcoming fix to Exynos7885 clock driver, so we need to correct the DTS earlier. 2. Fix theoretical OF node leak in Exynos machine code. * tag 'samsung-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: exynos: Fix refcount leak in exynos_map_pmu arm64: dts: exynos: Correct UART clocks on Exynos7885 Link: https://lore.kernel.org/r/20220624080423.31427-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit b262b3b571bc58775e7a115d94b0fcd1b1636c34 Merge: db6b92459f598 b9b6d4c925604 Author: Arnd Bergmann Date: Fri Jun 24 17:19:49 2022 +0200 Merge tag 'arm-soc/for-5.19/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-SoC Device Tree fixes for 5.19, please pull the following: - Stefan fixes the Raspberry Pi 400 GPIO expander line names to match that of the downstream Raspberry Pi Linux tree * tag 'arm-soc/for-5.19/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2711-rpi-400: Fix GPIO line names Link: https://lore.kernel.org/r/20220620170745.2485199-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit db6b92459f598d0a02b3a33aab9d995f0378e476 Merge: 2c629dd2d14fd 0c0af88f3f318 Author: Arnd Bergmann Date: Fri Jun 24 17:19:21 2022 +0200 Merge tag 'ti-k3-dt-fixes-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/fixes Devicetree fixes for TI K3 platforms for v5.19 Critical fixes for the following: * Boot failure on J721s2 (overlap GIC memory map) * AM64 boot fails on highspeed cards (SoC characterization updates) * tag 'ti-k3-dt-fixes-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode arm64: dts: ti: k3-j721s2: Fix overlapping GICD memory region Link: https://lore.kernel.org/r/20220618031627.xxvscc22c6doaa3t@kahuna Signed-off-by: Arnd Bergmann commit 2c629dd2d14fd7f64a553f809eda6d0b3a4f615a Author: Liang He Date: Thu Jun 16 17:30:27 2022 +0800 arm: mach-spear: Add missing of_node_put() in time.c In spear_setup_of_timer(), of_find_matching_node() will return a node pointer with refcount incrementd. We should use of_node_put() in each fail path or when it is not used anymore. Signed-off-by: Liang He Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20220616093027.3984903-1-windhl@126.com' Signed-off-by: Arnd Bergmann commit 1ba904b6b16e08de5aed7c1349838d9cd0d178c5 Author: Miaoqian Lin Date: Sun Jun 5 11:58:41 2022 +0400 ARM: cns3xxx: Fix refcount leak in cns3xxx_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 415f59142d9d ("ARM: cns3xxx: initial DT support") Signed-off-by: Miaoqian Lin Acked-by: Krzysztof Halasa Signed-off-by: Arnd Bergmann commit 17b1362d49191625440ca2c195959ce0b37ec296 Author: Thara Gopinath Date: Fri Jan 7 09:51:54 2022 -0500 MAINTAINERS: Update email address Update my email address in the MAINTAINERS file as the current one will stop functioning in a while. Signed-off-by: Thara Gopinath Reviewed-by: Bjorn Andersson Signed-off-by: Arnd Bergmann commit 8da33fd11c05b7c64ef6456970f2fce61851806e Author: Shyam Prasad N Date: Fri Jun 24 09:43:59 2022 +0000 cifs: avoid deadlocks while updating iface We use cifs_tcp_ses_lock to protect a lot of things. Not only does it protect the lists of connections, sessions, tree connects, open file lists, etc., we also use it to protect some fields in each of it's entries. In this case, cifs_mark_ses_for_reconnect takes the cifs_tcp_ses_lock to traverse the lists, and then calls cifs_update_iface. However, that can end up calling cifs_put_tcp_session, which picks up the same lock again. Avoid this by taking a ref for the session, drop the lock, and then call update iface. Also, in cifs_update_iface, avoid nested locking of iface_lock and chan_lock, as much as possible. When unavoidable, we need to pick iface_lock first. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit c242507c1b895646b4a25060df13b6214805759f Author: Joerg Roedel Date: Fri Jun 24 14:51:39 2022 +0200 MAINTAINERS: Add new IOMMU development mailing list The IOMMU mailing list will move from lists.linux-foundation.org to lists.linux.dev. The hard switch of the archive will happen on July 5th, but add the new list now already so that people start using the list when sending patches. After July 5th the old list will disappear. Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel Link: https://lore.kernel.org/r/20220624125139.412-1-joro@8bytes.org Signed-off-by: Joerg Roedel commit b24346a240b36cfc4df194d145463874985aa29b Author: Xu Yang Date: Thu Jun 23 11:02:42 2022 +0800 usb: chipidea: udc: check request status before setting device address The complete() function may be called even though request is not completed. In this case, it's necessary to check request status so as not to set device address wrongly. Fixes: 10775eb17bee ("usb: chipidea: udc: update gadget states according to ch9") cc: Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20220623030242.41796-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 90bc2af24638659da56397ff835f3c95a948f991 Author: Alan Stern Date: Wed Jun 22 10:46:31 2022 -0400 USB: gadget: Fix double-free bug in raw_gadget driver Re-reading a recently merged fix to the raw_gadget driver showed that it inadvertently introduced a double-free bug in a failure pathway. If raw_ioctl_init() encounters an error after the driver ID number has been allocated, it deallocates the ID number before returning. But when dev_free() runs later on, it will then try to deallocate the ID number a second time. Closely related to this issue is another error in the recent fix: The ID number is stored in the raw_dev structure before the code checks to see whether the structure has already been initialized, in which case the new ID number would overwrite the earlier value. The solution to both bugs is to keep the new ID number in a local variable, and store it in the raw_dev structure only after the check for prior initialization. No errors can occur after that point, so the double-free will never happen. Fixes: f2d8c2606825 ("usb: gadget: Fix non-unique driver names in raw-gadget driver") CC: Andrey Konovalov CC: Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YrMrRw5AyIZghN0v@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit ae8b1631561a3634cc09d0c62bbdd938eade05ec Author: Takashi Iwai Date: Fri Jun 24 12:11:32 2022 +0200 ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD Both Behringer UMC 202 HD and 404 HD need explicit quirks to enable the implicit feedback mode and start the playback stream primarily. The former seems fixing the stuttering and the latter is required for a playback-only case. Note that the "clock source 41 is not valid" error message still appears even after this fix, but it should be only once at probe. The reason of the error is still unknown, but this seems to be mostly harmless as it's a one-off error and the driver retires the clock setup and it succeeds afterwards. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215934 Cc: Link: https://lore.kernel.org/r/20220624101132.14528-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 87d044096ea62f1f230e8c4679ee8abf03266f64 Author: Tom Lendacky Date: Mon Jun 13 14:16:27 2022 -0500 crypto: ccp - Fix device IRQ counting by using platform_irq_count() The ccp driver loops through the platform device resources array to get the IRQ count for the device. With commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core"), the IRQ resources are no longer stored in the platform device resource array. As a result, the IRQ count is now always zero. This causes the driver to issue a second call to platform_get_irq(), which fails if the IRQ count is really 1, causing the loading of the driver to fail. Replace looping through the resources array to count the number of IRQs with a call to platform_irq_count(). Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") Signed-off-by: Tom Lendacky Reviewed-by: Rob Herring Signed-off-by: Herbert Xu commit 6defa24d3b12bbd418bc8526dea1cbc605265c06 Author: Peter Gonda Date: Thu Jun 23 10:34:06 2022 -0700 KVM: SEV: Init target VMCBs in sev_migrate_from The target VMCBs during an intra-host migration need to correctly setup for running SEV and SEV-ES guests. Add sev_init_vmcb() function and make sev_es_init_vmcb() static. sev_init_vmcb() uses the now private function to init SEV-ES guests VMCBs when needed. Fixes: 0b020f5af092 ("KVM: SEV: Add support for SEV-ES intra host migration") Fixes: b56639318bb2 ("KVM: SEV: Add support for SEV intra host migration") Signed-off-by: Peter Gonda Cc: Marc Orr Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Tom Lendacky Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Message-Id: <20220623173406.744645-1-pgonda@google.com> Signed-off-by: Paolo Bonzini commit ebdec859faa8cfbfef9f6c1f83d79dd6c8f4ab8c Author: Mingwei Zhang Date: Thu Jun 23 17:18:58 2022 +0000 KVM: x86/svm: add __GFP_ACCOUNT to __sev_dbg_{en,de}crypt_user() Adding the accounting flag when allocating pages within the SEV function, since these memory pages should belong to individual VM. No functional change intended. Signed-off-by: Mingwei Zhang Message-Id: <20220623171858.2083637-1-mizhang@google.com> Signed-off-by: Paolo Bonzini commit c346dae4f3fbce51bbd4f2ec5e8c6f9b91e93163 Author: Jason Wang Date: Wed Jun 22 09:29:40 2022 +0800 virtio: disable notification hardening by default We try to harden virtio device notifications in 8b4ec69d7e09 ("virtio: harden vring IRQ"). It works with the assumption that the driver or core can properly call virtio_device_ready() at the right place. Unfortunately, this seems to be not true and uncover various bugs of the existing drivers, mainly the issue of using virtio_device_ready() incorrectly. So let's add a Kconfig option and disable it by default. It gives us time to fix the drivers and then we can consider re-enabling it. Signed-off-by: Jason Wang Message-Id: <20220622012940.21441-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Cornelia Huck commit 03d9571706942fa653a4975709820596d13563c7 Author: Bo Liu Date: Fri Jun 17 01:59:52 2022 -0400 virtio: Remove unnecessary variable assignments In function vp_modern_probe(), "pci_dev" is initialized with the value of "mdev->pci_dev", so assigning "pci_dev" to "mdev->pci_dev" is unnecessary since they store the same value. Signed-off-by: Bo Liu Message-Id: <20220617055952.5364-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit a7722890fdfb2aaeb6b02d68bb0f1e411e58d539 Author: huangjie.albert Date: Fri Jun 17 10:04:11 2022 +0800 virtio_ring : keep used_wrap_counter in vq->last_used_idx the used_wrap_counter and the vq->last_used_idx may get out of sync if they are separate assignment，and interrupt might use an incorrect value to check for the used index. for example:OOB access ksoftirqd may consume the packet and it will call: virtnet_poll -->virtnet_receive -->virtqueue_get_buf_ctx -->virtqueue_get_buf_ctx_packed and in virtqueue_get_buf_ctx_packed: vq->last_used_idx += vq->packed.desc_state[id].num; if (unlikely(vq->last_used_idx >= vq->packed.vring.num)) { vq->last_used_idx -= vq->packed.vring.num; vq->packed.used_wrap_counter ^= 1; } if at the same time, there comes a vring interrupt，in vring_interrupt: we will call: vring_interrupt -->more_used -->more_used_packed -->is_used_desc_packed in is_used_desc_packed, the last_used_idx maybe >= vq->packed.vring.num. so this could case a memory out of bounds bug. this patch is to keep the used_wrap_counter in vq->last_used_idx so we can get the correct value to check for used index in interrupt. v3->v4: - use READ_ONCE/WRITE_ONCE to get/set vq->last_used_idx v2->v3: - add inline function to get used_wrap_counter and last_used - when use vq->last_used_idx, only read once if vq->last_used_idx is read twice, the values can be inconsistent. - use last_used_idx & ~(-(1 << VRING_PACKED_EVENT_F_WRAP_CTR)) to get the all bits below VRING_PACKED_EVENT_F_WRAP_CTR v1->v2: - reuse the VRING_PACKED_EVENT_F_WRAP_CTR - Remove parameter judgment in is_used_desc_packed, because it can't be illegal Signed-off-by: huangjie.albert Message-Id: <20220617020411.80367-1-huangjie.albert@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 0e0348ac3f0a6e6606f1aa5acb1803ada913aa3d Author: Parav Pandit Date: Mon Jun 13 22:52:23 2022 +0300 vduse: Tie vduse mgmtdev and its device vduse devices are not backed by any real devices such as PCI. Hence it doesn't have any parent device linked to it. Kernel driver model in [1] suggests to avoid an empty device release callback. Hence tie the mgmtdevice object's life cycle to an allocate dummy struct device instead of static one. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/core-api/kobject.rst?h=v5.18-rc7#n284 Signed-off-by: Parav Pandit Message-Id: <20220613195223.473966-1-parav@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xie Yongji Acked-by: Jason Wang commit ace9252446ec615cd79a5f77d90edb25c0b9d024 Author: Eli Cohen Date: Mon Jun 13 10:59:58 2022 +0300 vdpa/mlx5: Initialize CVQ vringh only once Currently, CVQ vringh is initialized inside setup_virtqueues() which is called every time a memory update is done. This is undesirable since it resets all the context of the vring, including the available and used indices. Move the initialization to mlx5_vdpa_set_status() when VIRTIO_CONFIG_S_DRIVER_OK is set. Signed-off-by: Eli Cohen Message-Id: <20220613075958.511064-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Eugenio Pérez commit 40f2f3e94178d45e4ee6078effba2dfc76f6f5ba Author: Eli Cohen Date: Mon Jun 13 10:59:57 2022 +0300 vdpa/mlx5: Update Control VQ callback information The control VQ specific information is stored in the dedicated struct mlx5_control_vq. When the callback is updated through mlx5_vdpa_set_vq_cb(), make sure to update the control VQ struct. Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") Signed-off-by: Eli Cohen Message-Id: <20220613075958.511064-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Date: Sun Jun 19 22:37:17 2022 +0900 ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA FileOffset should not be greater than BeyondFinalZero in FSCTL_ZERO_DATA. And don't call ksmbd_vfs_zero_data() if length is zero. Cc: stable@vger.kernel.org Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 18e39fb960e6a908ac5230b57e3d0d6c25232368 Author: Namjae Jeon Date: Sun Jun 19 22:35:48 2022 +0900 ksmbd: set the range of bytes to zero without extending file size in FSCTL_ZERO_DATA generic/091, 263 test failed since commit f66f8b94e7f2 ("cifs: when extending a file with falloc we should make files not-sparse"). FSCTL_ZERO_DATA sets the range of bytes to zero without extending file size. The VFS_FALLOCATE_FL_KEEP_SIZE flag should be used even on non-sparse files. Cc: stable@vger.kernel.org Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 745bbc0995c25917dfafb645b8efb29813ef9e0b Author: Hyunchul Lee Date: Tue Jun 14 08:25:50 2022 +0900 ksmbd: remove duplicate flag set in smb2_write The writethrough flag is set again if is_rdma_channel is false. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit b968080808f7f28b89aa495b7402ba48eb17ee93 Author: Dimitris Michailidis Date: Wed Jun 22 17:02:34 2022 -0700 selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test udpgso_bench.sh has been running its IPv6 TCP test with IPv4 arguments since its initial conmit. Looks like a typo. Fixes: 3a687bef148d ("selftests: udp gso benchmark") Cc: willemb@google.com Signed-off-by: Dimitris Michailidis Acked-by: Willem de Bruijn Link: https://lore.kernel.org/r/20220623000234.61774-1-dmichail@fungible.com Signed-off-by: Jakub Kicinski commit 1228b34c8d0ecf6de18c4c95d22f60cc8607c50a Author: Eric Dumazet Date: Wed Jun 22 15:02:20 2022 +0000 net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user() syzbot reported uninit-value in tcp_recvmsg() [1] Issue here is that msg->msg_get_inq should have been cleared, otherwise tcp_recvmsg() might read garbage and perform more work than needed, or have undefined behavior. Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be the default soon, I chose to change __sys_recvfrom() to clear all fields but msghdr.addr which might be not NULL. For __copy_msghdr_from_user(), I added an explicit clear of kmsg->msg_get_inq. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557 tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557 inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850 sock_recvmsg_nosec net/socket.c:995 [inline] sock_recvmsg net/socket.c:1013 [inline] __sys_recvfrom+0x696/0x900 net/socket.c:2176 __do_sys_recvfrom net/socket.c:2194 [inline] __se_sys_recvfrom net/socket.c:2190 [inline] __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Local variable msg created at: __sys_recvfrom+0x81/0x900 net/socket.c:2154 __do_sys_recvfrom net/socket.c:2194 [inline] __se_sys_recvfrom net/socket.c:2190 [inline] __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190 CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Jens Axboe Tested-by: Alexander Potapenko Link: https://lore.kernel.org/r/20220622150220.1091182-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ad887a507d7386de09a532c5d303ed659eba2cfb Author: Krzysztof Kozlowski Date: Wed Jun 22 13:54:16 2022 +0200 net/ncsi: use proper "mellanox" DT vendor prefix "mlx" Devicetree vendor prefix is not documented and instead "mellanox" should be used. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220622115416.7400-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 6886da5f49e6d86aad76807a93f3eef5e4f01b10 Author: Liam Howlett Date: Fri Jun 24 01:17:58 2022 +0000 powerpc/prom_init: Fix kernel config grep When searching for config options, use the KCONFIG_CONFIG shell variable so that builds using non-standard config locations work. Fixes: 26deb04342e3 ("powerpc: prepare string/mem functions for KASAN") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Liam R. Howlett Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220624011745.4060795-1-Liam.Howlett@oracle.com commit 7c97bc0128b2eecc703106112679a69d446d1a12 Author: Doug Berger Date: Wed Jun 22 20:02:04 2022 -0700 net: dsa: bcm_sf2: force pause link settings The pause settings reported by the PHY should also be applied to the GMII port status override otherwise the switch will not generate pause frames towards the link partner despite the advertisement saying otherwise. Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver") Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220623030204.1966851-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit 16d584d2fc8f4ea36203af45a76becd7093586f1 Author: Liang He Date: Wed Jun 22 12:06:21 2022 +0800 net/dsa/hirschmann: Add missing of_node_get() in hellcreek_led_setup() of_find_node_by_name() will decrease the refcount of its first arg and we need a of_node_get() to keep refcount balance. Fixes: 7d9ee2e8ff15 ("net: dsa: hellcreek: Add PTP status LEDs") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220622040621.4094304-1-windhl@126.com Signed-off-by: Jakub Kicinski commit 986481618023e18e187646b0fff05a3c337531cb Author: Christophe Leroy Date: Thu Jun 23 10:56:17 2022 +0200 powerpc/book3e: Fix PUD allocation size in map_kernel_page() Commit 2fb4706057bc ("powerpc: add support for folded p4d page tables") erroneously changed PUD setup to a mix of PMD and PUD. Fix it. While at it, use PTE_TABLE_SIZE instead of PAGE_SIZE for PTE tables in order to avoid any confusion. Fixes: 2fb4706057bc ("powerpc: add support for folded p4d page tables") Cc: stable@vger.kernel.org # v5.8+ Signed-off-by: Christophe Leroy Acked-by: Mike Rapoport Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/95ddfd6176d53e6c85e13bd1c358359daa56775f.1655974558.git.christophe.leroy@csgroup.eu commit 19fc5bb93c6bbdce8292b4d7eed04e2fa118d2fe Author: Nathan Lynch Date: Thu Jun 23 13:25:09 2022 -0500 powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm->bitmap allocation: BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28 Call Trace: [c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable) [c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710 [c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354 [c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0 [c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140 [c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260 [c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450 [c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118 [c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac [c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640 [c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0 [c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64 Allocated by task 0: kasan_save_stack+0x34/0x70 __kasan_kmalloc+0xb4/0xf0 __kmalloc+0x268/0x540 xive_spapr_init+0x4d0/0x77c pseries_init_irq+0x40/0x27c init_IRQ+0x44/0x84 start_kernel+0x2a4/0x538 start_here_common+0x1c/0x20 The buggy address belongs to the object at c00000001d1d0118 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [c00000001d1d0118, c00000001d1d0120) The buggy address belongs to the physical page: page:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff) raw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480 raw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc ^ c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc This happens because the allocation uses the wrong unit (bits) when it should pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small numbers of bits, the allocated object can be smaller than sizeof(long), which results in invalid accesses. Use bitmap_zalloc() to allocate and initialize the irq bitmap, paired with bitmap_free() for consistency. Signed-off-by: Nathan Lynch Reviewed-by: Cédric Le Goater Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220623182509.3985625-1-nathanl@linux.ibm.com commit f50974eee5c4a5de1e4f1a3d873099f170df25f8 Author: Dan Williams Date: Thu Jun 23 13:02:31 2022 -0700 memregion: Fix memregion_free() fallback definition In the CONFIG_MEMREGION=n case, memregion_free() is meant to be a static inline. 0day reports: In file included from drivers/cxl/core/port.c:4: include/linux/memregion.h:19:6: warning: no previous prototype for function 'memregion_free' [-Wmissing-prototypes] Mark memregion_free() static. Fixes: 33dd70752cd7 ("lib: Uplevel the pmem "region" ida to a global allocator") Reported-by: kernel test robot Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/165601455171.4042645.3350844271068713515.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 1e9124df8be0a43e4e9a10c5d1140d6ca8e50132 Merge: 08d27daaaa9e2 a6e2af64a79af Author: Dave Airlie Date: Fri Jun 24 10:11:26 2022 +1000 Merge tag 'drm-msm-fixes-2022-06-20' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v5.19-rc4 - Workaround for parade DSI bridge power sequencing - Fix for multi-planar YUV format offsets - Limiting WB modes to max sspp linewidth - Fixing the supported rotations to add 180 back for IGT - Fix to handle pm_runtime_get_sync() errors to avoid unclocked access in the bind() path for dpu driver - Fix the irq_free() without request issue which was a being hit frequently in CI. - Fix to add minimum ICC vote in the msm_mdss pm_resume path to address bootup splats - Fix to avoid dereferencing without checking in WB encoder - Fix to avoid crash during suspend in DP driver by ensuring interrupt mask bits are updated - Remove unused code from dpu_encoder_virt_atomic_check() - Fix to remove redundant init of dsc variable - Fix to ensure mmap offset is initialized to avoid memory corruption from unpin/evict - Fix double runpm disable in probe-defer path - VMA fenced-unpin fixes - Fix for WB max-width - Fix for rare dp resolution change issue Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvdsOF1-+WfTWyEyu33XPcvxOCU00G-dz7EF2J+fdyUHg@mail.gmail.com commit 08d27daaaa9e215ce9c78a35a94fc4fa7a434d3a Merge: 0a86b0db38d84 c7b28f52f406b Author: Dave Airlie Date: Fri Jun 24 09:58:06 2022 +1000 Merge tag 'drm-intel-fixes-2022-06-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.19-rc4: - Revert low voltage SKU check removal to fix display issues - Apply PLL DCO fraction workaround for ADL-S - Don't show engine classes not present in client fdinfo Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87a6a4syrr.fsf@intel.com commit 0a86b0db38d848e5e3928707cca55ed664a53eb4 Merge: 382cf35f2508d 85016f66af850 Author: Dave Airlie Date: Fri Jun 24 09:45:41 2022 +1000 Merge tag 'drm-misc-fixes-2022-06-23' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Multiple fixes in sun4i for suspend, DDC, DMA setup; A rework of vc4 to properly split the driver between hardware capabilities that wasn't done properly causing multiple crashes; and a panel quirk for Aya Neo Next Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220623064152.ubjmnpj7tdejdcw6@houat commit 382cf35f2508ddf444f4d5af33c5860620add29a Merge: a111daf0c53ae e84131a88a8cd Author: Dave Airlie Date: Fri Jun 24 09:36:30 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-06-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-06-22: amdgpu: - Adjust GTT size logic - eDP fix for RMB - DCN 3.15 fix - DP training fix - Color encoding fix for DCN2+ Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220622214106.5984-1-alexander.deucher@amd.com commit b0d473185ba887c798ed0cd6f5abf4075363baa4 Author: Stefan Wahren Date: Fri Jun 17 12:38:09 2022 +0200 gpio: mxs: Fix header comment This driver is about MXS GPIO support. MXC is a different platform. Signed-off-by: Stefan Wahren Signed-off-by: Bartosz Golaszewski commit 5e672cd69f0a534a445df4372141fd0d1d00901d Author: Dave Chinner Date: Thu Jun 16 07:44:32 2022 -0700 xfs: introduce xfs_inodegc_push() The current blocking mechanism for pushing the inodegc queue out to disk can result in systems becoming unusable when there is a long running inodegc operation. This is because the statfs() implementation currently issues a blocking flush of the inodegc queue and a significant number of common system utilities will call statfs() to discover something about the underlying filesystem. This can result in userspace operations getting stuck on inodegc progress, and when trying to remove a heavily reflinked file on slow storage with a full journal, this can result in delays measuring in hours. Avoid this problem by adding "push" function that expedites the flushing of the inodegc queue, but doesn't wait for it to complete. Convert xfs_fs_statfs() and xfs_qm_scall_getquota() to use this mechanism so they don't block but still ensure that queued operations are expedited. Fixes: ab23a7768739 ("xfs: per-cpu deferred inode inactivation queues") Reported-by: Chris Dunlop Signed-off-by: Dave Chinner [djwong: fix _getquota_next to use _inodegc_push too] Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 7cf2b0f9611b9971d663e1fc3206eeda3b902922 Author: Dave Chinner Date: Thu Jun 16 07:44:31 2022 -0700 xfs: bound maximum wait time for inodegc work Currently inodegc work can sit queued on the per-cpu queue until the workqueue is either flushed of the queue reaches a depth that triggers work queuing (and later throttling). This means that we could queue work that waits for a long time for some other event to trigger flushing. Hence instead of just queueing work at a specific depth, use a delayed work that queues the work at a bound time. We can still schedule the work immediately at a given depth, but we no long need to worry about leaving a number of items on the list that won't get processed until external events prevail. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit c7e1c443584ddd7facffca00e9e23b0d084e5bb3 Author: Akira Yokosawa Date: Mon Jun 6 13:44:24 2022 +0900 gpio: Fix kernel-doc comments to nested union Commit 48ec13d36d3f ("gpio: Properly document parent data union") is supposed to have fixed a warning from "make htmldocs" regarding kernel-doc comments to union members. However, the same warning still remains [1]. Fix the issue by following the example found in section "Nested structs/unions" of Documentation/doc-guide/kernel-doc.rst. Signed-off-by: Akira Yokosawa Reported-by: Stephen Rothwell Fixes: 48ec13d36d3f ("gpio: Properly document parent data union") Link: https://lore.kernel.org/r/20220606093302.21febee3@canb.auug.org.au/ [1] Cc: Linus Walleij Cc: Bartosz Golaszewski Cc: Joey Gouly Cc: Marc Zyngier Tested-by: Stephen Rothwell Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Bartosz Golaszewski commit b376471fb47d4905e72fe73e9eeed228f8f2f230 Author: Jinzhou Su Date: Thu Jun 23 11:15:09 2022 +0800 cpufreq: amd-pstate: Add resume and suspend callbacks When system resumes from S3, the CPPC enable register will be cleared and reset to 0. So enable the CPPC interface by writing 1 to this register on system resume and disable it during system suspend. Signed-off-by: Jinzhou Su Signed-off-by: Jinzhou Su Acked-by: Huang Rui [ rjw: Subject and changelog edits ] Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 92f20ff72066d8d7e2ffb655c2236259ac9d1c5d Merge: ba461afbef604 202773260023b Author: Linus Torvalds Date: Thu Jun 23 14:17:15 2022 -0500 Merge tag 'pm-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a recent regression preventing some systems from powering off after saving a hibernation image (Dmitry Osipenko)" * tag 'pm-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: Use kernel_can_power_off() commit ba461afbef604f58e05676ca38c2a599f073f296 Merge: fa1796a835fc2 63b8ea5e4f1a8 Author: Linus Torvalds Date: Thu Jun 23 14:00:49 2022 -0500 Merge tag 'random-5.19-rc4-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - A change to schedule the interrupt randomness mixing less often, yet credit a little more each time, to reduce overhead during interrupt storms. - Squelch an undesired pr_warn() from __ratelimit(), which was causing problems in the reporters' CI. - A trivial comment fix. * tag 'random-5.19-rc4-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: update comment from copy_to_user() -> copy_to_iter() random: quiet urandom warning ratelimit suppression message random: schedule mix_interrupt_randomness() less often commit 90736eb3232d208ee048493f371075e4272e0944 Author: Mikulas Patocka Date: Thu Jun 23 14:53:25 2022 -0400 dm mirror log: clear log bits up to BITS_PER_LONG boundary Commit 85e123c27d5c ("dm mirror log: round up region bitmap size to BITS_PER_LONG") introduced a regression on 64-bit architectures in the lvm testsuite tests: lvcreate-mirror, mirror-names and vgsplit-operation. If the device is shrunk, we need to clear log bits beyond the end of the device. The code clears bits up to a 32-bit boundary and then calculates lc->sync_count by summing set bits up to a 64-bit boundary (the commit changed that; previously, this boundary was 32-bit too). So, it was using some non-zeroed bits in the calculation and this caused misbehavior. Fix this regression by clearing bits up to BITS_PER_LONG boundary. Fixes: 85e123c27d5c ("dm mirror log: round up region bitmap size to BITS_PER_LONG") Cc: stable@vger.kernel.org Reported-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 61b6e2e5321da281ab3c0c04e1962b3d000f6248 Author: Ming Lei Date: Thu Jun 23 21:20:05 2022 +0800 dm: fix BLK_STS_DM_REQUEUE handling when dm_io represents split bio Commit 7dd76d1feec7 ("dm: improve bio splitting and associated IO accounting") removed using cloned bio when dm io splitting is needed. Using bio_trim()+bio_inc_remaining() rather than bio_split()+bio_chain() causes multiple dm_io instances to share the same original bio, and it works fine if IOs are completed successfully. But a regression was caused for the case when BLK_STS_DM_REQUEUE is returned from any one of DM's cloned bios (whose dm_io share the same orig_bio). In this BLK_STS_DM_REQUEUE case only the mapped subset of the original bio for the current exact dm_io needs to be re-submitted. However, since the original bio is shared among all dm_io instances, the ->orig_bio actually only represents the last dm_io instance, so requeue can't work as expected. Also when more than one dm_io is requeued, the same original bio is requeued from all dm_io's completion handler, then race is caused. Fix this issue by still allocating one clone bio for completing io only, then io accounting can rely on ->orig_bio being unmodified. This is needed because the dm_io's sector_offset and sectors members are recorded relative to an unmodified ->orig_bio. In the future, we can go back to using bio_trim()+bio_inc_remaining() for dm's io splitting but then delay needing a bio clone only when handling BLK_STS_DM_REQUEUE, but that approach is a bit complicated (so it needs a development cycle): 1) bio clone needs to be done in task context 2) a block interface for unwinding bio is required Fixes: 7dd76d1feec7 ("dm: improve bio splitting and associated IO accounting") Reported-by: Benjamin Marzinski Signed-off-by: Ming Lei Signed-off-by: Mike Snitzer commit eb174bd875ae504cdc1b5b209da288fffb1e5128 Author: sunliming Date: Thu Jun 23 09:27:07 2022 +0800 drm/msm/dpu: Fix variable dereferenced before check Fixes the following smatch warning: drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:261 dpu_encoder_phys_wb_atomic_check() warn: variable dereferenced before check 'conn_state' Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") Signed-off-by: sunliming Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/490850/ Link: https://lore.kernel.org/r/20220623012707.453972-1-sunliming@kylinos.cn Signed-off-by: Abhinav Kumar commit 0769d0a7ae3c26c0f2210578f83b3d1b30391601 Author: Kuogee Hsieh Date: Wed Jun 22 12:55:31 2022 -0700 drm/msm/dp: reset drm_dev to NULL at dp_display_unbind() During msm initialize phase, dp_display_unbind() will be called to undo initializations had been done by dp_display_bind() previously if there is error happen at msm_drm_bind. Under this kind of circumstance, drm_device may not be populated completed which causes system crash at drm_dev_dbg(). This patch reset drm_dev to NULL so that following drm_dev_dbg() will not refer to any internal fields of drm_device to prevent system from crashing. Below are panic stack trace, [ 53.584904] Unable to handle kernel paging request at virtual address 0000000070018001 . [ 53.702212] Hardware name: Qualcomm Technologies, Inc. sc7280 CRD platform (rev5+) (DT) [ 53.710445] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 53.717596] pc : string_nocheck+0x1c/0x64 [ 53.721738] lr : string+0x54/0x60 [ 53.725162] sp : ffffffc013d6b650 [ 53.728590] pmr_save: 000000e0 [ 53.731743] x29: ffffffc013d6b650 x28: 0000000000000002 x27: 0000000000ffffff [ 53.739083] x26: ffffffc013d6b710 x25: ffffffd07a066ae0 x24: ffffffd07a419f97 [ 53.746420] x23: ffffffd07a419f99 x22: ffffff81fef360d4 x21: ffffff81fef364d4 [ 53.753760] x20: ffffffc013d6b6f8 x19: ffffffd07a06683c x18: 0000000000000000 [ 53.761093] x17: 4020386678302f30 x16: 00000000000000b0 x15: ffffffd0797523c8 [ 53.768429] x14: 0000000000000004 x13: ffff0000ffffff00 x12: ffffffd07a066b2c [ 53.775780] x11: 0000000000000000 x10: 000000000000013c x9 : 0000000000000000 [ 53.783117] x8 : ffffff81fef364d4 x7 : 0000000000000000 x6 : 0000000000000000 [ 53.790445] x5 : 0000000000000000 x4 : ffff0a00ffffff04 x3 : ffff0a00ffffff04 [ 53.797783] x2 : 0000000070018001 x1 : ffffffffffffffff x0 : ffffff81fef360d4 [ 53.805136] Call trace: [ 53.807667] string_nocheck+0x1c/0x64 [ 53.811439] string+0x54/0x60 [ 53.814498] vsnprintf+0x374/0x53c [ 53.818009] pointer+0x3dc/0x40c [ 53.821340] vsnprintf+0x398/0x53c [ 53.824854] vscnprintf+0x3c/0x88 [ 53.828274] __trace_array_vprintk+0xcc/0x2d4 [ 53.832768] trace_array_printk+0x8c/0xb4 [ 53.836900] drm_trace_printf+0x74/0x9c [ 53.840875] drm_dev_dbg+0xfc/0x1b8 [ 53.844480] dp_pm_suspend+0x70/0xf8 [ 53.848164] dpm_run_callback+0x60/0x1a0 [ 53.852222] __device_suspend+0x304/0x3f4 [ 53.856363] dpm_suspend+0xf8/0x3a8 [ 53.859959] dpm_suspend_start+0x8c/0xc0 Fixes: 570d3e5d28db ("drm/msm/dp: stop event kernel thread when DP unbind") Signed-off-by: Kuogee Hsieh Reviewed-by: Dmitry Baryshkov Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/490756/ Link: https://lore.kernel.org/r/1655927731-22396-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Abhinav Kumar commit c28d76d360f9f7af1f910342bde27939873bc45e Author: Stephen Boyd Date: Tue Jun 21 19:38:55 2022 -0700 drm/msm/dpu: Increment vsync_cnt before waking up userspace The 'vsync_cnt' is used to count the number of frames for a crtc. Unfortunately, we increment the count after waking up userspace via dpu_crtc_vblank_callback() calling drm_crtc_handle_vblank(). drm_crtc_handle_vblank() wakes up userspace processes that have called drm_wait_vblank_ioctl(), and if that ioctl is expecting the count to increase it won't. Increment the count before calling into the drm APIs so that we don't have to worry about ordering the increment with anything else in drm. This fixes a software video decode test that fails to see frame counts increase on Trogdor boards. Cc: Mark Yacoub Cc: Jessica Zhang Fixes: 885455d6bf82 ("drm/msm: Change dpu_crtc_get_vblank_counter to use vsync count.") Signed-off-by: Stephen Boyd Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Tested-by: Jessica Zhang # Trogdor (sc7180) Patchwork: https://patchwork.freedesktop.org/patch/490531/ Link: https://lore.kernel.org/r/20220622023855.2970913-1-swboyd@chromium.org Signed-off-by: Abhinav Kumar commit fa1796a835fc24eb8fb5d794512ec299dcd9f3fd Merge: 16e4bce6de64c 12c3e0c92fd7c Author: Linus Torvalds Date: Thu Jun 23 12:24:49 2022 -0500 Merge tag 'trace-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: - Check for NULL in kretprobe_dispatcher() NULL can now be passed in, make sure it can handle it - Clean up unneeded #endif #ifdef of the same preprocessor check in the middle of the block. - Comment clean up - Remove unneeded initialization of the "ret" variable in __trace_uprobe_create() * tag 'trace-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/uprobes: Remove unwanted initialization in __trace_uprobe_create() tracefs: Fix syntax errors in comments tracing: Simplify conditional compilation code in tracing_set_tracer() tracing/kprobes: Check whether get_kretprobe() returns NULL in kretprobe_dispatcher() commit 16e4bce6de64c8f6a0f2f221154ffa8c5fe9cdd0 Merge: 599d16912d074 00fa15e0d5648 Author: Linus Torvalds Date: Thu Jun 23 12:16:14 2022 -0500 Merge tag 'folio-5.19b' of git://git.infradead.org/users/willy/pagecache Pull pagecache fixes from Matthew Wilcox: "Four folio-related fixes for 5.19: - Mark a folio accessed at the right time (Yu Kuai) - Fix a race for folios being replaced in the middle of a read (Brian Foster) - Clear folio->private in more places (Xiubo Li) - Take the invalidate_lock in page_cache_ra_order() (Alistair Popple)" * tag 'folio-5.19b' of git://git.infradead.org/users/willy/pagecache: filemap: Fix serialization adding transparent huge pages to page cache mm: Clear page->private when splitting or migrating a page filemap: Handle sibling entries in filemap_get_read_batch() filemap: Correct the conditions for marking a folio as accessed commit 51889d225ce2ce118d8413eb4282045add81a689 Merge: 93d17c1c8c1cc 07a22b61946f0 Author: Petr Mladek Date: Thu Jun 23 19:11:28 2022 +0200 Merge branch 'rework/kthreads' into for-linus commit 599d16912d0746aa67ec645ca6c121efa7bfd377 Merge: 399bd66e219e3 3748d2185ac4c Author: Linus Torvalds Date: Thu Jun 23 12:11:26 2022 -0500 Merge tag 'mips-fixes_5.19_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - several refcount fixes - added missing clock for ingenic - fix wrong irq_err_count for vr41xx * tag 'mips-fixes_5.19_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: lantiq: Add missing of_node_put() in irq.c mips: dts: ingenic: Add TCU clock to x1000/x1830 tcu device node mips/pic32/pic32mzda: Fix refcount leak bugs mips: lantiq: xway: Fix refcount leak bug in sysctrl mips: lantiq: falcon: Fix refcount leak bug in sysctrl mips: ralink: Fix refcount leak in of.c mips: mti-malta: Fix refcount leak in malta-time.c arch: mips: generic: Add missing of_node_put() in board-ranchu.c MIPS: Remove repetitive increase irq_err_count commit 386e4fb6962b9f248a80f8870aea0870ca603e89 Author: Jens Axboe Date: Thu Jun 23 11:06:43 2022 -0600 io_uring: use original request task for inflight tracking In prior kernels, we did file assignment always at prep time. This meant that req->task == current. But after deferring that assignment and then pushing the inflight tracking back in, we've got the inflight tracking using current when it should in fact now be using req->task. Fixup that error introduced by adding the inflight tracking back after file assignments got modifed. Fixes: 9cae36a094e7 ("io_uring: reinstate the inflight tracking") Signed-off-by: Jens Axboe commit 6945b2141fc9429f30fd6df2bcdd657a7f309f2f Author: Paolo Bonzini Date: Thu Jun 23 07:15:17 2022 -0400 MAINTAINERS: Reorganize KVM/x86 maintainership For the last few years I have been the sole maintainer of KVM, albeit getting serious help from all the people who have reviewed hundreds of patches. The volume of KVM x86 alone has gotten to the point where one maintainer is not enough; especially if that maintainer is not doing it full time and if they want to keep up with the evolution of ARM64 and RISC-V at both the architecture and the hypervisor level. So, this patch is the first step in restoring double maintainership or even transitioning to the submaintainer model of other architectures. The changes here were mostly proposed by Sean offlist and they are twofold: - revisiting the set of KVM x86 reviewers. It's important to have an an accurate list of people that are actively reviewing patches ("R"), as well as people that are able to act on bug reports ("M"). Otherwise, voids to be filled are not easily visible. The proposal is to split KVM on Hyper-V, which is where Vitaly has been the main contributor for quite some time now; likewise for KVM paravirt support, which has been the main interest of Wanpeng and to which Vitaly has also contributed (e.g., for async page faults). Jim and Joerg have not been particularly active (though Joerg has worked on guest support for AMD SEV); knowing them a bit, I can't imagine they would object to their removal or even be surprised, but please speak up if you do. - promoting Sean to maintainer for KVM x86 host support. While for now this changes little, let's treat it as a harbinger for future changes. The plan is that I would keep the final integration testing for quite some time, and probably focus more on -rc work. This will give me more time to clean up my ad hoc setup and moving towards a more public CI, with Sean focusing instead on next-release patches, and the testing up to where kvm-unit-tests and selftests pass. In order to facilitate collaboration between Sean and myself, we'll also formalize a bit more the various branches of kvm.git. Nothing is going to change with respect to handling pull requests to Linus and from other architectures, as well as maintainance of the generic code (which I expect and hope to be more important as architectures try to share more code) and documentation. However, it's not a coincidence that my entry is now the last for x86, ready to be demoted to reviewer if/when the right time comes. Suggested-by: Sean Christopherson Co-developed-by: Sean Christopherson Cc: kvm@vger.kernel.org Cc: Sean Christopherson Cc: Vitaly Kuznetsov Cc: Wanpeng Li Cc: Jim Mattson Cc: Joerg Roedel Acked-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 07a22b61946f0b80065b0ddcc703b715f84355f5 Author: Petr Mladek Date: Thu Jun 23 16:51:57 2022 +0200 Revert "printk: add functions to prefer direct printing" This reverts commit 2bb2b7b57f81255c13f4395ea911d6bdc70c9fe2. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-7-pmladek@suse.com commit 5831788afb17b89c5b531fb60cbd798613ccbb63 Author: Petr Mladek Date: Thu Jun 23 16:51:56 2022 +0200 Revert "printk: add kthread console printers" This reverts commit 09c5ba0aa2fcfdadb17d045c3ee6f86d69270df7. This reverts commit b87f02307d3cfbda768520f0687c51ca77e14fc3. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-6-pmladek@suse.com commit 2d9ef940f89e0ab4fde7ba6f769d82f2a450c35a Author: Petr Mladek Date: Thu Jun 23 16:51:55 2022 +0200 Revert "printk: extend console_lock for per-console locking" This reverts commit 8e274732115f63c1d09136284431b3555bd5cc56. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-5-pmladek@suse.com commit 007eeab7e9f03a3108c300c03e11a6c151e430c9 Author: Petr Mladek Date: Thu Jun 23 16:51:54 2022 +0200 Revert "printk: remove @console_locked" This reverts commit ab406816fca009349b89cbde885daf68a8c77e33. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-4-pmladek@suse.com commit 05c96b3713aa2a406d0c4ef0505bf80a6748fedb Author: Petr Mladek Date: Thu Jun 23 16:51:53 2022 +0200 Revert "printk: Block console kthreads when direct printing will be required" This reverts commit c3230283e2819a69dad2cf7a63143fde8bab8b5c. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-3-pmladek@suse.com commit 20fb0c8272bbb102d15bdd11aa64f828619dd7cc Author: Petr Mladek Date: Thu Jun 23 16:51:52 2022 +0200 Revert "printk: Wait for the global console lock when the system is going down" This reverts commit b87f02307d3cfbda768520f0687c51ca77e14fc3. The testing of 5.19 release candidates revealed missing synchronization between early and regular console functionality. It would be possible to start the console kthreads later as a workaround. But it is clear that console lock serialized console drivers between each other. It opens a big area of possible problems that were not considered by people involved in the development and review. printk() is crucial for debugging kernel issues and console output is very important part of it. The number of consoles is huge and a proper review would take some time. As a result it need to be reverted for 5.19. Link: https://lore.kernel.org/r/YrBdjVwBOVgLfHyb@alley Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220623145157.21938-2-pmladek@suse.com commit 00fa15e0d56482e32d8ca1f51d76b0ee00afb16b Author: Alistair Popple Date: Mon Jun 20 19:05:36 2022 +1000 filemap: Fix serialization adding transparent huge pages to page cache Commit 793917d997df ("mm/readahead: Add large folio readahead") introduced support for using large folios for filebacked pages if the filesystem supports it. page_cache_ra_order() was introduced to allocate and add these large folios to the page cache. However adding pages to the page cache should be serialized against truncation and hole punching by taking invalidate_lock. Not doing so can lead to data races resulting in stale data getting added to the page cache and marked up-to-date. See commit 730633f0b7f9 ("mm: Protect operations adding pages to page cache with invalidate_lock") for more details. This issue was found by inspection but a testcase revealed it was possible to observe in practice on XFS. Fix this by taking invalidate_lock in page_cache_ra_order(), to mirror what is done for the non-thp case in page_cache_ra_unbounded(). Signed-off-by: Alistair Popple Fixes: 793917d997df ("mm/readahead: Add large folio readahead") Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit b653db77350c7307a513b81856fe53e94cf42446 Author: Matthew Wilcox (Oracle) Date: Sun Jun 19 10:37:32 2022 -0400 mm: Clear page->private when splitting or migrating a page In our efforts to remove uses of PG_private, we have found folios with the private flag clear and folio->private not-NULL. That is the root cause behind 642d51fb0775 ("ceph: check folio PG_private bit instead of folio->private"). It can also affect a few other filesystems that haven't yet reported a problem. compaction_alloc() can return a page with uninitialised page->private, and rather than checking all the callers of migrate_pages(), just zero page->private after calling get_new_page(). Similarly, the tail pages from split_huge_page() may also have an uninitialised page->private. Reported-by: Xiubo Li Tested-by: Xiubo Li Signed-off-by: Matthew Wilcox (Oracle) commit 21e876448792af2dd5261338907c72bdf37fa056 Author: Thomas Richter Date: Wed Jun 15 14:02:07 2022 +0200 s390/pai: Fix multiple concurrent event installation Two different events such as pai_crypto/KM_AES_128/ and pai_crypto/KM_AES_192/ can be installed multiple times on the same CPU and the events are executed concurrently: # perf stat -e pai_crypto/KM_AES_128/ -C0 -a -- sleep 5 & # sleep 2 # perf stat -e pai_crypto/KM_AES_192/ -C0 -a -- true This results in the first event being installed two times with two seconds delay. The kernel does install the second event after the first event has been deleted and re-added, as can be seen in the traces: 13:48:47.600350 paicrypt_start event 0x1007 (event KM_AES_128) 13:48:49.599359 paicrypt_stop event 0x1007 (event KM_AES_128) 13:48:49.599198 paicrypt_start event 0x1007 13:48:49.599199 paicrypt_start event 0x1008 13:48:49.599921 paicrypt_event_destroy event 0x1008 13:48:52.601507 paicrypt_event_destroy event 0x1007 This is caused by functions event_sched_in() and event_sched_out() which call the PMU's add() and start() functions on schedule_in and the PMU's stop() and del() functions on schedule_out. This is correct for events attached to processes. The pai_crypto events are system-wide events and not attached to processes. Since the kernel common code can not be changed easily, fix this issue and do not reset the event count value to zero each time the event is added and started. Instead use a flag and zero the event count value only when called immediately after the event has been initialized. Therefore only the first invocation of the the event's add() function initializes the event count value to zero. The following invocations of the event's add() function leave the current event count value untouched. Fixes: 39d62336f5c1 ("s390/pai: add support for cryptography counters") Reported-by: Sumanth Korikkar Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit 541a496644512ebed429b33f19a3fadfb19c6ee7 Author: Thomas Richter Date: Tue Jun 14 12:40:46 2022 +0200 s390/pai: Prevent invalid event number for pai_crypto PMU The pai_crypto PMU has to check the event number. It has to be in the supported range. This is not the case, the lower limit is not checked. Fix this and obey the lower limit. Fixes: 39d62336f5c1 ("s390/pai: add support for cryptography counters") Signed-off-by: Thomas Richter Suggested-by: Sumanth Korikkar Reviewed-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit be857b7f77d130dbbd47c91fc35198b040f35865 Author: Thomas Richter Date: Fri Jun 10 15:19:00 2022 +0200 s390/cpumf: Handle events cycles and instructions identical Events CPU_CYCLES and INSTRUCTIONS can be submitted with two different perf_event attribute::type values: - PERF_TYPE_HARDWARE: when invoked via perf tool predefined events name cycles or cpu-cycles or instructions. - pmu->type: when invoked via perf tool event name cpu_cf/CPU_CYLCES/ or cpu_cf/INSTRUCTIONS/. This invocation also selects the PMU to which the event belongs. Handle both type of invocations identical for events CPU_CYLCES and INSTRUCTIONS. They address the same hardware. The result is different when event modifier exclude_kernel is also set. Invocation with event modifier for user space event counting fails. Output before: # perf stat -e cpum_cf/cpu_cycles/u -- true Performance counter stats for 'true': cpum_cf/cpu_cycles/u 0.000761033 seconds time elapsed 0.000076000 seconds user 0.000725000 seconds sys # Output after: # perf stat -e cpum_cf/cpu_cycles/u -- true Performance counter stats for 'true': 349,613 cpum_cf/cpu_cycles/u 0.000844143 seconds time elapsed 0.000079000 seconds user 0.000800000 seconds sys # Fixes: 6a82e23f45fe ("s390/cpumf: Adjust registration of s390 PMU device drivers") Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar [agordeev@linux.ibm.com corrected commit ID of Fixes commit] Signed-off-by: Alexander Gordeev commit af2debd58bd769e38f538143f0d332e15d753396 Author: Alexander Gordeev Date: Thu Jun 9 21:32:39 2022 +0200 s390/crash: make copy_oldmem_page() return number of bytes copied Callback copy_oldmem_page() returns either error code or zero. Instead, it should return the error code or number of bytes copied. Fixes: df9694c7975f ("s390/dump: streamline oldmem copy functions") Reviewed-by: Alexander Egorenkov Tested-by: Alexander Egorenkov Signed-off-by: Alexander Gordeev commit cc02e6e21aa5f2ac0defe8c15e5a9d024da6e73d Author: Alexander Gordeev Date: Fri Jun 10 11:04:36 2022 +0200 s390/crash: add missing iterator advance in copy_oldmem_page() In case old memory was successfully copied the passed iterator should be advanced as well. Currently copy_oldmem_page() is always called with single-segment iterator. Should that ever change - copy_oldmem_user and copy_oldmem_kernel() functions would need a rework to deal with multi-segment iterators. Fixes: 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter") Reviewed-by: Alexander Egorenkov Tested-by: Alexander Egorenkov Signed-off-by: Alexander Gordeev commit c1c2a15c2b5379ea8e44dcdcc298e3de42076ba0 Author: Uwe Kleine-König Date: Tue Jun 21 08:40:36 2022 +0200 gpio: grgpio: Fix device removing If a platform device's remove callback returns non-zero, the device core emits a warning and still removes the device and calls the devm cleanup callbacks. So it's not save to not unregister the gpiochip because on the next request to a GPIO the driver accesses kfree()'d memory. Also if an IRQ triggers, the freed memory is accessed. Instead rely on the GPIO framework to ensure that after gpiochip_remove() all GPIOs are freed and so the corresponding IRQs are unmapped. This is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit e70b64a3f28b9f54602ae3e706b1dc1338de3df7 Author: Dylan Yudaken Date: Thu Jun 23 01:37:43 2022 -0700 io_uring: move io_uring_get_opcode out of TP_printk The TP_printk macro's are not supposed to use custom code ([1]) or else tools such as perf cannot use these events. Convert the opcode string representation to use the __string wiring that the event framework provides ([2]). [1]: https://lwn.net/Articles/379903/ [2]: https://lwn.net/Articles/381064/ Fixes: 033b87d24f72 ("io_uring: use the text representation of ops in trace") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220623083743.2648321-1-dylany@fb.com [axboe: fixup spurious removal of sq_thread assignment] Signed-off-by: Jens Axboe commit 9ca766eaea2e87b8b773bff04ee56c055cb76d4e Author: Dan Carpenter Date: Thu Jun 23 11:29:48 2022 +0300 gpio: winbond: Fix error code in winbond_gpio_get() This error path returns 1, but it should instead propagate the negative error code from winbond_sio_enter(). Fixes: a0d65009411c ("gpio: winbond: Add driver") Signed-off-by: Dan Carpenter Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 8ffdc53a60049f3930afe161dc51c67959c8d83d Author: Utkarsh Patel Date: Thu Jun 23 14:19:45 2022 +0300 xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI Meteor Lake TCSS(Type-C Subsystem) xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3cold and thus save energy. Cc: stable@kernel.org Signed-off-by: Utkarsh Patel Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220623111945.1557702-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 7516da47a349e74de623243a27f9b8a91446bf4f Author: Tanveer Alam Date: Thu Jun 23 14:19:44 2022 +0300 xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI In the same way as Intel Alder Lake TCSS (Type-C Subsystem) the Raptor Lake TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3cold and thus save energy. Cc: stable@kernel.org Signed-off-by: Tanveer Alam Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220623111945.1557702-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 83810f84ecf11dfc5a9414a8b762c3501b328185 Author: Mathias Nyman Date: Thu Jun 23 14:19:43 2022 +0300 xhci: turn off port power in shutdown If ports are not turned off in shutdown then runtime suspended self-powered USB devices may survive in U3 link state over S5. During subsequent boot, if firmware sends an IPC command to program the port in DISCONNECT state, it will time out, causing significant delay in the boot time. Turning off roothub port power is also recommended in xhci specification 4.19.4 "Port Power" in the additional note. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220623111945.1557702-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a808925075fb750804a60ff0710614466c396db4 Author: Hongyu Xie Date: Thu Jun 23 14:19:42 2022 +0300 xhci: Keep interrupt disabled in initialization until host is running. irq is disabled in xhci_quiesce(called by xhci_halt, with bit:2 cleared in USBCMD register), but xhci_run(called by usb_add_hcd) re-enable it. It's possible that you will receive thousands of interrupt requests after initialization for 2.0 roothub. And you will get a lot of warning like, "xHCI dying, ignoring interrupt. Shouldn't IRQs be disabled?". This amount of interrupt requests will cause the entire system to freeze. This problem was first found on a device with ASM2142 host controller on it. [tidy up old code while moving it, reword header -Mathias] Cc: stable@kernel.org Signed-off-by: Hongyu Xie Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220623111945.1557702-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 922d4578cfd017da67f545bfd07331bda86f795d Merge: 9e2f6498efbbc cbc6d44867a24 Author: Paolo Bonzini Date: Thu Jun 23 10:27:21 2022 -0400 Merge tag 'kvmarm-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 5.19, take #2 - Fix a regression with pKVM when kmemleak is enabled - Add Oliver Upton as an official KVM/arm64 reviewer commit 9e2f6498efbbc880d7caa7935839e682b64fe5a6 Author: Raghavendra Rao Ananta Date: Wed Jun 15 18:57:06 2022 +0000 selftests: KVM: Handle compiler optimizations in ucall The selftests, when built with newer versions of clang, is found to have over optimized guests' ucall() function, and eliminating the stores for uc.cmd (perhaps due to no immediate readers). This resulted in the userspace side always reading a value of '0', and causing multiple test failures. As a result, prevent the compiler from optimizing the stores in ucall() with WRITE_ONCE(). Suggested-by: Ricardo Koller Suggested-by: Reiji Watanabe Signed-off-by: Raghavendra Rao Ananta Message-Id: <20220615185706.1099208-1-rananta@google.com> Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 2bdc2bcd9a759613d6340c4a0b7f5d3b7a1a71a2 Merge: 9ef1654063085 15b694e96c318 Author: Greg Kroah-Hartman Date: Thu Jun 23 16:25:55 2022 +0200 Merge tag 'usb-serial-5.19-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.19-rc4 Here are some new modem device ids and support for further PL2303 device types. All but the final commit (RM500K device id) have been in linux-next and with no reported issues. * tag 'usb-serial-5.19-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel RM500K module support USB: serial: option: add Quectel EM05-G modem USB: serial: pl2303: add support for more HXN (G) types USB: serial: option: add Telit LE910Cx 0x1250 composition commit 399bd66e219e331976fe6fa6ab81a023c0c97870 Merge: f410c3e000a3c 12378a5a75e33 Author: Linus Torvalds Date: Thu Jun 23 09:01:01 2022 -0500 Merge tag 'net-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bpf and netfilter. Current release - regressions: - netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit Current release - new code bugs: - bpf: ftrace: keep address offset in ftrace_lookup_symbols - bpf: force cookies array to follow symbols sorting Previous releases - regressions: - ipv4: ping: fix bind address validity check - tipc: fix use-after-free read in tipc_named_reinit - eth: veth: add updating of trans_start Previous releases - always broken: - sock: redo the psock vs ULP protection check - netfilter: nf_dup_netdev: fix skb_under_panic - bpf: fix request_sock leak in sk lookup helpers - eth: igb: fix a use-after-free issue in igb_clean_tx_ring - eth: ice: prohibit improper channel config for DCB - eth: at803x: fix null pointer dereference on AR9331 phy - eth: virtio_net: fix xdp_rxq_info bug after suspend/resume Misc: - eth: hinic: replace memcpy() with direct assignment" * tag 'net-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) net: openvswitch: fix parsing of nw_proto for IPv6 fragments sock: redo the psock vs ULP protection check Revert "net/tls: fix tls_sk_proto_close executed repeatedly" virtio_net: fix xdp_rxq_info bug after suspend/resume igb: Make DMA faster when CPU is active on the PCIe link net: dsa: qca8k: reduce mgmt ethernet timeout net: dsa: qca8k: reset cpu port on MTU change MAINTAINERS: Add a maintainer for OCP Time Card hinic: Replace memcpy() with direct assignment Revert "drivers/net/ethernet/neterion/vxge: Fix a use-after-free bug in vxge-main.c" net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode ice: ethtool: Prohibit improper channel config for DCB ice: ethtool: advertise 1000M speeds properly ice: Fix switchdev rules book keeping ice: ignore protocol field in GTP offload netfilter: nf_dup_netdev: add and use recursion counter netfilter: nf_dup_netdev: do not push mac header a second time selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh net/tls: fix tls_sk_proto_close executed repeatedly erspan: do not assume transport header is always set ... commit f410c3e000a3ced328b2c4c8bb6d121ff5572dde Merge: ddfe80311b81a 89bcd9a64b849 Author: Linus Torvalds Date: Thu Jun 23 08:55:37 2022 -0500 Merge tag 'mmc-v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - mtk-sd: Fix dma hang issues - sdhci-pci-o2micro: Fix card detect by dealing with debouncing * tag 'mmc-v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: mediatek: wait dma stop bit reset to 0 mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing commit e531485a0a0e0a06644de1b639502471415d5e12 Merge: ca2a3343d6974 e6487833182a8 Author: Jens Axboe Date: Thu Jun 23 07:55:07 2022 -0600 Merge tag 'nvme-5.19-2022-06-23' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - fix the mixed up CRIMS/CRWMS constants (Joel Granados) - add another broken identifier quirk (Leo Savernik) - fix up a quirk because Samsung reuses PCI IDs over different products (Christoph Hellwig)" * tag 'nvme-5.19-2022-06-23' of git://git.infradead.org/nvme: nvme: move the Samsung X5 quirk entry to the core quirks nvme: fix the CRIMS and CRWMS definitions to match the spec nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH commit ca2a3343d69741dae4df2dbb954fb806d9a835de Author: Li Nan Date: Thu Jun 23 15:41:00 2022 +0800 block: remove WARN_ON() from bd_link_disk_holder Since commit 83cbce957446("block: add error handling for device_add_disk / add_disk"), bdev->bd_holder_dir can not be empty now, so remove WARN_ON() from bd_link_disk_holder. Signed-off-by: Li Nan Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220623074100.2251301-1-linan122@huawei.com Signed-off-by: Jens Axboe commit ddfe80311b81a83d3fde7e59fddc6aa822a5188d Merge: de5c208d533a4 627ce0d68eb4b Author: Linus Torvalds Date: Thu Jun 23 08:44:00 2022 -0500 Merge tag 'sound-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All small changes, mostly device-specific: - A regression fix for PCM WC-page allocation on x86 - A regression fix for i915 audio component binding - Fixes for (longstanding) beep handling bug - Runtime PM fixes for Intel LPE HDMI audio - A couple of pending FireWire fixes - Usual HD-audio and USB-audio quirks, new Intel dspconf entries" * tag 'sound-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for Clevo NS50PU ALSA: hda: Fix discovery of i915 graphics PCI device ALSA: hda/via: Fix missing beep setup ALSA: hda/conexant: Fix missing beep setup ALSA: memalloc: Drop x86-specific hack for WC allocations ALSA: hda/realtek: Add quirk for Clevo PD70PNT ALSA: x86: intel_hdmi_audio: use pm_runtime_resume_and_get() ALSA: x86: intel_hdmi_audio: enable pm_runtime and set autosuspend delay ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg ALSA: hda: intel-dspcfg: use SOF for UpExtreme and UpExtreme11 boards firewire: convert sysfs sprintf/snprintf family to sysfs_emit firewire: cdev: fix potential leak of kernel stack due to uninitialized value ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly ALSA: hda/realtek - ALC897 headset MIC no sound ALSA: usb-audio: US16x08: Move overflow check before array access ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop commit dbe97cff7dd9f0f75c524afdd55ad46be3d15295 Author: Demi Marie Obenour Date: Tue Jun 21 22:27:26 2022 -0400 xen/gntdev: Avoid blocking in unmap_grant_pages() unmap_grant_pages() currently waits for the pages to no longer be used. In https://github.com/QubesOS/qubes-issues/issues/7481, this lead to a deadlock against i915: i915 was waiting for gntdev's MMU notifier to finish, while gntdev was waiting for i915 to free its pages. I also believe this is responsible for various deadlocks I have experienced in the past. Avoid these problems by making unmap_grant_pages async. This requires making it return void, as any errors will not be available when the function returns. Fortunately, the only use of the return value is a WARN_ON(), which can be replaced by a WARN_ON when the error is detected. Additionally, a failed call will not prevent further calls from being made, but this is harmless. Because unmap_grant_pages is now async, the grant handle will be sent to INVALID_GRANT_HANDLE too late to prevent multiple unmaps of the same handle. Instead, a separate bool array is allocated for this purpose. This wastes memory, but stuffing this information in padding bytes is too fragile. Furthermore, it is necessary to grab a reference to the map before making the asynchronous call, and release the reference when the call returns. It is also necessary to guard against reentrancy in gntdev_map_put(), and to handle the case where userspace tries to map a mapping whose contents have not all been freed yet. Fixes: 745282256c75 ("xen/gntdev: safely unmap grants in case they are still in use") Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220622022726.2538-1-demi@invisiblethingslab.com Signed-off-by: Juergen Gross commit 3be4562584bba603f33863a00c1c32eecf772ee6 Author: Dexuan Cui Date: Wed Jun 22 12:14:24 2022 -0700 dma-direct: use the correct size for dma_set_encrypted() The third parameter of dma_set_encrypted() is a size in bytes rather than the number of pages. Fixes: 4d0564785bb0 ("dma-direct: factor out dma_set_{de,en}crypted helpers") Signed-off-by: Dexuan Cui Reviewed-by: Robin Murphy Signed-off-by: Christoph Hellwig commit e6487833182a8a0187f0292aca542fc163ccd03e Author: Christoph Hellwig Date: Fri Jun 17 10:29:42 2022 +0200 nvme: move the Samsung X5 quirk entry to the core quirks This device shares the PCI ID with the Samsung 970 Evo Plus that does not need or want the quirks. Move the the quirk entry to the core table based on the model number instead. Fixes: bc360b0b1611 ("nvme-pci: add quirks for Samsung X5 SSDs") Signed-off-by: Christoph Hellwig Reviewed-by: Pankaj Raghav commit 23c9cd56007e90b2c2317c5eab6ab12921b4314a Author: Joel Granados Date: Tue Jun 21 09:05:00 2022 +0200 nvme: fix the CRIMS and CRWMS definitions to match the spec Adjust the values of NVME_CAP_CRMS_CRIMS and NVME_CAP_CRMS_CRWMS masks as they are different from the ones in TP4084 - Time-to-ready. Fixes: 354201c53e61 ("nvme: add support for TP4084 - Time-to-Ready Enhancements"). Signed-off-by: Joel Granados Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 41f38043f884c66af4114a7109cf540d6222f450 Author: Leo Savernik Date: Wed Jun 22 12:19:21 2022 +0200 nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH The Micron MTFDKBA2T0TFH device reports the same subsysem NQN for all devices. Add a quick to ignore it. Signed-off-by: Leo Savernik Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 15b694e96c31807d8515aacfa687a1e8a4fbbadc Author: Macpaul Lin Date: Thu Jun 23 16:56:44 2022 +0800 USB: serial: option: add Quectel RM500K module support Add usb product id of the Quectel RM500K module. RM500K provides 2 mandatory interfaces to Linux host after enumeration. - /dev/ttyUSB5: this is a serial interface for control path. User needs to write AT commands to this device node to query status, set APN, set PIN code, and enable/disable the data connection to 5G network. - ethX: this is the data path provided as a RNDIS devices. After the data connection has been established, Linux host can access 5G data network via this interface. "RNDIS": RNDIS + ADB + AT (/dev/ttyUSB5) + MODEM COMs usb-devices output for 0x7001: T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=7001 Rev=00.01 S: Manufacturer=MediaTek Inc. S: Product=USB DATA CARD S: SerialNumber=869206050009672 C: #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Co-developed-by: Ballon Shi Signed-off-by: Ballon Shi Signed-off-by: Macpaul Lin Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 12378a5a75e33f34f8586706eb61cca9e6d4690c Author: Rosemarie O'Riorden Date: Tue Jun 21 16:48:45 2022 -0400 net: openvswitch: fix parsing of nw_proto for IPv6 fragments When a packet enters the OVS datapath and does not match any existing flows installed in the kernel flow cache, the packet will be sent to userspace to be parsed, and a new flow will be created. The kernel and OVS rely on each other to parse packet fields in the same way so that packets will be handled properly. As per the design document linked below, OVS expects all later IPv6 fragments to have nw_proto=44 in the flow key, so they can be correctly matched on OpenFlow rules. OpenFlow controllers create pipelines based on this design. This behavior was changed by the commit in the Fixes tag so that nw_proto equals the next_header field of the last extension header. However, there is no counterpart for this change in OVS userspace, meaning that this field is parsed differently between OVS and the kernel. This is a problem because OVS creates actions based on what is parsed in userspace, but the kernel-provided flow key is used as a match criteria, as described in Documentation/networking/openvswitch.rst. This leads to issues such as packets incorrectly matching on a flow and thus the wrong list of actions being applied to the packet. Such changes in packet parsing cannot be implemented without breaking the userspace. The offending commit is partially reverted to restore the expected behavior. The change technically made sense and there is a good reason that it was implemented, but it does not comply with the original design of OVS. If in the future someone wants to implement such a change, then it must be user-configurable and disabled by default to preserve backwards compatibility with existing OVS versions. Cc: stable@vger.kernel.org Fixes: fa642f08839b ("openvswitch: Derive IP protocol number for IPv6 later frags") Link: https://docs.openvswitch.org/en/latest/topics/design/#fragments Signed-off-by: Rosemarie O'Riorden Acked-by: Eelco Chaudron Link: https://lore.kernel.org/r/20220621204845.9721-1-roriorden@redhat.com Signed-off-by: Paolo Abeni commit e34a07c0ae3906f97eb18df50902e2a01c1015b6 Author: Jakub Kicinski Date: Mon Jun 20 12:13:53 2022 -0700 sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the new tcp_bpf_update_proto() function. I'm guessing that this was done to allow creating psocks for non-inet sockets. Unfortunately the destruction path for psock includes the ULP unwind, so we need to fail the sk_psock_init() itself. Otherwise if ULP is already present we'll notice that later, and call tcp_update_ulp() with the sk_proto of the ULP itself, which will most likely result in the ULP looping its callbacks. Fixes: 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") Signed-off-by: Jakub Kicinski Reviewed-by: John Fastabend Reviewed-by: Jakub Sitnicki Tested-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20220620191353.1184629-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 1b205d948fbb06a7613d87dcea0ff5fd8a08ed91 Author: Jakub Kicinski Date: Mon Jun 20 12:13:52 2022 -0700 Revert "net/tls: fix tls_sk_proto_close executed repeatedly" This reverts commit 69135c572d1f84261a6de2a1268513a7e71753e2. This commit was just papering over the issue, ULP should not get ->update() called with its own sk_prot. Each ULP would need to add this check. Fixes: 69135c572d1f ("net/tls: fix tls_sk_proto_close executed repeatedly") Signed-off-by: Jakub Kicinski Reviewed-by: John Fastabend Link: https://lore.kernel.org/r/20220620191353.1184629-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8af52fe9fd3bf5e7478da99193c0632276e1dfce Author: Stephan Gerhold Date: Tue Jun 21 13:48:44 2022 +0200 virtio_net: fix xdp_rxq_info bug after suspend/resume The following sequence currently causes a driver bug warning when using virtio_net: # ip link set eth0 up # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) # ip link set eth0 down Missing register, driver bug WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138 xdp_rxq_info_unreg+0x58/0x60 Call trace: xdp_rxq_info_unreg+0x58/0x60 virtnet_close+0x58/0xac __dev_close_many+0xac/0x140 __dev_change_flags+0xd8/0x210 dev_change_flags+0x24/0x64 do_setlink+0x230/0xdd0 ... This happens because virtnet_freeze() frees the receive_queue completely (including struct xdp_rxq_info) but does not call xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets up the receive_queue again but does not call xdp_rxq_info_reg(). Actually, parts of virtnet_freeze_down() and virtnet_restore_up() are almost identical to virtnet_close() and virtnet_open(): only the calls to xdp_rxq_info_(un)reg() are missing. This means that we can fix this easily and avoid such problems in the future by just calling virtnet_close()/open() from the freeze/restore handlers. Aside from adding the missing xdp_rxq_info calls the only difference is that the refill work is only cancelled if netif_running(). However, this should not make any functional difference since the refill work should only be active if the network interface is actually up. Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") Signed-off-by: Stephan Gerhold Acked-by: Jesper Dangaard Brouer Acked-by: Jason Wang Link: https://lore.kernel.org/r/20220621114845.3650258-1-stephan.gerhold@kernkonzept.com Signed-off-by: Jakub Kicinski commit 448ad88f8011af77e0960fd011039e525fcb7cde Merge: 4e0effd9007ea a632b2a4c920c Author: Jakub Kicinski Date: Wed Jun 22 18:59:29 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-06-21 This series contains updates to ice driver only. Marcin fixes GTP filters by allowing ignoring of the inner ethertype field. Wojciech adds VSI handle tracking in order to properly distinguish similar filters for removal. Anatolii removes ability to set 1000baseT and 1000baseX fields concurrently which caused link issues. He also disallows setting channels to less than the number of Traffic Classes which would cause NULL pointer dereference. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: ethtool: Prohibit improper channel config for DCB ice: ethtool: advertise 1000M speeds properly ice: Fix switchdev rules book keeping ice: ignore protocol field in GTP offload ==================== Link: https://lore.kernel.org/r/20220621224756.631765-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4e0effd9007ea0be31f7488611eb3824b4541554 Author: Kai-Heng Feng Date: Tue Jun 21 15:10:56 2022 -0700 igb: Make DMA faster when CPU is active on the PCIe link Intel I210 on some Intel Alder Lake platforms can only achieve ~750Mbps Tx speed via iperf. The RR2DCDELAY shows around 0x2xxx DMA delay, which will be significantly lower when 1) ASPM is disabled or 2) SoC package c-state stays above PC3. When the RR2DCDELAY is around 0x1xxx the Tx speed can reach to ~950Mbps. According to the I210 datasheet "8.26.1 PCIe Misc. Register - PCIEMISC", "DMA Idle Indication" doesn't seem to tie to DMA coalesce anymore, so set it to 1b for "DMA is considered idle when there is no Rx or Tx AND when there are no TLPs indicating that CPU is active detected on the PCIe link (such as the host executes CSR or Configuration register read or write operation)" and performing Tx should also fall under "active CPU on PCIe link" case. In addition to that, commit b6e0c419f040 ("igb: Move DMA Coalescing init code to separate function.") seems to wrongly changed from enabling E1000_PCIEMISC_LX_DECISION to disabling it, also fix that. Fixes: b6e0c419f040 ("igb: Move DMA Coalescing init code to separate function.") Signed-off-by: Kai-Heng Feng Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220621221056.604304-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 85467f7da18992311deafdbf32a8d163cb1e98d7 Author: Christian Marangi Date: Tue Jun 21 17:16:33 2022 +0200 net: dsa: qca8k: reduce mgmt ethernet timeout The current mgmt ethernet timeout is set to 100ms. This value is too big and would slow down any mdio command in case the mgmt ethernet packet have some problems on the receiving part. Reduce it to just 5ms to handle case when some operation are done on the master port that would cause the mgmt ethernet to not work temporarily. Fixes: 5950c7c0a68c ("net: dsa: qca8k: add support for mgmt read/write in Ethernet packet") Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20220621151633.11741-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 386228c694bf1e7a7688e44412cb33500b0ac585 Author: Christian Marangi Date: Tue Jun 21 17:11:22 2022 +0200 net: dsa: qca8k: reset cpu port on MTU change It was discovered that the Documentation lacks of a fundamental detail on how to correctly change the MAX_FRAME_SIZE of the switch. In fact if the MAX_FRAME_SIZE is changed while the cpu port is on, the switch panics and cease to send any packet. This cause the mgmt ethernet system to not receive any packet (the slow fallback still works) and makes the device not reachable. To recover from this a switch reset is required. To correctly handle this, turn off the cpu ports before changing the MAX_FRAME_SIZE and turn on again after the value is applied. Fixes: f58d2598cf70 ("net: dsa: qca8k: implement the port MTU callbacks") Cc: stable@vger.kernel.org Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20220621151122.10220-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 6e1c1c08cdf3d7d7b8c571c0f032a283af6ca024 Author: Shyam Prasad N Date: Mon Jun 6 09:17:56 2022 +0000 cifs: periodically query network interfaces from server Currently, we only query the server for network interfaces information at the time of mount, and never afterwards. This can be a problem, especially for services like Azure, where the IP address of the channel endpoints can change over time. With this change, we schedule a 600s polling of this info from the server for each tree connect. An alternative for periodic polling was to do this only at the time of reconnect. But this could delay the reconnect time slightly. Also, there are some challenges w.r.t how we have cifs_reconnect implemented today. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit b54034a73baf9fe31fb3f218c17bd5308a27a1ca Author: Shyam Prasad N Date: Mon Jan 3 08:47:30 2022 +0000 cifs: during reconnect, update interface if necessary Going forward, the plan is to periodically query the server for it's interfaces (when multichannel is enabled). This change allows checking for inactive interfaces during reconnect, and reconnect to a new interface if necessary. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit aa45dadd34e44fcd6a9df4b395bee5b5633b4cec Author: Shyam Prasad N Date: Sat Jan 1 12:50:21 2022 +0000 cifs: change iface_list from array to sorted linked list A server's published interface list can change over time, and needs to be updated. We've storing iface_list as a simple array, which makes it difficult to manipulate an existing list. With this change, iface_list is modified into a linked list of interfaces, which is kept sorted by speed. Also added a reference counter for an iface entry, so that each channel can maintain a backpointer to the iface and drop it easily when needed. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 9de74996a739bf0b7b5d8c260bd207ad6007442b Author: Shyam Prasad N Date: Wed Jun 22 12:36:36 2022 -0500 smb3: use netname when available on secondary channels Some servers do not allow null netname contexts, which would cause multichannel to revert to single channel when mounting to some servers (e.g. Azure xSMB). The previous patch fixed that by avoiding incorrectly sending the netname context when there would be a null hostname sent in the netname context, while this patch fixes the null hostname for the secondary channel by using the hostname of the primary channel for the secondary channel. Fixes: 4c14d7043fede ("cifs: populate empty hostnames for extra channels") Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 13f28c2cf0701eaf3b251a57b46bca0fe17248ca Author: Vadim Fedorenko Date: Wed Jun 22 02:31:31 2022 +0300 MAINTAINERS: Add a maintainer for OCP Time Card I've been contributing and reviewing patches for ptp_ocp driver for some time and I'm taking care of it's github mirror. On Jakub's suggestion, I would like to step forward and become a maintainer for this driver. This patch adds a dedicated entry to MAINTAINERS. Signed-off-by: Vadim Fedorenko Acked-by: Jonathan Lemon Link: https://lore.kernel.org/r/20220621233131.21240-1-vfedorenko@novek.ru Signed-off-by: Jakub Kicinski commit db7cfc380900bc4243b09623fd72fabe0a8ff23b Author: Alexey Gladkov Date: Wed Jun 22 22:07:29 2022 +0200 ipc: Free mq_sysctls if ipc namespace creation failed The problem that Dmitry Vyukov pointed out is that if setup_ipc_sysctls fails, mq_sysctls must be freed before return. executing program BUG: memory leak unreferenced object 0xffff888112fc9200 (size 512): comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s) hex dump (first 32 bytes): ef d3 60 85 ff ff ff ff 0c 9b d2 12 81 88 ff ff ..`............. 04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemdup+0x23/0x50 mm/util.c:129 [] kmemdup include/linux/fortify-string.h:456 [inline] [] setup_mq_sysctls+0x4b/0x1c0 ipc/mq_sysctl.c:89 [] create_ipc_ns ipc/namespace.c:63 [inline] [] copy_ipcs+0x292/0x390 ipc/namespace.c:91 [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90 [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226 [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165 [] __do_sys_unshare kernel/fork.c:3236 [inline] [] __se_sys_unshare kernel/fork.c:3234 [inline] [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: memory leak unreferenced object 0xffff888112fd5f00 (size 256): comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s) hex dump (first 32 bytes): 00 92 fc 12 81 88 ff ff 00 00 00 00 01 00 00 00 ................ 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:605 [inline] [] kzalloc include/linux/slab.h:733 [inline] [] __register_sysctl_table+0x7b/0x7f0 fs/proc/proc_sysctl.c:1344 [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112 [] create_ipc_ns ipc/namespace.c:63 [inline] [] copy_ipcs+0x292/0x390 ipc/namespace.c:91 [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90 [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226 [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165 [] __do_sys_unshare kernel/fork.c:3236 [inline] [] __se_sys_unshare kernel/fork.c:3234 [inline] [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: memory leak unreferenced object 0xffff888112fbba00 (size 256): comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s) hex dump (first 32 bytes): 78 ba fb 12 81 88 ff ff 00 00 00 00 01 00 00 00 x............... 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:605 [inline] [] kzalloc include/linux/slab.h:733 [inline] [] new_dir fs/proc/proc_sysctl.c:978 [inline] [] get_subdir fs/proc/proc_sysctl.c:1022 [inline] [] __register_sysctl_table+0x5a9/0x7f0 fs/proc/proc_sysctl.c:1373 [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112 [] create_ipc_ns ipc/namespace.c:63 [inline] [] copy_ipcs+0x292/0x390 ipc/namespace.c:91 [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90 [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226 [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165 [] __do_sys_unshare kernel/fork.c:3236 [inline] [] __se_sys_unshare kernel/fork.c:3234 [inline] [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: memory leak unreferenced object 0xffff888112fbb900 (size 256): comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s) hex dump (first 32 bytes): 78 b9 fb 12 81 88 ff ff 00 00 00 00 01 00 00 00 x............... 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:605 [inline] [] kzalloc include/linux/slab.h:733 [inline] [] new_dir fs/proc/proc_sysctl.c:978 [inline] [] get_subdir fs/proc/proc_sysctl.c:1022 [inline] [] __register_sysctl_table+0x5a9/0x7f0 fs/proc/proc_sysctl.c:1373 [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112 [] create_ipc_ns ipc/namespace.c:63 [inline] [] copy_ipcs+0x292/0x390 ipc/namespace.c:91 [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90 [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226 [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165 [] __do_sys_unshare kernel/fork.c:3236 [inline] [] __se_sys_unshare kernel/fork.c:3234 [inline] [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Reported-by: syzbot+b4b0d1b35442afbf6fd2@syzkaller.appspotmail.com Signed-off-by: Alexey Gladkov Link: https://lkml.kernel.org/r/000000000000f5004705e1db8bad@google.com Link: https://lkml.kernel.org/r/20220622200729.2639663-1-legion@kernel.org Signed-off-by: Eric W. Biederman commit e84131a88a8cdcd6fe9f234ed98e3f8ca049142b Author: Joshua Ashton Date: Thu Jun 16 01:21:27 2022 +0000 amd/display/dc: Fix COLOR_ENCODING and COLOR_RANGE doing nothing for DCN20+ For DCN20 and above, the code that actually hooks up the provided input_color_space got lost at some point. Fixes COLOR_ENCODING and COLOR_RANGE doing nothing on DCN20+. Tested using Steam Remote Play Together + gamescope. Update other DCNs the same wasy DCN1.x was updates in commit a1e07ba89d49 ("drm/amd/display: Use plane->color_space for dpp if specified") Fixes: a1e07ba89d49 ("drm/amd/display: Use plane->color_space for dpp if specified") Signed-off-by: Joshua Ashton Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 98b02e9f002b21944176774cf420c4d674f6201c Author: George Shen Date: Thu Oct 7 15:59:44 2021 -0400 drm/amd/display: Fix typo in override_lane_settings [Why] The function currently skips overriding the drive settings of the first lane. [How] Change for loop to start at 0 instead of 1. Tested-by: Daniel Wheeler Reviewed-by: Wenjing Liu Acked-by: Alan Liu Signed-off-by: George Shen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 235870f659687b48b12c28f9427e6ca39dcaa81e Author: Qingqing Zhuo Date: Fri Jun 10 10:43:53 2022 -0400 drm/amd/display: Fix DC warning at driver load [Why] Wrong index was checked for dcfclk_mhz, causing false warning. [How] Fix the assertion index. Tested-by: Daniel Wheeler Reviewed-by: Dmytro Laktyushkin Acked-by: Rodrigo Siqueira Signed-off-by: Qingqing Zhuo Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit 937e24b7f5595566a64e0f856ebab9147f2e4d1b Author: Mario Limonciello Date: Wed Jun 15 17:30:05 2022 -0500 drm/amd: Revert "drm/amd/display: keep eDP Vdd on when eDP stream is already enabled" A variety of Lenovo machines with Rembrandt APUs and OLED panels have stopped showing the display at login. This behavior clears up after leaving it idle and moving the mouse or touching keyboard. It was bisected to be caused by commit 559e2655220d ("drm/amd/display: keep eDP Vdd on when eDP stream is already enabled"). Revert this commit to fix the issue. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2047 Reported-by: Aaron Ma Fixes: 559e2655220d ("drm/amd/display: keep eDP Vdd on when eDP stream is already enabled") Signed-off-by: Mario Limonciello Tested-by: Mark Pearson Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f15345a377c6ea9c7cc74f079616af8856aff37f Author: Alex Deucher Date: Thu May 19 10:21:08 2022 -0400 drm/amdgpu: Adjust logic around GTT size (v3) Certain GL unit tests for large textures can cause problems with the OOM killer since there is no way to link this memory to a process. This was originally mitigated (but not necessarily eliminated) by limiting the GTT size. The problem is this limit is often too low for many modern games so just make the limit 1/2 of system memory. The OOM accounting needs to be addressed, but we shouldn't prevent common 3D applications from being usable just to potentially mitigate that corner case. Set default GTT size to max(3G, 1/2 of system ram) by default. v2: drop previous logic and default to 3/4 of ram v3: default to half of ram to align with ttm v4: fix spelling in comment (Kent) Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1942 Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher commit de5c208d533a46a074eb46ea17f672cc005a7269 Merge: 3abc3ae553c7e 9b4d5c01eb234 Author: Linus Torvalds Date: Wed Jun 22 14:08:06 2022 -0500 Merge tag 'linux-kselftest-fixes-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "Compile time fixes and run-time resources leaks: - Fix clang cross compilation - Fix resource leak when return error - fix compile error for dma_map_benchmark - Fix regression - make use of GUP_TEST_FILE macro" * tag 'linux-kselftest-fixes-5.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: make use of GUP_TEST_FILE macro selftests: vm: Fix resource leak when return error selftests dma: fix compile error for dma_map_benchmark selftests: Fix clang cross compilation commit 1e70212e031528918066a631c9fdccda93a1ffaa Author: Kees Cook Date: Wed Jun 15 22:23:12 2022 -0700 hinic: Replace memcpy() with direct assignment Under CONFIG_FORTIFY_SOURCE=y and CONFIG_UBSAN_BOUNDS=y, Clang is bugged here for calculating the size of the destination buffer (0x10 instead of 0x14). This copy is a fixed size (sizeof(struct fw_section_info_st)), with the source and dest being struct fw_section_info_st, so the memcpy should be safe, assuming the index is within bounds, which is UBSAN_BOUNDS's responsibility to figure out. Avoid the whole thing and just do a direct assignment. This results in no change to the executable code. [This is a duplicate of commit 2c0ab32b73cf ("hinic: Replace memcpy() with direct assignment") which was applied to net-next.] Cc: Nick Desaulniers Cc: Tom Rix Cc: llvm@lists.linux.dev Link: https://github.com/ClangBuiltLinux/linux/issues/1592 Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Tested-by: Nathan Chancellor # build Link: https://lore.kernel.org/r/20220616052312.292861-1-keescook@chromium.org Signed-off-by: Jakub Kicinski commit 627ce0d68eb4b53e995b08089fa9da1e513ec5ba Author: Tim Crawford Date: Wed Jun 22 09:00:17 2022 -0600 ALSA: hda/realtek: Add quirk for Clevo NS50PU Fixes headset detection on Clevo NS50PU. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220622150017.9897-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit cb5177336ecb07fe1c6804306fe8efc827643c64 Author: Jiang Jian Date: Wed Jun 22 02:55:38 2022 +0800 video: fbdev: omap: Remove duplicate 'the' in comment Signed-off-by: Jiang Jian Signed-off-by: Helge Deller commit bdc48fd571a7bb0aecb9d101d78b29a05f217c72 Author: Jiang Jian Date: Tue Jun 21 14:49:04 2022 +0800 video: fbdev: omapfb: Align '*' in comment Consider '*' alignment in comments Signed-off-by: Jiang Jian Signed-off-by: Helge Deller commit 85016f66af8506cb601fd4f4fde23ed327a266be Author: Saud Farooqui Date: Wed Jun 22 13:59:17 2022 +0500 drm/sun4i: Return if frontend is not present Added return statement in sun4i_layer_format_mod_supported() in case frontend is not present. Signed-off-by: Saud Farooqui Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/PA4P189MB1421E93EF5F8E8E00E71B7878BB29@PA4P189MB1421.EURP189.PROD.OUTLOOK.COM commit 3026b5ca06fa872147f9726ca7c1f658bae71abf Author: Dan Carpenter Date: Wed Jun 22 15:25:15 2022 +0300 drm/vc4: fix error code in vc4_check_tex_size() The vc4_check_tex_size() function is supposed to return false on error but this error path accidentally returns -ENODEV (which means true). Fixes: 30f8c74ca9b7 ("drm/vc4: Warn if some v3d code is run on BCM2711") Signed-off-by: Dan Carpenter Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/YrMKK89/viQiaiAg@kili commit 9f7d09fe23a0112c08d2326d9116fccb5a912660 Author: Yoshihiro Shimoda Date: Fri Jun 17 10:01:07 2022 +0900 iommu/ipmmu-vmsa: Fix compatible for rcar-gen4 Fix compatible string for R-Car Gen4. Fixes: ae684caf465b ("iommu/ipmmu-vmsa: Add support for R-Car Gen4") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220617010107.3229784-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Joerg Roedel commit 3abc3ae553c7ed73365b385b9a4cffc5176aae45 Merge: ca1fdab7fd27e b0017602fdf6b Author: Linus Torvalds Date: Wed Jun 22 08:09:49 2022 -0500 Merge tag '9p-for-5.19-rc4' of https://github.com/martinetd/linux Pull 9pfs fixes from Dominique Martinet: "A couple of fid refcount and fscache fixes: - fid refcounting was incorrect in some corner cases and would leak resources, only freed at umount time. The first three commits fix three such cases - 'cache=loose' or fscache was broken when trying to write a partial page to a file with no read permission since the rework a few releases ago. The fix taken here is just to restore old behavior of using the special 'writeback_fid' for such reads, which is open as root/RDWR and such not get complains that we try to read on a WRONLY fid. Long-term it'd be nice to get rid of this and not issue the read at all (skip cache?) in such cases, but that direction hasn't progressed" * tag '9p-for-5.19-rc4' of https://github.com/martinetd/linux: 9p: fix EBADF errors in cached mode 9p: Fix refcounting during full path walks for fid lookups 9p: fix fid refcount leak in v9fs_vfs_get_link 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl commit 877fe9d49b74e5f84346f9df34e2c7f8086dbceb Author: Jakub Kicinski Date: Mon Jun 20 12:12:37 2022 -0700 Revert "drivers/net/ethernet/neterion/vxge: Fix a use-after-free bug in vxge-main.c" This reverts commit 8fc74d18639a2402ca52b177e990428e26ea881f. BAR0 is the main (only?) register bank for this device. We most obviously can't unmap it before the netdev is unregistered. This was pointed out in review but the patch got reposted and merged, anyway. The author of the patch was only testing it with a QEMU model, which I presume does not emulate enough for the netdev to be brought up (author's replies are not visible in lore because they kept sending their emails in HTML). Link: https://lore.kernel.org/all/20220616085059.680dc215@kernel.org/ Fixes: 8fc74d18639a ("drivers/net/ethernet/neterion/vxge: Fix a use-after-free bug in vxge-main.c") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 3f05010f243be06478a9b11cfce0ce994f5a0890 Author: Aidan MacDonald Date: Mon Jun 20 21:05:57 2022 +0100 regmap-irq: Fix offset/index mismatch in read_sub_irq_data() We need to divide the sub-irq status register offset by register stride to get an index for the status buffer to avoid an out of bounds write when the register stride is greater than 1. Fixes: a2d21848d921 ("regmap: regmap-irq: Add main status register support") Signed-off-by: Aidan MacDonald Link: https://lore.kernel.org/r/20220620200644.1961936-3-aidanmacdonald.0x0@gmail.com Signed-off-by: Mark Brown commit 485037ae9a095491beb7f893c909a76cc4f9d1e7 Author: Aidan MacDonald Date: Mon Jun 20 21:05:56 2022 +0100 regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips When enabling a type_in_mask irq, the type_buf contents must be AND'd with the mask of the IRQ we're enabling to avoid enabling other IRQs by accident, which can happen if several type_in_mask irqs share a mask register. Fixes: bc998a730367 ("regmap: irq: handle HW using separate rising/falling edge interrupts") Signed-off-by: Aidan MacDonald Link: https://lore.kernel.org/r/20220620200644.1961936-2-aidanmacdonald.0x0@gmail.com Signed-off-by: Mark Brown commit f3eac426657d985b97c92fa5f7ae1d43f04721f3 Author: Jason A. Donenfeld Date: Tue Jun 21 16:08:49 2022 +0200 powerpc/powernv: wire up rng during setup_arch The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call. Complicating things, however, is that POWER8 systems need some per-cpu state and kmalloc, which isn't available at this stage. So we split things up into an early phase and a later opportunistic phase. This commit also removes some noisy log messages that don't add much. Fixes: a4da0d50b2a0 ("powerpc: Implement arch_get_random_long/int() for powernv") Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Jason A. Donenfeld Reviewed-by: Christophe Leroy [mpe: Add of_node_put(), use pnv naming, minor change log editing] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220621140849.127227-1-Jason@zx2c4.com commit f5aa16807aa4f99293044944590dde81364f434f Author: Jernej Skrabec Date: Mon Jun 20 20:13:33 2022 +0200 drm/sun4i: Add DMA mask and segment size Kernel occasionally complains that there is mismatch in segment size when trying to render HW decoded videos and rendering them directly with sun4i DRM driver. Following message can be observed on H6 SoC: [ 184.298308] ------------[ cut here ]------------ [ 184.298326] DMA-API: sun4i-drm display-engine: mapping sg segment longer than device claims to support [len=6144000] [max=65536] [ 184.298364] WARNING: CPU: 1 PID: 382 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2b0/0x350 [ 184.322997] CPU: 1 PID: 382 Comm: ffmpeg Not tainted 5.19.0-rc1+ #1331 [ 184.329533] Hardware name: Tanix TX6 (DT) [ 184.333544] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 184.340512] pc : debug_dma_map_sg+0x2b0/0x350 [ 184.344882] lr : debug_dma_map_sg+0x2b0/0x350 [ 184.349250] sp : ffff800009f33a50 [ 184.352567] x29: ffff800009f33a50 x28: 0000000000010000 x27: ffff000001b86c00 [ 184.359725] x26: ffffffffffffffff x25: ffff000005d8cc80 x24: 0000000000000000 [ 184.366879] x23: ffff80000939ab18 x22: 0000000000000001 x21: 0000000000000001 [ 184.374031] x20: 0000000000000000 x19: ffff0000018a7410 x18: ffffffffffffffff [ 184.381186] x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff [ 184.388338] x14: 0000000000000001 x13: ffff800009534e86 x12: 6f70707573206f74 [ 184.395493] x11: 20736d69616c6320 x10: 000000000000000a x9 : 0000000000010000 [ 184.402647] x8 : ffff8000093b6d40 x7 : ffff800009f33850 x6 : 000000000000000c [ 184.409800] x5 : ffff0000bf997940 x4 : 0000000000000000 x3 : 0000000000000027 [ 184.416953] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003960e80 [ 184.424106] Call trace: [ 184.426556] debug_dma_map_sg+0x2b0/0x350 [ 184.430580] __dma_map_sg_attrs+0xa0/0x110 [ 184.434687] dma_map_sgtable+0x28/0x4c [ 184.438447] vb2_dc_dmabuf_ops_map+0x60/0xcc [ 184.442729] __map_dma_buf+0x2c/0xd4 [ 184.446321] dma_buf_map_attachment+0xa0/0x130 [ 184.450777] drm_gem_prime_import_dev+0x7c/0x18c [ 184.455410] drm_gem_prime_fd_to_handle+0x1b8/0x214 [ 184.460300] drm_prime_fd_to_handle_ioctl+0x2c/0x40 [ 184.465190] drm_ioctl_kernel+0xc4/0x174 [ 184.469123] drm_ioctl+0x204/0x420 [ 184.472534] __arm64_sys_ioctl+0xac/0xf0 [ 184.476474] invoke_syscall+0x48/0x114 [ 184.480240] el0_svc_common.constprop.0+0x44/0xec [ 184.484956] do_el0_svc+0x2c/0xc0 [ 184.488283] el0_svc+0x2c/0x84 [ 184.491354] el0t_64_sync_handler+0x11c/0x150 [ 184.495723] el0t_64_sync+0x18c/0x190 [ 184.499397] ---[ end trace 0000000000000000 ]--- Fix that by setting DMA mask and segment size. Signed-off-by: Jernej Skrabec Reviewed-by: Samuel Holland Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220620181333.650301-1-jernej.skrabec@gmail.com commit 5f940e528da6bce52a86fbdf881b76f60240aeaf Author: Saud Farooqui Date: Thu Jun 9 23:50:31 2022 +0500 drm/vc4: hdmi: Fixed possible integer overflow Multiplying ints and saving it in unsigned long long could lead to integer overflow before being type casted to unsigned long long. Addresses-Coverity: 1505113: Unintentional integer overflow. Signed-off-by: Saud Farooqui Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/PA4P189MB1421E63C0FF3EBF234A80AB38BA79@PA4P189MB1421.EURP189.PROD.OUTLOOK.COM commit 33b29dbb39bcbd0a96e440646396bbf670b914fa Author: Yonglin Tan Date: Tue Jun 21 20:37:53 2022 +0800 USB: serial: option: add Quectel EM05-G modem The EM05-G modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively: "RMNET" : AT + DIAG + NMEA + Modem + QMI "MBIM" : MBIM + AT + DIAG + NMEA + Modem The detailed description of the USB configuration for each mode as follows: RMNET Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030a Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms MBIM Mode -------------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030a Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Yonglin Tan Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit ae60aac59a9ad8ab64a4b07de509a534a75b6bac Author: Johan Hovold Date: Tue Jun 21 10:58:55 2022 +0200 USB: serial: pl2303: add support for more HXN (G) types Add support for further HXN (G) type devices (GT variant, GL variant, GS variant and GR) and document the bcdDevice mapping. Note that the TA and TB types use the same bcdDevice as some GT and GE variants, respectively, but that the HX status request can be used to determine which is which. Also note that we currently do not distinguish between the various HXN (G) types in the driver but that this may change eventually (e.g. when adding GPIO support). Reported-by: Charles Yeh Link: https://lore.kernel.org/r/YrF77b9DdeumUAee@hovoldconsulting.com Cc: stable@vger.kernel.org # 5.13 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 53664d51d3510e1d4092e539c5928fc9951f63b0 Merge: 2642cc6c3bbe0 fcd53c51d0370 Author: Jakub Kicinski Date: Tue Jun 21 22:41:40 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Use get_random_u32() instead of prandom_u32_state() in nft_meta and nft_numgen, from Florian Westphal. 2) Incorrect list head in nfnetlink_cttimeout in recent update coming from previous development cycle. Also from Florian. 3) Incorrect path to pktgen scripts for nft_concat_range.sh selftest. From Jie2x Zhou. 4) Two fixes for the for nft_fwd and nft_dup egress support, from Florian. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_dup_netdev: add and use recursion counter netfilter: nf_dup_netdev: do not push mac header a second time selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh netfilter: cttimeout: fix slab-out-of-bounds read typo in cttimeout_net_exit netfilter: use get_random_u32 instead of prandom ==================== Link: https://lore.kernel.org/r/20220621085618.3975-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 2642cc6c3bbe0900ba15bab078fd15ad8baccbc5 Author: Lukas Wunner Date: Mon Jun 20 13:04:50 2022 +0200 net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode Simon reports that if two LAN9514 USB adapters are directly connected without an intermediate switch, the link fails to come up and link LEDs remain dark. The issue was introduced by commit 1ce8b37241ed ("usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling"). The PHY suffers from a known erratum wherein link detection becomes unreliable if Energy Detect Power-Down is used. In poll mode, the driver works around the erratum by briefly disabling EDPD for 640 msec to detect a neighbor, then re-enabling it to save power. In interrupt mode, no interrupt is signaled if EDPD is used by both link partners, so it must not be enabled at all. We'll recoup the power savings by enabling SUSPEND1 mode on affected LAN95xx chips in a forthcoming commit. Fixes: 1ce8b37241ed ("usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling") Reported-by: Simon Han Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/439a3f3168c2f9d44b5fd9bb8d2b551711316be6.1655714438.git.lukas@wunner.de Signed-off-by: Jakub Kicinski commit c0737fa9a5a5cf5a053bcc983f72d58919b997c6 Author: Pavel Begunkov Date: Wed Jun 22 00:00:37 2022 +0100 io_uring: fix double poll leak on repolling We have re-polling for partial IO, so a request can be polled twice. If it used two poll entries the first time then on the second io_arm_poll_handler() it will find the old apoll entry and NULL kmalloc()'ed second entry, i.e. apoll->double_poll, so leaking it. Fixes: 10c873334feba ("io_uring: allow re-poll if we made progress") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/fee2452494222ecc7f1f88c8fb659baef971414a.1655852245.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 9d2ad2947a53abf5e5e6527a9eeed50a3a4cbc72 Author: Pavel Begunkov Date: Wed Jun 22 00:00:36 2022 +0100 io_uring: fix wrong arm_poll error handling Leaving ip.error set when a request was punted to task_work execution is problematic, don't forget to clear it. Fixes: aa43477b04025 ("io_uring: poll rework") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/a6c84ef4182c6962380aebe11b35bdcb25b0ccfb.1655852245.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit c487a5ad48831afa6784b368ec40d0ee50f2fe1b Author: Pavel Begunkov Date: Wed Jun 22 00:00:35 2022 +0100 io_uring: fail links when poll fails Don't forget to cancel all linked requests of poll request when __io_arm_poll_handler() failed. Fixes: aa43477b04025 ("io_uring: poll rework") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/a78aad962460f9fdfe4aa4c0b62425c88f9415bc.1655852245.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a632b2a4c920ce5af29410fb091f7ee6d2e77dc6 Author: Anatolii Gerasymenko Date: Mon Jun 6 09:01:21 2022 +0200 ice: ethtool: Prohibit improper channel config for DCB Do not allow setting less channels, than Traffic Classes there are via ethtool. There must be at least one channel per Traffic Class. If you set less channels, than Traffic Classes there are, then during ice_vsi_rebuild there would be allocated only the requested amount of tx/rx rings in ice_vsi_alloc_arrays. But later in ice_vsi_setup_q_map there would be requested at least one channel per Traffic Class. This results in setting num_rxq > alloc_rxq and num_txq > alloc_txq. Later, there would be a NULL pointer dereference in ice_vsi_map_rings_to_vectors, because we go beyond of rx_rings or tx_rings arrays. Change ice_set_channels() to return error if you try to allocate less channels, than Traffic Classes there are. Change ice_vsi_setup_q_map() and ice_vsi_setup_q_map_mqprio() to return status code instead of void. Add error handling for ice_vsi_setup_q_map() and ice_vsi_setup_q_map_mqprio() in ice_vsi_init() and ice_vsi_cfg_tc(). [53753.889983] INFO: Flow control is disabled for this traffic class (0) on this vsi. [53763.984862] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 [53763.992915] PGD 14b45f5067 P4D 0 [53763.996444] Oops: 0002 [#1] SMP NOPTI [53764.000312] CPU: 12 PID: 30661 Comm: ethtool Kdump: loaded Tainted: GOE --------- - - 4.18.0-240.el8.x86_64 #1 [53764.011825] Hardware name: Intel Corporation WilsonCity/WilsonCity, BIOS WLYDCRB1.SYS.0020.P21.2012150710 12/15/2020 [53764.022584] RIP: 0010:ice_vsi_map_rings_to_vectors+0x7e/0x120 [ice] [53764.029089] Code: 41 0d 0f b7 b7 12 05 00 00 0f b6 d0 44 29 de 44 0f b7 c6 44 01 c2 41 39 d0 7d 2d 4c 8b 47 28 44 0f b7 ce 83 c6 01 4f 8b 04 c8 <49> 89 48 28 4 c 8b 89 b8 01 00 00 4d 89 08 4c 89 81 b8 01 00 00 44 [53764.048379] RSP: 0018:ff550dd88ea47b20 EFLAGS: 00010206 [53764.053884] RAX: 0000000000000002 RBX: 0000000000000004 RCX: ff385ea42fa4a018 [53764.061301] RDX: 0000000000000006 RSI: 0000000000000005 RDI: ff385e9baeedd018 [53764.068717] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000004 [53764.076133] R10: 0000000000000002 R11: 0000000000000004 R12: 0000000000000000 [53764.083553] R13: 0000000000000000 R14: ff385e658fdd9000 R15: ff385e9baeedd018 [53764.090976] FS: 000014872c5b5740(0000) GS:ff385e847f100000(0000) knlGS:0000000000000000 [53764.099362] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [53764.105409] CR2: 0000000000000028 CR3: 0000000a820fa002 CR4: 0000000000761ee0 [53764.112851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [53764.120301] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [53764.127747] PKRU: 55555554 [53764.130781] Call Trace: [53764.133564] ice_vsi_rebuild+0x611/0x870 [ice] [53764.138341] ice_vsi_recfg_qs+0x94/0x100 [ice] [53764.143116] ice_set_channels+0x1a8/0x3e0 [ice] [53764.147975] ethtool_set_channels+0x14e/0x240 [53764.152667] dev_ethtool+0xd74/0x2a10 [53764.156665] ? __mod_lruvec_state+0x44/0x110 [53764.161280] ? __mod_lruvec_state+0x44/0x110 [53764.165893] ? page_add_file_rmap+0x15/0x170 [53764.170518] ? inet_ioctl+0xd1/0x220 [53764.174445] ? netdev_run_todo+0x5e/0x290 [53764.178808] dev_ioctl+0xb5/0x550 [53764.182485] sock_do_ioctl+0xa0/0x140 [53764.186512] sock_ioctl+0x1a8/0x300 [53764.190367] ? selinux_file_ioctl+0x161/0x200 [53764.195090] do_vfs_ioctl+0xa4/0x640 [53764.199035] ksys_ioctl+0x60/0x90 [53764.202722] __x64_sys_ioctl+0x16/0x20 [53764.206845] do_syscall_64+0x5b/0x1a0 [53764.210887] entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: 87324e747fde ("ice: Implement ethtool ops for channels") Signed-off-by: Anatolii Gerasymenko Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 8a66487506161dbc1d22fd154d2de0244e232040 Author: Alison Schofield Date: Fri Feb 25 14:14:56 2022 -0800 cxl/mbox: Use __le32 in get,set_lsa mailbox structures CXL specification defines these as little endian. Fixes: 60b8f17215de ("cxl/pmem: Translate NVDIMM label commands to CXL label commands") Reported-by: Dan Williams Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/20220225221456.1025635-1-alison.schofield@intel.com Signed-off-by: Dan Williams commit 8ae3cebc1704b9a3ab8398dc7820c37183026bbc Author: Ben Widawsky Date: Fri Mar 4 13:36:45 2022 -0800 cxl/core: Use is_endpoint_decoder Save some characters and directly check decoder type rather than port type. There's no need to check if the port is an endpoint port since, by this point, cxl_endpoint_decoder_alloc() has a specified type. Reviewed by: Adam Manzanares Signed-off-by: Ben Widawsky Signed-off-by: Dan Williams commit db9a3a35d31ea337331f0e6e07e04bcd52642894 Author: Jonathan Cameron Date: Thu Jun 9 14:45:19 2022 +0100 cxl: Fix cleanup of port devices on failure to probe driver. The device is created, and then there is a check if a driver succesfully bound to it. In event of failing the bind (e.g. failure in cxl_port_probe()) the device is left registered. When a bus rescan later occurs, fresh devices are created leading to a multiple device representing the same underlying hardware. Bad things may follow and at very least we have far too many devices. Fix by ensuring autoremove is registered if the device create succeeds, but doesn't depend on sucessful binding to a driver. Bug was observed as side effect of incorrect ownership in [PATCH v9 6/9] cxl/port: Read CDAT table but will result from any failure to in cxl_port_probe(). Fixes: 8dd2bc0f8e02 ("cxl/mem: Add the cxl_mem driver") Signed-off-by: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/20220609134519.11668-1-Jonathan.Cameron@huawei.com Signed-off-by: Dan Williams commit c3d184c83ff4b80167e34edfc3d21df424bf27ff Author: Anatolii Gerasymenko Date: Mon Jun 20 09:47:05 2022 +0200 ice: ethtool: advertise 1000M speeds properly In current implementation ice_update_phy_type enables all link modes for selected speed. This approach doesn't work for 1000M speeds, because both copper (1000baseT) and optical (1000baseX) standards cannot be enabled at once. Fix this, by adding the function `ice_set_phy_type_from_speed()` for 1000M speeds. Fixes: 48cb27f2fd18 ("ice: Implement handlers for ethtool PHY/link operations") Signed-off-by: Anatolii Gerasymenko Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3748d2185ac4c2c6f80989672253aad909ecaf95 Author: Liang He Date: Tue Jun 21 23:41:25 2022 +0800 mips: lantiq: Add missing of_node_put() in irq.c In icu_of_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 3578dc90013b1fa20da996cdadd8515802716132 Author: Wojciech Drewek Date: Mon May 23 11:41:55 2022 +0200 ice: Fix switchdev rules book keeping Adding two filters with same matching criteria ends up with one rule in hardware with act = ICE_FWD_TO_VSI_LIST. In order to remove them properly we have to keep the information about vsi handle which is used in VSI bitmap (ice_adv_fltr_mgmt_list_entry::vsi_list_info::vsi_map). Fixes: 0d08a441fb1a ("ice: ndo_setup_tc implementation for PF") Reported-by: Sridhar Samudrala Signed-off-by: Wojciech Drewek Tested-by: Sandeep Penigalapati Signed-off-by: Tony Nguyen commit f6f0dab5efe4fcabe726f9218a0b3000fee0fa8a Author: Ben Widawsky Date: Fri May 20 11:00:59 2022 -0700 MAINTAINERS: Update Ben's email address I'm leaving Intel. Update email address to korg and add .mailmap entries. For now, I will be taking a reduced role in CXL development, but I still plan to spend time working on it, and I can still serve as a good substitute if needed for maintainer responsibilities (that may change in the future). Signed-off-by: Ben Widawsky Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/20220520180059.632054-1-bwidawsk@kernel.org Signed-off-by: Dan Williams commit 202773260023b56e868d09d13d3a417028f1ff5b Author: Dmitry Osipenko Date: Fri Jun 17 15:24:02 2022 +0300 PM: hibernate: Use kernel_can_power_off() Use new kernel_can_power_off() API instead of legacy pm_power_off global variable to fix regressed hibernation to disk where machine no longer powers off when it should because ACPI power driver transitioned to the new sys-off based API and it doesn't use pm_power_off anymore. Fixes: 98f30d0ecf79 ("ACPI: power: Switch to sys-off handler API") Tested-by: Ken Moffat Reported-by: Ken Moffat Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit d4ea6f6373ef56d1d795a24f1f5874f4a6019199 Author: Marcin Szycik Date: Mon May 9 21:01:18 2022 +0200 ice: ignore protocol field in GTP offload Commit 34a897758efe ("ice: Add support for inner etype in switchdev") added the ability to match on inner ethertype. A side effect of that change is that it is now impossible to add some filters for protocols which do not contain inner ethtype field. tc requires the protocol field to be specified when providing certain other options, e.g. src_ip. This is a problem in case of GTP - when user wants to specify e.g. src_ip, they also need to specify protocol in tc command (otherwise tc fails with: Illegal "src_ip"). Because GTP is a tunnel, the protocol field is treated as inner protocol. GTP does not contain inner ethtype field and the filter cannot be added. To fix this, ignore the ethertype field in case of GTP filters. Fixes: 9a225f81f540 ("ice: Support GTP-U and GTP-C offload in switchdev") Signed-off-by: Marcin Szycik Tested-by: Sandeep Penigalapati Signed-off-by: Tony Nguyen commit 78ccef91234ba331c04d71f3ecb1377451d21056 Author: Mike Snitzer Date: Tue Jun 21 13:37:06 2022 -0400 dm: do not return early from dm_io_complete if BLK_STS_AGAIN without polling Commit 5291984004edf ("dm: fix bio polling to handle possibile BLK_STS_AGAIN") inadvertently introduced an early return from dm_io_complete() without first queueing the bio to DM if BLK_STS_AGAIN occurs and bio-polling is _not_ being used. Fix this by only returning early from dm_io_complete() if the bio has first been properly queued to DM. Otherwise, the bio will never finish via bio_endio. Fixes: 5291984004edf ("dm: fix bio polling to handle possibile BLK_STS_AGAIN") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 9ae6e8b1c9bbf6874163d1243e393137313762b7 Author: Nikos Tsironis Date: Tue Jun 21 15:24:03 2022 +0300 dm era: commit metadata in postsuspend after worker stops During postsuspend dm-era does the following: 1. Archives the current era 2. Commits the metadata, as part of the RPC call for archiving the current era 3. Stops the worker Until the worker stops, it might write to the metadata again. Moreover, these writes are not flushed to disk immediately, but are cached by the dm-bufio client, which writes them back asynchronously. As a result, the committed metadata of a suspended dm-era device might not be consistent with the in-core metadata. In some cases, this can result in the corruption of the on-disk metadata. Suppose the following sequence of events: 1. Load a new table, e.g. a snapshot-origin table, to a device with a dm-era table 2. Suspend the device 3. dm-era commits its metadata, but the worker does a few more metadata writes until it stops, as part of digesting an archived writeset 4. These writes are cached by the dm-bufio client 5. Load the dm-era table to another device. 6. The new instance of the dm-era target loads the committed, on-disk metadata, which don't include the extra writes done by the worker after the metadata commit. 7. Resume the new device 8. The new dm-era target instance starts using the metadata 9. Resume the original device 10. The destructor of the old dm-era target instance is called and destroys the dm-bufio client, which results in flushing the cached writes to disk 11. These writes might overwrite the writes done by the new dm-era instance, hence corrupting its metadata. Fix this by committing the metadata after the worker stops running. stop_worker uses flush_workqueue to flush the current work. However, the work item may re-queue itself and flush_workqueue doesn't wait for re-queued works to finish. This could result in the worker changing the metadata after they have been committed, or writing to the metadata concurrently with the commit in the postsuspend thread. Use drain_workqueue instead, which waits until the work and all re-queued works finish. Fixes: eec40579d8487 ("dm: add era target") Cc: stable@vger.kernel.org # v3.15+ Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit ca1fdab7fd27eb069df1384b2850dcd0c2bebe8d Merge: 0273fd423b2fe aa6d1ed107eba Author: Linus Torvalds Date: Tue Jun 21 12:20:11 2022 -0500 Merge tag 'efi-urgent-for-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - remove pointless include of asm/efi.h, which does not exist on ia64 - fix DXE service marshalling prototype for mixed mode * tag 'efi-urgent-for-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/x86: libstub: Fix typo in __efi64_argmap* name efi: sysfb_efi: remove unnecessary include commit 0273fd423b2fe10af96ff713273137c63a7736c0 Merge: ff872b76b3d89 3cde3174eb910 Author: Linus Torvalds Date: Tue Jun 21 12:13:53 2022 -0500 Merge tag 'certs-20220621' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull signature checking selftest from David Howells: "The signature checking code, as used by module signing, kexec, etc., is non-FIPS compliant as there is no selftest. For a kernel to be FIPS-compliant, signature checking would have to be tested before being used, and the box would need to panic if it's not available (probably reasonable as simply disabling signature checking would prevent you from loading any driver modules). Deal with this by adding a minimal test. This is split into two patches: the first moves load_certificate_list() to the same place as the X.509 code to make it more accessible internally; the second adds a selftest" * tag 'certs-20220621' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: certs: Add FIPS selftests certs: Move load_certificate_list() to be with the asymmetric keys code commit ff872b76b3d89a09a997cc45c133e4a3ddc12f90 Merge: cb78d1b5efffe e3a4167c880cf Author: Linus Torvalds Date: Tue Jun 21 12:06:04 2022 -0500 Merge tag 'for-5.19-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - print more error messages for invalid mount option values - prevent remount with v1 space cache for subpage filesystem - fix hang during unmount when block group reclaim task is running * tag 'for-5.19-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: add error messages to all unrecognized mount options btrfs: prevent remounting to v1 space cache for subpage mount btrfs: fix hang during unmount when block group reclaim task is running commit 2645672ffe21f0a1c139bfbc05ad30fd4e4f2583 Author: Jens Axboe Date: Tue Jun 21 10:03:57 2022 -0600 block: pop cached rq before potentially blocking rq_qos_throttle() If rq_qos_throttle() ends up blocking, then we will have invalidated and flushed our current plug. Since blk_mq_get_cached_request() hasn't popped the cached request off the plug list just yet, we end holding a pointer to a request that is no longer valid. This insta-crashes with rq->mq_hctx being NULL in the validity checks just after. Pop the request off the cached list before doing rq_qos_throttle() to avoid using a potentially stale request. Fixes: 0a5aa8d161d1 ("block: fix blk_mq_attempt_bio_merge and rq_qos_throttle protection") Reported-by: Dylan Yudaken Tested-by: Dylan Yudaken Signed-off-by: Jens Axboe commit cb78d1b5efffe4cf97e16766329dd7358aed3deb Author: David Howells Date: Tue Jun 21 15:59:57 2022 +0100 afs: Fix dynamic root getattr The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd. Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr(). This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like: BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:afs_getattr+0x8b/0x14b ... Call Trace: vfs_statx+0x79/0xf5 vfs_fstatat+0x49/0x62 Fixes: 2aeb8c86d499 ("afs: Fix afs_getattr() to refetch file status if callback break occurred") Reported-by: Marc Dionne Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/165408450783.1031787.7941404776393751186.stgit@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit aa6d1ed107eba26f49933216cffe797253914132 Author: Evgeniy Baskov Date: Thu Jun 9 14:37:30 2022 +0300 efi/x86: libstub: Fix typo in __efi64_argmap* name The actual name of the DXE services function used is set_memory_space_attributes(), not set_memory_space_descriptor(). Change EFI mixed mode helper macro name to match the function name. Fixes: 31f1a0edff78 ("efi/x86: libstub: Make DXE calls mixed mode safe") Signed-off-by: Evgeniy Baskov Signed-off-by: Ard Biesheuvel commit 34705a57e7df97d161324263c103c4d4d120dfe7 Author: Javier Martinez Canillas Date: Fri Jun 10 11:00:05 2022 +0200 efi: sysfb_efi: remove unnecessary include Nothing defined in the header is used by drivers/firmware/efi/sysfb_efi.c but also, including it can lead to build errors when built on arches that don't have an asm/efi.h header file. This can happen for example if a driver that is built when COMPILE_TEST is enabled selects the SYSFB symbol, e.g. on powerpc with allyesconfig: drivers/firmware/efi/sysfb_efi.c:29:10: fatal error: asm/efi.h: No such file or directory 29 | #include | ^~~~~~~~~~~ Reported-by: Stephen Rothwell Signed-off-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit 82c7863ed95d0914f02c7c8c011200a763bc6725 Author: Jaegeuk Kim Date: Sat Jun 18 00:42:24 2022 -0700 f2fs: do not count ENOENT for error case Otherwise, we can get a wrong cp_error mark. Cc: Fixes: a7b8618aa2f0 ("f2fs: avoid infinite loop to flush node pages") Signed-off-by: Jaegeuk Kim commit db30dc1a5226eb74d52f748989e9a06451333678 Author: Aidan MacDonald Date: Fri Jun 17 13:18:05 2022 +0100 mips: dts: ingenic: Add TCU clock to x1000/x1830 tcu device node This clock is a gate for the TCU hardware block on these SoCs, but it wasn't included in the device tree since the ingenic-tcu driver erroneously did not request it. Reviewed-by: Paul Cercueil Signed-off-by: Aidan MacDonald Signed-off-by: Thomas Bogendoerfer commit 3cde3174eb910513d32a9ec8a9b95ea59be833df Author: David Howells Date: Wed May 18 17:15:34 2022 +0100 certs: Add FIPS selftests Add some selftests for signature checking when FIPS mode is enabled. These need to be done before we start actually using the signature checking for things and must panic the kernel upon failure. Note that the tests must not check the blacklist lest this provide a way to prevent a kernel from booting by installing a hash of a test key in the appropriate UEFI table. Reported-by: Simo Sorce Signed-off-by: David Howells Reviewed-by: Simo Sorce Reviewed-by: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org Link: https://lore.kernel.org/r/165515742832.1554877.2073456606206090838.stgit@warthog.procyon.org.uk/ commit 60050ffe3d770dd1df5b641aa48f49d07a54bd84 Author: David Howells Date: Wed May 18 23:48:09 2022 +0100 certs: Move load_certificate_list() to be with the asymmetric keys code Move load_certificate_list(), which loads a series of binary X.509 certificates from a blob and inserts them as keys into a keyring, to be with the asymmetric keys code that it drives. This makes it easier to add FIPS selftest code in which we need to load up a private keyring for the tests to use. Signed-off-by: David Howells Reviewed-by: Simo Sorce Reviewed-by: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org Link: https://lore.kernel.org/r/165515742145.1554877.13488098107542537203.stgit@warthog.procyon.org.uk/ commit eb9e9bc4fa5fb489c92ec588b3fb35f042ba6d86 Author: Liang He Date: Sun Jun 19 12:54:27 2022 +0800 mips/pic32/pic32mzda: Fix refcount leak bugs of_find_matching_node(), of_find_compatible_node() and of_find_node_by_path() will return node pointers with refcout incremented. We should call of_node_put() when they are not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 76695592711ef1e215cc24ed3e1cd857d7fc3098 Author: Liang He Date: Fri Jun 17 20:25:05 2022 +0800 mips: lantiq: xway: Fix refcount leak bug in sysctrl In ltq_soc_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 72a2af539fff975caadd9a4db3f99963569bd9c9 Author: Liang He Date: Fri Jun 17 20:19:58 2022 +0800 mips: lantiq: falcon: Fix refcount leak bug in sysctrl In ltq_soc_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 48ca54e39173d1ed4c4dc8cf045484014bb26eaf Author: Liang He Date: Fri Jun 17 11:39:29 2022 +0800 mips: ralink: Fix refcount leak in of.c In plat_of_remap_node(), plat_of_remap_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 608d94cb84c42585058d692f2fe5d327f8868cdb Author: Liang He Date: Thu Jun 16 22:27:56 2022 +0800 mips: mti-malta: Fix refcount leak in malta-time.c In update_gic_frequency_dt(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit 4becf6417bbdc293734a590fe4ed38437bbcea2c Author: Liang He Date: Wed Jun 15 22:11:23 2022 +0800 arch: mips: generic: Add missing of_node_put() in board-ranchu.c In ranchu_measure_hpt_freq(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_put_node() when it is not used anymore. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer commit c81aba8fde2aee4f5778ebab3a1d51bd2ef48e4c Author: huhai Date: Fri Jun 10 19:14:20 2022 +0800 MIPS: Remove repetitive increase irq_err_count commit 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") added a function irq_dispatch, and it'll increase irq_err_count when the get_irq callback returns a negative value, but increase irq_err_count in get_irq was not removed. And also, modpost complains once gpio-vr41xx drivers become modules. ERROR: modpost: "irq_err_count" [drivers/gpio/gpio-vr41xx.ko] undefined! So it would be a good idea to remove repetitive increase irq_err_count in get_irq callback. Fixes: 27fdd325dace ("MIPS: Update VR41xx GPIO driver to use gpiolib") Fixes: 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") Reported-by: k2ci Signed-off-by: huhai Signed-off-by: Genjian Zhang Signed-off-by: Thomas Bogendoerfer commit ca6969013d13282b42cb5edcc13db731a08e0ad8 Author: Oleksandr Tyshchenko Date: Mon May 9 16:51:43 2022 +0300 drm/xen: Add missing VM_DONTEXPAND flag in mmap callback With Xen PV Display driver in use the "expected" VM_DONTEXPAND flag is not set (neither explicitly nor implicitly), so the driver hits the code path in drm_gem_mmap_obj() which triggers the WARNING. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Oleksandr Andrushchenko Link: https://lore.kernel.org/r/1652104303-5098-1-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit ecb6237fa397b7b810d798ad19322eca466dbab1 Author: Julien Grall Date: Fri Jun 17 11:30:37 2022 +0100 x86/xen: Remove undefined behavior in setup_features() 1 << 31 is undefined. So switch to 1U << 31. Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") Signed-off-by: Julien Grall Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220617103037.57828-1-julien@xen.org Signed-off-by: Juergen Gross commit f9710c357e5bbf64d7ce45ba0bc75a52222491c1 Author: Jason Andryuk Date: Wed Jun 1 15:53:41 2022 -0400 xen-blkfront: Handle NULL gendisk When a VBD is not fully created and then closed, the kernel can have a NULL pointer dereference: The reproducer is trivial: [user@dom0 ~]$ sudo xl block-attach work backend=sys-usb vdev=xvdi target=/dev/sdz [user@dom0 ~]$ xl block-list work Vdev BE handle state evt-ch ring-ref BE-path 51712 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51712 51728 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51728 51744 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51744 51760 0 241 4 -1 -1 /local/domain/0/backend/vbd/241/51760 51840 3 241 3 -1 -1 /local/domain/3/backend/vbd/241/51840 ^ note state, the /dev/sdz doesn't exist in the backend [user@dom0 ~]$ sudo xl block-detach work xvdi [user@dom0 ~]$ xl block-list work Vdev BE handle state evt-ch ring-ref BE-path work is an invalid domain identifier And its console has: BUG: kernel NULL pointer dereference, address: 0000000000000050 PGD 80000000edebb067 P4D 80000000edebb067 PUD edec2067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 52 Comm: xenwatch Not tainted 5.16.18-2.43.fc32.qubes.x86_64 #1 RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40 Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48 RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293 RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8 R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000 R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00 FS: 0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0 Call Trace: blkback_changed+0x95/0x137 [xen_blkfront] ? read_reply+0x160/0x160 xenwatch_thread+0xc0/0x1a0 ? do_wait_intr_irq+0xa0/0xa0 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device snd_timer snd soundcore ipt_REJECT nf_reject_ipv4 xt_state xt_conntrack nft_counter nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables nfnetlink intel_rapl_msr intel_rapl_common crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel xen_netfront pcspkr xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn ipmi_devintf ipmi_msghandler fuse bpf_preload ip_tables overlay xen_blkfront CR2: 0000000000000050 ---[ end trace 7bc9597fd06ae89d ]--- RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40 Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48 RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293 RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8 R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000 R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00 FS: 0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled info->rq and info->gd are only set in blkfront_connect(), which is called for state 4 (XenbusStateConnected). Guard against using NULL variables in blkfront_closing() to avoid the issue. The rest of blkfront_closing looks okay. If info->nr_rings is 0, then for_each_rinfo won't do anything. blkfront_remove also needs to check for non-NULL pointers before cleaning up the gendisk and request queue. Fixes: 05d69d950d9d "xen-blkfront: sanitize the removal state machine" Reported-by: Marek Marczykowski-Górecki Signed-off-by: Jason Andryuk Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220601195341.28581-1-jandryuk@gmail.com Signed-off-by: Juergen Gross commit 9ef165406308515dcf2e3f6e97b39a1c56d86db5 Author: Andy Shevchenko Date: Mon Jun 20 13:43:16 2022 +0300 usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC Intel SoC PMIC is a generic name for all PMICs that are used on Intel platforms. In particular, INTEL_SOC_PMIC kernel configuration option refers to Crystal Cove PMIC, which has never been a part of any Intel Broxton hardware. Drop wrong dependency from Kconfig. Note, the correct dependency is satisfied via ACPI PMIC OpRegion driver, which the Type-C depends on. Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Reported-by: Hans de Goede Reviewed-by: Guenter Roeck Reviewed-by: Heikki Krogerus Reviewed-by: Hans de Goede Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220620104316.57592-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 96163f835e65f8c9897487fac965819f0651d671 Author: Dan Vacura Date: Fri Jun 17 11:31:53 2022 -0500 usb: gadget: uvc: fix list double add in uvcg_video_pump A panic can occur if the endpoint becomes disabled and the uvcg_video_pump adds the request back to the req_free list after it has already been queued to the endpoint. The endpoint complete will add the request back to the req_free list. Invalidate the local request handle once it's been queued. <6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0) <3>[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90. <6>[ 246.797213][ T26] ------------[ cut here ]------------ <2>[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31! <6>[ 246.807073][ T26] Call trace: <6>[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c <6>[ 246.807366][ T26] process_one_work+0x2a4/0x544 <6>[ 246.807394][ T26] worker_thread+0x350/0x784 <6>[ 246.807442][ T26] kthread+0x2ac/0x320 Fixes: f9897ec0f6d3 ("usb: gadget: uvc: only pump video data if necessary") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220617163154.16621-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman commit 9faa1c8f92f33daad9db96944139de225cefa199 Author: Geert Uytterhoeven Date: Wed Jun 15 15:53:09 2022 +0200 dt-bindings: usb: ehci: Increase the number of PHYs "make dtbs_check": arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee080100: phys: [[17, 0], [31]] is too long From schema: Documentation/devicetree/bindings/usb/generic-ehci.yaml arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee0c0100: phys: [[17, 1], [33], [21, 0]] is too long From schema: Documentation/devicetree/bindings/usb/generic-ehci.yaml Some USB EHCI controllers (e.g. on the Renesas RZ/G1C SoC) have multiple PHYs. Increase the maximum number of PHYs to 3, which is sufficient for now. Fixes: 0499220d6dadafa5 ("dt-bindings: Add missing array size constraints") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/c5d19e2f9714f43effd90208798fc1936098078f.1655301043.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 0f074c1c95ea496dc91279b6c4b9845a337517fa Author: Geert Uytterhoeven Date: Wed Jun 15 15:54:02 2022 +0200 dt-bindings: usb: ohci: Increase the number of PHYs "make dtbs_check": arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee080000: phys: [[17, 0], [31]] is too long From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml arch/arm/boot/dts/r8a77470-iwg23s-sbc.dtb: usb@ee0c0000: phys: [[17, 1], [33], [21, 0]] is too long From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml Some USB OHCI controllers (e.g. on the Renesas RZ/G1C SoC) have multiple PHYs. Increase the maximum number of PHYs to 3, which is sufficient for now. Fixes: 0499220d6dadafa5 ("dt-bindings: Add missing array size constraints") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/0112f9c8881513cb33bf7b66bc743dd08b35a2f5.1655301203.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit aacf2f9f382c91df73f33317e28a4c34c8038986 Author: Pavel Begunkov Date: Tue Jun 21 13:25:06 2022 +0100 io_uring: fix req->apoll_events apoll_events should be set once in the beginning of poll arming just as poll->events and not change after. However, currently io_uring resets it on each __io_poll_execute() for no clear reason. There is also a place in __io_arm_poll_handler() where we add EPOLLONESHOT to downgrade a multishot, but forget to do the same thing with ->apoll_events, which is buggy. Fixes: 81459350d581e ("io_uring: cache req->apoll->events in req->cflags") Signed-off-by: Pavel Begunkov Reviewed-by: Hao Xu Link: https://lore.kernel.org/r/0aef40399ba75b1a4d2c2e85e6e8fd93c02fc6e4.1655814213.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b60cac14bb3c88cff2a7088d9095b01a80938c41 Author: Jens Axboe Date: Tue Jun 21 07:47:13 2022 -0600 io_uring: fix merge error in checking send/recv addr2 flags With the dropping of the IOPOLL checking in the per-opcode handlers, we inadvertently left two checks in the recv/recvmsg and send/sendmsg prep handlers for the same thing, and one of them includes addr2 which holds the flags for these opcodes. Fix it up and kill the redundant checks. Signed-off-by: Jens Axboe commit 037e127452b973f45b34c1e88a1af183e652e657 Author: David Sterba Date: Tue Jun 14 15:27:48 2022 +0200 Documentation: update btrfs list of features and link to readthedocs.io The btrfs documentation in kernel is only meant as a starting point, so update the list of features and add link to btrfs.readthedocs.io page that is most up-to-date. The wiki is still used but information is migrated from there. Signed-off-by: David Sterba commit bf7ba8ee759b7b7a34787ddd8dc3f190a3d7fa24 Author: Josef Bacik Date: Mon Jun 13 15:09:49 2022 -0400 btrfs: fix deadlock with fsync+fiemap+transaction commit We are hitting the following deadlock in production occasionally Task 1 Task 2 Task 3 Task 4 Task 5 fsync(A) start trans start commit falloc(A) lock 5m-10m start trans wait for commit fiemap(A) lock 0-10m wait for 5m-10m (have 0-5m locked) have btrfs_need_log_full_commit !full_sync wait_ordered_extents finish_ordered_io(A) lock 0-5m DEADLOCK We have an existing dependency of file extent lock -> transaction. However in fsync if we tried to do the fast logging, but then had to fall back to committing the transaction, we will be forced to call btrfs_wait_ordered_range() to make sure all of our extents are updated. This creates a dependency of transaction -> file extent lock, because btrfs_finish_ordered_io() will need to take the file extent lock in order to run the ordered extents. Fix this by stopping the transaction if we have to do the full commit and we attempted to do the fast logging. Then attach to the transaction and commit it if we need to. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 97e86631bccddfbbe0c13f9a9605cdef11d31296 Author: Zygo Blaxell Date: Wed Jun 8 22:39:36 2022 -0400 btrfs: don't set lock_owner when locking extent buffer for reading In 196d59ab9ccc "btrfs: switch extent buffer tree lock to rw_semaphore" the functions for tree read locking were rewritten, and in the process the read lock functions started setting eb->lock_owner = current->pid. Previously lock_owner was only set in tree write lock functions. Read locks are shared, so they don't have exclusive ownership of the underlying object, so setting lock_owner to any single value for a read lock makes no sense. It's mostly harmless because write locks and read locks are mutually exclusive, and none of the existing code in btrfs (btrfs_init_new_buffer and print_eb_refs_lock) cares what nonsense is written in lock_owner when no writer is holding the lock. KCSAN does care, and will complain about the data race incessantly. Remove the assignments in the read lock functions because they're useless noise. Fixes: 196d59ab9ccc ("btrfs: switch extent buffer tree lock to rw_semaphore") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Nikolay Borisov Reviewed-by: Filipe Manana Signed-off-by: Zygo Blaxell Signed-off-by: David Sterba commit 19ab78ca86981e0e1e73036fb73a508731a7c078 Author: Naohiro Aota Date: Tue Jun 7 16:08:30 2022 +0900 btrfs: zoned: fix critical section of relocation inode writeback We use btrfs_zoned_data_reloc_{lock,unlock} to allow only one process to write out to the relocation inode. That critical section must include all the IO submission for the inode. However, flush_write_bio() in extent_writepages() is out of the critical section, causing an IO submission outside of the lock. This leads to an out of the order IO submission and fail the relocation process. Fix it by extending the critical section. Fixes: 35156d852762 ("btrfs: zoned: only allow one process to add pages to a relocation inode") CC: stable@vger.kernel.org # 5.16+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 343d8a30851c48a4ef0f5ef61d5e9fbd847a6883 Author: Naohiro Aota Date: Tue Jun 7 16:08:29 2022 +0900 btrfs: zoned: prevent allocation from previous data relocation BG After commit 5f0addf7b890 ("btrfs: zoned: use dedicated lock for data relocation"), we observe IO errors on e.g, btrfs/232 like below. [09.0][T4038707] WARNING: CPU: 3 PID: 4038707 at fs/btrfs/extent-tree.c:2381 btrfs_cross_ref_exist+0xfc/0x120 [btrfs] [09.9][T4038707] Call Trace: [09.5][T4038707] [09.3][T4038707] run_delalloc_nocow+0x7f1/0x11a0 [btrfs] [09.6][T4038707] ? test_range_bit+0x174/0x320 [btrfs] [09.2][T4038707] ? fallback_to_cow+0x980/0x980 [btrfs] [09.3][T4038707] ? find_lock_delalloc_range+0x33e/0x3e0 [btrfs] [09.5][T4038707] btrfs_run_delalloc_range+0x445/0x1320 [btrfs] [09.2][T4038707] ? test_range_bit+0x320/0x320 [btrfs] [09.4][T4038707] ? lock_downgrade+0x6a0/0x6a0 [09.2][T4038707] ? orc_find.part.0+0x1ed/0x300 [09.5][T4038707] ? __module_address.part.0+0x25/0x300 [09.0][T4038707] writepage_delalloc+0x159/0x310 [btrfs] [09.4][ C3] sd 10:0:1:0: [sde] tag#2620 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [09.5][ C3] sd 10:0:1:0: [sde] tag#2620 Sense Key : Illegal Request [current] [09.9][ C3] sd 10:0:1:0: [sde] tag#2620 Add. Sense: Unaligned write command [09.5][ C3] sd 10:0:1:0: [sde] tag#2620 CDB: Write(16) 8a 00 00 00 00 00 02 f3 63 87 00 00 00 2c 00 00 [09.4][ C3] critical target error, dev sde, sector 396041272 op 0x1:(WRITE) flags 0x800 phys_seg 3 prio class 0 [09.9][ C3] BTRFS error (device dm-1): bdev /dev/mapper/dml_102_2 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0 The IO errors occur when we allocate a regular extent in previous data relocation block group. On zoned btrfs, we use a dedicated block group to relocate a data extent. Thus, we allocate relocating data extents (pre-alloc) only from the dedicated block group and vice versa. Once the free space in the dedicated block group gets tight, a relocating extent may not fit into the block group. In that case, we need to switch the dedicated block group to the next one. Then, the previous one is now freed up for allocating a regular extent. The BG is already not enough to allocate the relocating extent, but there is still room to allocate a smaller extent. Now the problem happens. By allocating a regular extent while nocow IOs for the relocation is still on-going, we will issue WRITE IOs (for relocation) and ZONE APPEND IOs (for the regular writes) at the same time. That mixed IOs confuses the write pointer and arises the unaligned write errors. This commit introduces a new bit 'zoned_data_reloc_ongoing' to the btrfs_block_group. We set this bit before releasing the dedicated block group, and no extent are allocated from a block group having this bit set. This bit is similar to setting block_group->ro, but is different from it by allowing nocow writes to start. Once all the nocow IO for relocation is done (hooked from btrfs_finish_ordered_io), we reset the bit to release the block group for further allocation. Fixes: c2707a255623 ("btrfs: zoned: add a dedicated data relocation block group") CC: stable@vger.kernel.org # 5.16+ Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit 650c9caba32a0167a018cca0fab32a2965d23513 Author: Filipe Manana Date: Mon Jun 6 10:41:19 2022 +0100 btrfs: do not BUG_ON() on failure to migrate space when replacing extents At btrfs_replace_file_extents(), if we fail to migrate reserved metadata space from the transaction block reserve into the local block reserve, we trigger a BUG_ON(). This is because it should not be possible to have a failure here, as we reserved more space when we started the transaction than the space we want to migrate. However having a BUG_ON() is way too drastic, we can perfectly handle the failure and return the error to the caller. So just do that instead, and add a WARN_ON() to make it easier to notice the failure if it ever happens (which is particularly useful for fstests, and the warning will trigger a failure of a test case). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 983d8209c6803345c9958f4cc358d1155f93a099 Author: Filipe Manana Date: Mon Jun 6 10:41:18 2022 +0100 btrfs: add missing inode updates on each iteration when replacing extents When replacing file extents, called during fallocate, hole punching, clone and deduplication, we may not be able to replace/drop all the target file extent items with a single transaction handle. We may get -ENOSPC while doing it, in which case we release the transaction handle, balance the dirty pages of the btree inode, flush delayed items and get a new transaction handle to operate on what's left of the target range. By dropping and replacing file extent items we have effectively modified the inode, so we should bump its iversion and update its mtime/ctime before we update the inode item. This is because if the transaction we used for partially modifying the inode gets committed by someone after we release it and before we finish the rest of the range, a power failure happens, then after mounting the filesystem our inode has an outdated iversion and mtime/ctime, corresponding to the values it had before we changed it. So add the missing iversion and mtime/ctime updates. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit d4597898ba7b9d467b94a9aafd65ec408a75041f Author: Filipe Manana Date: Mon Jun 6 10:41:17 2022 +0100 btrfs: fix race between reflinking and ordered extent completion While doing a reflink operation, if an ordered extent for a file range that does not overlap with the source and destination ranges of the reflink operation happens, we can end up having a failure in the reflink operation and return -EINVAL to user space. The following sequence of steps explains how this can happen: 1) We have the page at file offset 315392 dirty (under delalloc); 2) A reflink operation for this file starts, using the same file as both source and destination, the source range is [372736, 409600) (length of 36864 bytes) and the destination range is [208896, 245760); 3) At btrfs_remap_file_range_prep(), we flush all delalloc in the source and destination ranges, and wait for any ordered extents in those range to complete; 4) Still at btrfs_remap_file_range_prep(), we then flush all delalloc in the inode, but we neither wait for it to complete nor any ordered extents to complete. This results in starting delalloc for the page at file offset 315392 and creating an ordered extent for that single page range; 5) We then move to btrfs_clone() and enter the loop to find file extent items to copy from the source range to destination range; 6) In the first iteration we end up at last file extent item stored in leaf A: (...) item 131 key (143616 108 315392) itemoff 5101 itemsize 53 extent data disk bytenr 1903988736 nr 73728 extent data offset 12288 nr 61440 ram 73728 This represents the file range [315392, 376832), which overlaps with the source range to clone. @datal is set to 61440, key.offset is 315392 and @next_key_min_offset is therefore set to 376832 (315392 + 61440). @off (372736) is > key.offset (315392), so @new_key.offset is set to the value of @destoff (208896). @new_key.offset == @last_dest_end (208896) so @drop_start is set to 208896 (@new_key.offset). @datal is adjusted to 4096, as @off is > @key.offset. So in this iteration we call btrfs_replace_file_extents() for the range [208896, 212991] (a single page, which is [@drop_start, @new_key.offset + @datal - 1]). @last_dest_end is set to 212992 (@new_key.offset + @datal = 208896 + 4096 = 212992). Before the next iteration of the loop, @key.offset is set to the value 376832, which is @next_key_min_offset; 7) On the second iteration btrfs_search_slot() leaves us again at leaf A, but this time pointing beyond the last slot of leaf A, as that's where a key with offset 376832 should be at if it existed. So end up calling btrfs_next_leaf(); 8) btrfs_next_leaf() releases the path, but before it searches again the tree for the next key/leaf, the ordered extent for the single page range at file offset 315392 completes. That results in trimming the file extent item we processed before, adjusting its key offset from 315392 to 319488, reducing its length from 61440 to 57344 and inserting a new file extent item for that single page range, with a key offset of 315392 and a length of 4096. Leaf A now looks like: (...) item 132 key (143616 108 315392) itemoff 4995 itemsize 53 extent data disk bytenr 1801666560 nr 4096 extent data offset 0 nr 4096 ram 4096 item 133 key (143616 108 319488) itemoff 4942 itemsize 53 extent data disk bytenr 1903988736 nr 73728 extent data offset 16384 nr 57344 ram 73728 9) When btrfs_next_leaf() returns, it gives us a path pointing to leaf A at slot 133, since it's the first key that follows what was the last key we saw (143616 108 315392). In fact it's the same item we processed before, but its key offset was changed, so it counts as a new key; 10) So now we have: @key.offset == 319488 @datal == 57344 @off (372736) is > key.offset (319488), so @new_key.offset is set to 208896 (@destoff value). @new_key.offset (208896) != @last_dest_end (212992), so @drop_start is set to 212992 (@last_dest_end value). @datal is adjusted to 4096 because @off > @key.offset. So in this iteration we call btrfs_replace_file_extents() for the invalid range of [212992, 212991] (which is [@drop_start, @new_key.offset + @datal - 1]). This range is empty, the end offset is smaller than the start offset so btrfs_replace_file_extents() returns -EINVAL, which we end up returning to user space and fail the reflink operation. This all happens because the range of this file extent item was already processed in the previous iteration. This scenario can be triggered very sporadically by fsx from fstests, for example with test case generic/522. So fix this by having btrfs_clone() skip file extent items that cover a file range that we have already processed. CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 36a38c53b4ee51b90566f8f44a613601eb31a10e Author: Takashi Iwai Date: Tue Jun 21 14:00:44 2022 +0200 ALSA: hda: Fix discovery of i915 graphics PCI device It's been reported that the recent fix for skipping the component-binding with D-GPU caused a regression on some systems; it resulted in the completely missing component binding with i915 GPU. The problem was the use of pci_get_class() function. It matches with the full PCI class bits, while we want to match only partially the PCI base class bits. So, when a system has an i915 graphics device with the PCI class 0380, it won't hit because we're looking for only the PCI class 0300. This patch fixes i915_gfx_present() to look up each PCI device and match with PCI base class explicitly instead of pci_get_class(). Fixes: c9db8a30d9f0 ("ALSA: hda/i915 - skip acomp init if no matching display") Reviewed-by: Kai Vehmanen Tested-by: Kai Vehmanen Cc: Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1200611 Link: https://lore.kernel.org/r/87bkunztec.wl-tiwai@suse.de Link: https://lore.kernel.org/r/20220621120044.11573-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f2d8c2606825317b77db1f9ba0fc26ef26160b30 Author: Alan Stern Date: Mon Jun 13 10:17:03 2022 -0400 usb: gadget: Fix non-unique driver names in raw-gadget driver In a report for a separate bug (which has already been fixed by commit 5f0b5f4d50fa "usb: gadget: fix race when gadget driver register via ioctl") in the raw-gadget driver, the syzbot console log included error messages caused by attempted registration of a new driver with the same name as an existing driver: > kobject_add_internal failed for raw-gadget with -EEXIST, don't try to register things with the same name in the same directory. > UDC core: USB Raw Gadget: driver registration failed: -17 > misc raw-gadget: fail, usb_gadget_register_driver returned -17 These errors arise because raw_gadget.c registers a separate UDC driver for each of the UDC instances it creates, but these drivers all have the same name: "raw-gadget". Until recently this wasn't a problem, but when the "gadget" bus was added and UDC drivers were registered on this bus, it became possible for name conflicts to cause the registrations to fail. The reason is simply that the bus code in the driver core uses the driver name as a sysfs directory name (e.g., /sys/bus/gadget/drivers/raw-gadget/), and you can't create two directories with the same pathname. To fix this problem, the driver names used by raw-gadget are made distinct by appending a unique ID number: "raw-gadget.N", with a different value of N for each driver instance. And to avoid the proliferation of error handling code in the raw_ioctl_init() routine, the error return paths are refactored into the common pattern (goto statements leading to cleanup code at the end of the routine). Link: https://lore.kernel.org/all/0000000000008c664105dffae2eb@google.com/ Fixes: fc274c1e9973 "USB: gadget: Add a new bus for gadgets" CC: Andrey Konovalov CC: Reported-and-tested-by: syzbot+02b16343704b3af1667e@syzkaller.appspotmail.com Reviewed-by: Andrey Konovalov Acked-by: Hillf Danton Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YqdG32w+3h8c1s7z@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit dbab764ed5e987306480f827775876b99b81429e Author: Lukas Bulwahn Date: Mon Jun 13 14:46:47 2022 +0200 MAINTAINERS: add include/dt-bindings/usb to USB SUBSYSTEM Maintainers of the directory Documentation/devicetree/bindings/usb are also the maintainers of the corresponding directory include/dt-bindings/usb. Add the file entry for include/dt-bindings/usb to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220613124647.32019-1-lukas.bulwahn@gmail.com Signed-off-by: Greg Kroah-Hartman commit fcd53c51d03709bc429822086f1e9b3e88904284 Author: Florian Westphal Date: Mon Jun 20 16:17:31 2022 +0200 netfilter: nf_dup_netdev: add and use recursion counter Now that the egress function can be called from egress hook, we need to avoid recursive calls into the nf_tables traverser, else crash. Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 574a5b85dc3b9ab672ff3fba0ee020f927960648 Author: Florian Westphal Date: Mon Jun 20 16:17:30 2022 +0200 netfilter: nf_dup_netdev: do not push mac header a second time Eric reports skb_under_panic when using dup/fwd via bond+egress hook. Before pushing mac header, we should make sure that we're called from ingress to put back what was pulled earlier. In egress case, the MAC header is already there; we should leave skb alone. While at it be more careful here: skb might have been altered and headroom reduced, so add a skb_cow() before so that headroom is increased if necessary. nf_do_netdev_egress() assumes skb ownership (it normally ends with a call to dev_queue_xmit), so we must free the packet on error. Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook") Reported-by: Eric Garver Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 5d79d8af8dec58bf709b3124d09d9572edd9c617 Author: Jie2x Zhou Date: Thu Jun 16 15:40:46 2022 +0800 selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh Before change: make -C netfilter TEST: performance net,port [SKIP] perf not supported port,net [SKIP] perf not supported net6,port [SKIP] perf not supported port,proto [SKIP] perf not supported net6,port,mac [SKIP] perf not supported net6,port,mac,proto [SKIP] perf not supported net,mac [SKIP] perf not supported After change: net,mac [ OK ] baseline (drop from netdev hook): 2061098pps baseline hash (non-ranged entries): 1606741pps baseline rbtree (match on first field only): 1191607pps set with 1000 full, ranged entries: 1639119pps ok 8 selftests: netfilter: nft_concat_range.sh Fixes: 611973c1e06f ("selftests: netfilter: Introduce tests for sets with range concatenation") Reported-by: kernel test robot Signed-off-by: Jie2x Zhou Signed-off-by: Pablo Neira Ayuso commit 372b2aee97028c75a6e12d205a2e5f0c8626efc6 Author: Stephen Boyd Date: Thu Jun 2 12:06:21 2022 -0700 arm64: dts: qcom: Remove duplicate sc7180-trogdor include on lazor/homestar The sc7180-trogdor-{lazor,homestar}-*.dtsi files all include sc7180-trogdor.dtsi and sc7180-trogdor-lazor.dtsi or sc7180-trogdor-homestar.dtsi, so including it here in the sc7180-trogdor-{lazor,homestar}.dtsi file means we have a duplicate include after commit 19794489fa24 ("arm64: dts: qcom: Only include sc7180.dtsi in sc7180-trogdor.dtsi"). We include the sc7180-trogdor.dtsi file in a board like sc7180-trogdor-lazor-r1.dts so that we can include the display bridge snippet (e.g. sc7180-trogdor-ti-sn65dsi86.dtsi) instead of making ever increasing variants like sc7180-trogdor-lazor-ti-sn65dsi86.dtsi. Unfortunately, having the double include like this means the display bridge's i2c bus is left disabled instead of enabled by the bridge snippet. Any boards that use the i2c bus for the display bridge will have the bus disabled when we include sc7180-trogdor.dtsi the second time, which picks up the i2c status="disabled" line from sc7180.dtsi. This leads to the display not turning on and black screens at boot on lazor and homestar devices. Fix this by dropping the include and making a note that the sc7180-trogdor-{lazor,homestar}.dtsi file must be included after sc7180-trogdor.dtsi Reported-by: Douglas Anderson Cc: "Joseph S. Barrera III" Cc: Matthias Kaehlcke Fixes: 19794489fa24 ("arm64: dts: qcom: Only include sc7180.dtsi in sc7180-trogdor.dtsi") Signed-off-by: Stephen Boyd Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220602190621.1646679-1-swboyd@chromium.org commit 73130a7b1ac92c9f30e0a255951129f4851c5794 Author: Steve French Date: Sat Jun 18 17:24:23 2022 -0500 smb3: fix empty netname context on secondary channels Some servers do not allow null netname contexts, which would cause multichannel to revert to single channel when mounting to some servers (e.g. Azure xSMB). Fixes: 4c14d7043fede ("cifs: populate empty hostnames for extra channels") Reviewed-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit cb995f4eeba9d268fd4b56c2423ad6c1d1ea1b82 Author: Matthew Wilcox (Oracle) Date: Fri Jun 17 20:00:17 2022 -0400 filemap: Handle sibling entries in filemap_get_read_batch() If a read races with an invalidation followed by another read, it is possible for a folio to be replaced with a higher-order folio. If that happens, we'll see a sibling entry for the new folio in the next iteration of the loop. This manifests as a NULL pointer dereference while holding the RCU read lock. Handle this by simply returning. The next call will find the new folio and handle it correctly. The other ways of handling this rare race are more complex and it's just not worth it. Reported-by: Dave Chinner Reported-by: Brian Foster Debugged-by: Brian Foster Tested-by: Brian Foster Reviewed-by: Brian Foster Fixes: cbd59c48ae2b ("mm/filemap: use head pages in generic_file_buffered_read") Cc: stable@vger.kernel.org Signed-off-by: Matthew Wilcox (Oracle) commit 5ccc944dce3df5fd2fd683a7df4fd49d1068eba2 Author: Matthew Wilcox (Oracle) Date: Fri Jun 10 14:44:41 2022 -0400 filemap: Correct the conditions for marking a folio as accessed We had an off-by-one error which meant that we never marked the first page in a read as accessed. This was visible as a slowdown when re-reading a file as pages were being evicted from cache too soon. In reviewing this code, we noticed a second bug where a multi-page folio would be marked as accessed multiple times when doing reads that were less than the size of the folio. Abstract the comparison of whether two file positions are in the same folio into a new function, fixing both of these bugs. Reported-by: Yu Kuai Reviewed-by: Kent Overstreet Signed-off-by: Matthew Wilcox (Oracle) commit 5491424d17bdeb7b7852a59367858251783f8398 Author: Yihao Han Date: Thu Jun 2 02:42:18 2022 -0700 video: fbdev: simplefb: Check before clk_put() not needed clk_put() already checks the clk ptr using !clk and IS_ERR() so there is no need to check it again before calling it. Signed-off-by: Yihao Han Reviewed-by: Hans de Goede Signed-off-by: Helge Deller commit b5c525abe717f2f41684b8581c13347d50d5285a Author: Yihao Han Date: Wed Jun 8 04:43:25 2022 -0700 video: fbdev: au1100fb: Drop unnecessary NULL ptr check clk_disable() already checks the clk ptr using IS_ERR_OR_NULL(clk) and clk_enable() checks the clk ptr using !clk, so there is no need to check clk ptr again before calling them. Signed-off-by: Yihao Han Signed-off-by: Helge Deller commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 Author: Hyunwoo Kim Date: Mon Jun 20 07:17:46 2022 -0700 video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of type int. Then, copy_from_user() may cause a heap overflow because it is used as the third argument of copy_from_user(). Signed-off-by: Hyunwoo Kim Signed-off-by: Helge Deller commit c7b28f52f406bc89d15ca0ccbc47994f979f2fcd Author: Jason A. Donenfeld Date: Mon Jun 13 12:22:41 2022 +0200 drm/i915/display: Re-add check for low voltage sku for max dp source rate This reverts commit 73867c8709b5 ("drm/i915/display: Remove check for low voltage sku for max dp source rate"), which, on an i7-11850H iGPU with a Thinkpad X1 Extreme Gen 4, attached to a LG LP160UQ1-SPB1 embedded panel, causes wild flickering glitching technicolor pyrotechnics on resumption from suspend. The display shows strobing colors in an utter disaster explosion of pantone, as though bombs were dropped on the leprechauns at the base of the rainbow. Rebooting the machine fixes the issue, presumably because the display is initialized by firmware rather than by i915. Otherwise, the GPU appears to work fine. Bisection traced it back to this commit, which makes sense given the issues. Note: This re-opens, and puts back to the drawing board, https://gitlab.freedesktop.org/drm/intel/-/issues/5272 which was fixed by the regressing commit. Fixes: 73867c8709b5 ("drm/i915/display: Remove check for low voltage sku for max dp source rate") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205 Cc: Ankit Nautiyal Cc: Imre Deak Cc: Jani Nikula Cc: Uma Shankar Cc: Animesh Manna Cc: Jani Saarinen Signed-off-by: Jason A. Donenfeld Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220613102241.9236-1-Jason@zx2c4.com (cherry picked from commit d5929835080a60f9119d024fa42f315913942f76) Signed-off-by: Jani Nikula commit 2a166929bc0a3ae754365dabc455039fd1be82ca Author: Javier Martinez Canillas Date: Thu Jun 16 09:34:35 2022 +0200 regmap: Wire up regmap_config provided bulk write in missed functions There are some functions that were missed by commit d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config") when support to define bulk read/write callbacks in regmap_config was introduced. The regmap_bulk_write() and regmap_noinc_write() functions weren't changed to use the added map->write instead of the map->bus->write handler. Also, the regmap_can_raw_write() was not modified to take map->write into account. So will only return true if a bus with a .write callback is set. Fixes: d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config") Signed-off-by: Javier Martinez Canillas Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20220616073435.1988219-4-javierm@redhat.com Signed-off-by: Mark Brown commit c42e99a3f93b4ca15720fdfd7aa8f6141dcc2a58 Author: Javier Martinez Canillas Date: Thu Jun 16 09:34:34 2022 +0200 regmap: Make regmap_noinc_read() return -ENOTSUPP if map->read isn't set Before adding support to define bulk read/write callbacks in regmap_config by the commit d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config"), the regmap_noinc_read() function returned an errno early a map->bus->read callback wasn't set. But that commit dropped the check and now a call to _regmap_raw_read() is attempted even when bulk read operations are not supported. That function checks for map->read anyways but there's no point to continue if the read can't succeed. Also is a fragile assumption to make so is better to make it fail earlier. Fixes: d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config") Signed-off-by: Javier Martinez Canillas Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20220616073435.1988219-3-javierm@redhat.com Signed-off-by: Mark Brown commit ea50e2a1540fd94e6439a961daae595f65e574fb Author: Javier Martinez Canillas Date: Thu Jun 16 09:34:33 2022 +0200 regmap: Re-introduce bulk read support check in regmap_bulk_read() Support for drivers to define bulk read/write callbacks in regmap_config was introduced by the commit d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config"), but this commit wrongly dropped a check in regmap_bulk_read() to determine whether bulk reads can be done or not. Before that commit, it was checked if map->bus was set. Now has to check if a map->read callback has been set. Fixes: d77e74561368 ("regmap: Add bulk read/write callbacks into regmap_config") Signed-off-by: Javier Martinez Canillas Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20220616073435.1988219-2-javierm@redhat.com Signed-off-by: Mark Brown commit 78ca55889a549a9a194c6ec666836329b774ab6d Merge: c5b3a0946bbe0 aeaadcde1a601 Author: Linus Torvalds Date: Mon Jun 20 09:35:04 2022 -0500 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Eight fixes, all in drivers (ufs, scsi_debug, storvsc, iscsi, ibmvfc). Apart from the ufs command clearing updates, these are mostly minor and obvious fixes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ibmvfc: Store vhost pointer during subcrq allocation scsi: ibmvfc: Allocate/free queue resource only during probe/remove scsi: storvsc: Correct reporting of Hyper-V I/O size limits scsi: ufs: Fix a race between the interrupt handler and the reset handler scsi: ufs: Support clearing multiple commands at once scsi: ufs: Simplify ufshcd_clear_cmd() scsi: iscsi: Exclude zero from the endpoint ID range scsi: scsi_debug: Fix zone transition to full condition commit c5b3a0946bbe050502c3faef2d4ff02b0da11bd1 Merge: 59b785fe2abbe 140cd9ec8fddd Author: Linus Torvalds Date: Mon Jun 20 09:31:03 2022 -0500 Merge tag 'perf-tools-fixes-for-v5.19-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tool fixes from Arnaldo Carvalho de Melo: - Don't set data source if it's not a memory operation in ARM SPE (Statistical Profiling Extensions). - Fix handling of exponent floating point values in perf stat expressions. - Don't leak fd on failure on libperf open. - Fix 'perf test' CPU topology test for PPC guest systems. - Fix undefined behaviour on breakpoint account 'perf test' entry. - Record only user callchains on the "Check ARM64 callgraphs are complete in FP mode" 'perf test' entry. - Fix "perf stat CSV output linter" test on s390. - Sync batch of kernel headers with tools/perf/. * tag 'perf-tools-fixes-for-v5.19-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: tools headers UAPI: Sync linux/prctl.h with the kernel sources perf metrics: Ensure at least 1 id per metric tools headers arm64: Sync arm64's cputype.h with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources perf arm-spe: Don't set data source if it's not a memory operation perf expr: Allow exponents on floating point values perf test topology: Use !strncmp(right platform) to fix guest PPC comparision check perf test: Record only user callchains on the "Check Arm64 callgraphs are complete in fp mode" test perf beauty: Update copy of linux/socket.h with the kernel sources perf test: Fix variable length array undefined behavior in bp_account libperf evsel: Open shouldn't leak fd on failure perf test: Fix "perf stat CSV output linter" test on s390 perf unwind: Fix uninitialized variable commit 59b785fe2abbe21267516799f6c584cf4fe5f08b Merge: 05b252cccb2e5 eeaa345e12851 Author: Linus Torvalds Date: Mon Jun 20 09:28:51 2022 -0500 Merge tag 'slab-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - A slub fix for PREEMPT_RT locking semantics from Sebastian. - A slub fix for state corruption due to a possible race scenario from Jann. * tag 'slab-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: add missing TID updates on slab deactivation mm/slub: Move the stackdepot related allocation out of IRQ-off section. commit 05b252cccb2e5c3f56119d25de684b4f810ba40a Author: Gerd Hoffmann Date: Mon Jun 20 09:15:47 2022 +0200 udmabuf: add back sanity check Check vm_fault->pgoff before using it. When we removed the warning, we also removed the check. Fixes: 7b26e4e2119d ("udmabuf: drop WARN_ON() check.") Reported-by: zdi-disclosures@trendmicro.com Suggested-by: Linus Torvalds Signed-off-by: Gerd Hoffmann Signed-off-by: Linus Torvalds commit 1bacd264d3c3a05de4afdd1712c9dd6ccebb9490 Author: Jens Axboe Date: Mon Jun 20 06:39:27 2022 -0600 io_uring: mark reissue requests with REQ_F_PARTIAL_IO If we mark for reissue, we assume that the buffer will remain stable. Hence if are using a provided buffer, we need to ensure that we stick with it for the duration of that request. This only affects block devices that use provided buffers, as those are the only ones that get marked with REQ_F_REISSUE. Signed-off-by: Jens Axboe commit 267173cbf4a6b37599e644098c756e7e4b771fe9 Author: Bjorn Helgaas Date: Tue Jun 7 18:11:12 2022 -0500 video: fbdev: skeletonfb: Convert to generic power management PCI-specific power management (pci_driver.suspend and pci_driver.resume) is deprecated. If drivers implement power management, they should use the generic power management framework, not the PCI-specific hooks. Convert the sample code to use the generic power management framework. Signed-off-by: Bjorn Helgaas Acked-by: Daniel Vetter Signed-off-by: Helge Deller commit e146a096217e335f4e297a4fbba7ce6c722a1115 Author: Bjorn Helgaas Date: Tue Jun 7 18:11:11 2022 -0500 video: fbdev: cirrusfb: Remove useless reference to PCI power management PCI-specific power management (pci_driver.suspend and pci_driver.resume) is deprecated. The cirrusfb driver has never implemented power management at all, but if it ever does, it should use the generic power management framework, not the PCI-specific hooks. Remove the commented-out references to the PCI-specific power management hooks. Signed-off-by: Bjorn Helgaas Acked-by: Daniel Vetter Signed-off-by: Helge Deller commit d36a869e0d0e56439365ed6d836480c480470e88 Author: Petr Cvek Date: Fri Jun 17 15:38:13 2022 +0200 video: fbdev: intelfb: Initialize value of stolen size Variable stolen_size can be left uninitialized in a code path with INTEL_855_GMCH_GMS_DISABLED. Fix this by initializing the variable to 0. Also fix indentation of function arguments. Signed-off-by: Petr Cvek Signed-off-by: Helge Deller commit 25c9a15fb7bbfafb94dd3b4e3165c18b8e1bd039 Author: Petr Cvek Date: Fri Jun 17 15:38:04 2022 +0200 video: fbdev: intelfb: Use aperture size from pci_resource_len Aperture size for i9x5 variants is determined from PCI base address. if (pci_resource_start(pdev, 2) & 0x08000000) *aperture_size = MB(128); ... This condition is incorrect as 128 MiB address can have the address set as 0x?8000000 or 0x?0000000. Also the code can be simplified to just use pci_resource_len(). The true settings of the aperture size is in the MSAC register, which could be used instead. However the value is used only as an info message, so it doesn't matter. Signed-off-by: Petr Cvek Signed-off-by: Helge Deller commit fc378794a2f7a19cf26010dc33b89ba608d4c70f Author: Xiang wangx Date: Sun Jun 5 16:59:13 2022 +0800 video: fbdev: skeletonfb: Fix syntax errors in comments Delete the redundant word 'its'. Signed-off-by: Xiang wangx Signed-off-by: Helge Deller commit c7807b27d510e5aa53c8a120cfc02c33c24ebb5f Author: Takashi Iwai Date: Mon Jun 20 12:40:08 2022 +0200 ALSA: hda/via: Fix missing beep setup Like the previous fix for Conexant codec, the beep_nid has to be set up before calling snd_hda_gen_parse_auto_config(); otherwise it'd miss the path setup. Fix the call order for addressing the missing beep setup. Fixes: 0e8f9862493a ("ALSA: hda/via - Simplify control management") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=216152 Link: https://lore.kernel.org/r/20220620104008.1994-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5faa0bc69102f3a4c605581564c367be5eb94dfa Author: Takashi Iwai Date: Mon Jun 20 12:40:07 2022 +0200 ALSA: hda/conexant: Fix missing beep setup Currently the Conexant codec driver sets up the beep NID after calling snd_hda_gen_parse_auto_config(). It turned out that this results in the insufficient setup for the beep control, as the generic parser handles the fake path in snd_hda_gen_parse_auto_config() only if the beep_nid is set up beforehand. For dealing with the beep widget properly, call cx_auto_parse_beep() before snd_hda_gen_parse_auto_config() call. Fixes: 51e19ca5f755 ("ALSA: hda/conexant - Clean up beep code") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=216152 Link: https://lore.kernel.org/r/20220620104008.1994-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 419bc8f681a0dc63588cee693b6d45e7caa6006c Author: Jon Lin Date: Fri Jun 17 20:42:51 2022 +0800 spi: rockchip: Unmask IRQ at the final to avoid preemption Avoid pio_write process is preempted, resulting in abnormal state. Signed-off-by: Jon Lin Signed-off-by: Jon Link: https://lore.kernel.org/r/20220617124251.5051-1-jon.lin@rock-chips.com Signed-off-by: Mark Brown commit 342fc0c3b345525da21112bd0478a0dc741598ea Author: Carlo Lobrano Date: Tue Jun 14 09:56:23 2022 +0200 USB: serial: option: add Telit LE910Cx 0x1250 composition Add support for the following Telit LE910Cx composition: 0x1250: rmnet, tty, tty, tty, tty Reviewed-by: Daniele Palmas Signed-off-by: Carlo Lobrano Link: https://lore.kernel.org/r/20220614075623.2392607-1-c.lobrano@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 3828296ad6242c25d2679d32a377b8e07c6b08c0 Author: Tvrtko Ursulin Date: Thu Jun 16 15:00:56 2022 +0100 drm/i915/fdinfo: Don't show engine classes not present Stop displaying engine classes with no engines - it is not a huge problem if they are shown, since the values will correctly be all zeroes, but it does count as misleading. Signed-off-by: Tvrtko Ursulin Fixes: 055634e4b62f ("drm/i915: Expose client engine utilisation via fdinfo") Cc: Umesh Nerlige Ramappa Reviewed-by: Umesh Nerlige Ramappa Link: https://patchwork.freedesktop.org/patch/msgid/20220616140056.559074-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 9f1b1d0b2242171b2891a0398def233801601c14) Signed-off-by: Jani Nikula commit 13bd259b64bb58ae130923ada42ebc19bf3f2fa2 Author: Ville Syrjälä Date: Mon Jun 13 23:14:39 2022 +0300 drm/i915: Implement w/a 22010492432 for adl-s adl-s needs the combo PLL DCO fraction w/a as well. Gets us slightly more accurate clock out of the PLL. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220613201439.23341-1-ville.syrjala@linux.intel.com Reviewed-by: Matt Roper (cherry picked from commit d36bdd77b9e6aa7f5cb7b0f11ebbab8e5febf10b) Signed-off-by: Jani Nikula commit a2d9b75b19dc8863f0845ffb401d33b2286d0aa1 Author: Max Filippov Date: Mon Jun 20 02:45:10 2022 -0700 xtensa: change '.bss' to '.section .bss' For some reason (ancient assembler?) the following build error is reported by the kisskb: kisskb/src/arch/xtensa/kernel/entry.S: Error: unknown pseudo-op: `.bss': => 2176 Change abbreviated '.bss' to the full '.section .bss, "aw"' to fix this error. Reported-by: Geert Uytterhoeven Signed-off-by: Max Filippov commit 754f04cac362417b157e30d5dc4046b5ec92060c Author: Cristian Marussi Date: Thu Jun 16 18:03:47 2022 +0100 firmware: arm_scmi: Relax CLOCK_DESCRIBE_RATES out-of-spec checks A reply to CLOCK_DESCRIBE_RATES issued against a non rate-discrete clock should be composed of a triplet of rates descriptors (min/max/step) returned all in one reply message. This is not always the case when dealing with some SCMI server deployed in the wild: relax such constraint while maintaining memory safety by checking carefully the returned payload size. While at that cleanup a stale debug printout. Link: https://lore.kernel.org/r/20220616170347.2800771-1-cristian.marussi@arm.com Fixes: 7bc7caafe6b1 ("firmware: arm_scmi: Use common iterators in the clock protocol") Tested-by: Robin Murphy Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 63b8ea5e4f1a87dea4d3114293fc8e96a8f193d7 Author: Jason A. Donenfeld Date: Mon Jun 20 11:03:48 2022 +0200 random: update comment from copy_to_user() -> copy_to_iter() This comment wasn't updated when we moved from read() to read_iter(), so this patch makes the trivial fix. Fixes: 1b388e7765f2 ("random: convert to using fops->read_iter()") Signed-off-by: Jason A. Donenfeld commit 69135c572d1f84261a6de2a1268513a7e71753e2 Author: Ziyang Xuan Date: Mon Jun 20 12:35:08 2022 +0800 net/tls: fix tls_sk_proto_close executed repeatedly After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When close the sock, tls_sk_proto_close() is called for sock->sk_prot->close is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly occurred. That will trigger the following bug. ================================================================= KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306 Call Trace: tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329 inet_release+0x12e/0x280 net/ipv4/af_inet.c:428 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x18/0x20 net/socket.c:1365 Updating a proto which is same with sock->sk_prot is incorrect. Add proto and sock->sk_prot equality check at the head of tls_update() to fix it. Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free") Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan Signed-off-by: David S. Miller commit 301bd140ed0b24f0da660874c7e8a47dad8c8222 Author: Eric Dumazet Date: Mon Jun 20 01:35:06 2022 -0700 erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set. syzbot reported: WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Modules linked in: CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 Call Trace: __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3815 [inline] __dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 dev_queue_xmit include/linux/netdevice.h:2994 [inline] tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Fixes: d5db21a3e697 ("erspan: auto detect truncated ipv6 packets.") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: William Tu Signed-off-by: David S. Miller commit 313c502fa3b3494159cb8f18d4a6444d06c5c9a5 Author: Riccardo Paolo Bestetti Date: Sun Jun 19 18:27:35 2022 +0200 ipv4: fix bind address validity regression tests Commit 8ff978b8b222 ("ipv4/raw: support binding to nonlocal addresses") introduces support for binding to nonlocal addresses, as well as some basic test coverage for some of the related cases. Commit b4a028c4d031 ("ipv4: ping: fix bind address validity check") fixes a regression which incorrectly removed some checks for bind address validation. In addition, it introduces regression tests for those specific checks. However, those regression tests are defective, in that they perform the tests using an incorrect combination of bind flags. As a result, those tests fail when they should succeed. This commit introduces additional regression tests for nonlocal binding and fixes the defective regression tests. It also introduces new set_sysctl calls for the ipv4_bind test group, as to perform the ICMP binding tests it is necessary to allow ICMP socket creation by setting the net.ipv4.ping_group_range knob. Fixes: b4a028c4d031 ("ipv4: ping: fix bind address validity check") Reported-by: Riccardo Paolo Bestetti Signed-off-by: Riccardo Paolo Bestetti Signed-off-by: David S. Miller commit 315f7e15c261167ea71c1a4cce2a18ca30e990ea Merge: a111daf0c53ae 70171ed6dc53d Author: Greg Kroah-Hartman Date: Mon Jun 20 09:49:52 2022 +0200 Merge tag 'iio-fixes-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: 1st set of IIO fixes for the 5.19 cycle. Most of these have been in next for a long time. Unfortunately there was one stray patch in the branch (wasn't a fix), so I've just rebased to remove that. * testing - Fix a missing MODULE_LICENSE() warning by restricting possible build configs. * Various drivers - Fix ordering of iio_get_trigger() being called before iio_trigger_register() * adi,admv1014 - Fix dubious x & !y warning. * adi,axi-adc - Fix missing of_node_put() in error and normal paths. * aspeed,adc - Add missing of_node_put() * fsl,mma8452 - Fix broken probing from device tree. - Drop check on return value of i2c write to device to cause reset as ACK will be missing (device reset before sending it). * fsl,vf610 - Fix documentation of in_conversion_mode ABI. * iio-trig-sysfs - Ensure irq work has finished before freeing the trigger. * invensense,mpu3050 - Disable regulators in error path. * invensense,icm42600 - Fix collision of enum value of 0 with error path where 0 is no match. * renesas,rzg2l_Adc - Add missing fwnode_handle_put() in error path. * rescale - Fix a boolean logic bug for detection of raw + scale affecting an obscure corner case. * semtech,sx9324 - Check return value of read of pin_defs * st,stm32-adc: - Fix interaction across ADC instances for some supported devices. - Drop false spurious IRQ messages. - Fix calibration value handling. If we can't calibrate don't expose the vref_int channel. - Fix maximum clock rate for stm32pm15x * ti,ads131e08 - Add missing fwnode_handle_put() in error paths. * xilinx,ams - Fix variable checked for error from platform_get_irq() * x-powers,axp288 - Overide TS_PIN bias current for boards where it is not correctly initialized. * yamaha,yas530 - Fix inverted check on calibration data being all zeros. * tag 'iio-fixes-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (26 commits) iio:proximity:sx9324: Check ret value of device_property_read_u32_array() iio: accel: mma8452: ignore the return value of reset operation iio: adc: stm32: fix maximum clock rate for stm32mp15x iio: adc: stm32: fix vrefint wrong calibration value handling iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) iio: adc: vf610: fix conversion mode sysfs node name iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client iio: test: fix missing MODULE_LICENSE for IIO_RESCALE=m iio:humidity:hts221: rearrange iio trigger get and register iio:chemical:ccs811: rearrange iio trigger get and register iio:accel:mxc4005: rearrange iio trigger get and register iio:accel:kxcjk-1013: rearrange iio trigger get and register iio:accel:bma180: rearrange iio trigger get and register iio: afe: rescale: Fix boolean logic bug iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message iio: adc: stm32: Fix ADCs iteration in irq handler iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels() iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties() iio: trigger: sysfs: fix use-after-free on remove ... commit 9882d63bea14c8b3ed2c9360b9ab9f0e2f64ae2b Author: Takashi Iwai Date: Mon Jun 20 09:34:40 2022 +0200 ALSA: memalloc: Drop x86-specific hack for WC allocations The recent report for a crash on Haswell machines implied that the x86-specific (rather hackish) implementation for write-cache memory buffer allocation in ALSA core is buggy with the recent kernel in some corner cases. This patch drops the x86-specific implementation and uses the standard dma_alloc_wc() & co generically for avoiding the bug and also for simplification. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216112 Cc: # v5.18+ Link: https://lore.kernel.org/r/20220620073440.7514-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9243fc4cd28c8bdddd7fe0abd5bbec3c4fdf5052 Author: Damien Le Moal Date: Fri Jun 3 14:35:29 2022 +0900 block: remove queue from struct blk_independent_access_range The request queue pointer in struct blk_independent_access_range is unused. Remove it. Signed-off-by: Damien Le Moal Fixes: 41e46b3c2aa2 ("block: Fix potential deadlock in blk_ia_range_sysfs_show()") Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220603053529.76405-1-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit 291810be4227564403807e663f3ec8d3b3d6ba34 Author: Nick Desaulniers Date: Fri Jun 17 09:58:17 2022 -0700 Documentation/llvm: Update Supported Arch table While watching Michael's new talk on Clang-built-Linux, I noticed the arch table in our docs that he refers to is outdated. Add hexagon and User Mode. Bump MIPS and RISCV to LLVM=1. PowerPC is almost LLVM=1 capable; ppc64le works, but ppc64 (big endian) and ppc32 still need more work. Link: https://youtu.be/W4zdEDpvR5c?t=399 Signed-off-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 28438794aba47a27e922857d27b31b74e8559143 Author: Masahiro Yamada Date: Sat Jun 11 03:32:30 2022 +0900 modpost: fix section mismatch check for exported init/exit sections Since commit f02e8a6596b7 ("module: Sort exported symbols"), EXPORT_SYMBOL* is placed in the individual section ___ksymtab(_gpl)+ (3 leading underscores instead of 2). Since then, modpost cannot detect the bad combination of EXPORT_SYMBOL and __init/__exit. Fix the .fromsec field. Fixes: f02e8a6596b7 ("module: Sort exported symbols") Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 61803e984307c767a96d85f3b61ca50e1705fc67 Author: Daeho Jeong Date: Fri Jun 10 11:32:40 2022 -0700 f2fs: fix iostat related lock protection Made iostat related locks safe to be called from irq context again. Cc: Fixes: a1e09b03e6f5 ("f2fs: use iomap for direct I/O") Signed-off-by: Daeho Jeong Reviewed-by: Stanley Chu Tested-by: Eddie Huang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4cde00d50707c2ef6647b9b96b2cb40b6eb24397 Author: Jaegeuk Kim Date: Tue May 31 18:27:09 2022 -0700 f2fs: attach inline_data after setting compression This fixes the below corruption. [345393.335389] F2FS-fs (vdb): sanity_check_inode: inode (ino=6d0, mode=33206) should not have inline_data, run fsck to fix Cc: Fixes: 677a82b44ebf ("f2fs: fix to do sanity check for inline inode") Signed-off-by: Jaegeuk Kim commit c01d4d0a82b71857be7449380338bc53dde2da92 Author: Jason A. Donenfeld Date: Thu Jun 16 15:00:51 2022 +0200 random: quiet urandom warning ratelimit suppression message random.c ratelimits how much it warns about uninitialized urandom reads using __ratelimit(). When the RNG is finally initialized, it prints the number of missed messages due to ratelimiting. It has been this way since that functionality was introduced back in 2018. Recently, cc1e127bfa95 ("random: remove ratelimiting for in-kernel unseeded randomness") put a bit more stress on the urandom ratelimiting, which teased out a bug in the implementation. Specifically, when under pressure, __ratelimit() will print its own message and reset the count back to 0, making the final message at the end less useful. Secondly, it does so as a pr_warn(), which apparently is undesirable for people's CI. Fortunately, __ratelimit() has the RATELIMIT_MSG_ON_RELEASE flag exactly for this purpose, so we set the flag. Fixes: 4e00b339e264 ("random: rate limit unseeded randomness warnings") Cc: stable@vger.kernel.org Reported-by: Jon Hunter Reported-by: Ron Economos Tested-by: Ron Economos Signed-off-by: Jason A. Donenfeld commit 534d2eaf1970274150596fdd2bf552721e65d6b2 Author: Jason A. Donenfeld Date: Thu Jun 16 02:03:12 2022 +0200 random: schedule mix_interrupt_randomness() less often It used to be that mix_interrupt_randomness() would credit 1 bit each time it ran, and so add_interrupt_randomness() would schedule mix() to run every 64 interrupts, a fairly arbitrary number, but nonetheless considered to be a decent enough conservative estimate. Since e3e33fc2ea7f ("random: do not use input pool from hard IRQs"), mix() is now able to credit multiple bits, depending on the number of calls to add(). This was done for reasons separate from this commit, but it has the nice side effect of enabling this patch to schedule mix() less often. Currently the rules are: a) Credit 1 bit for every 64 calls to add(). b) Schedule mix() once a second that add() is called. c) Schedule mix() once every 64 calls to add(). Rules (a) and (c) no longer need to be coupled. It's still important to have _some_ value in (c), so that we don't "over-saturate" the fast pool, but the once per second we get from rule (b) is a plenty enough baseline. So, by increasing the 64 in rule (c) to something larger, we avoid calling queue_work_on() as frequently during irq storms. This commit changes that 64 in rule (c) to be 1024, which means we schedule mix() 16 times less often. And it does *not* need to change the 64 in rule (a). Fixes: 58340f8e952b ("random: defer fast pool mixing to worker") Cc: stable@vger.kernel.org Cc: Dominik Brodowski Acked-by: Sebastian Andrzej Siewior Signed-off-by: Jason A. Donenfeld commit a111daf0c53ae91e71fd2bfe7497862d14132e3e Author: Linus Torvalds Date: Sun Jun 19 15:06:47 2022 -0500 Linux 5.19-rc3 commit 70171ed6dc53d2f580166d47f5b66cf51a6d0092 Author: Aashish Sharma Date: Mon Jun 13 16:22:24 2022 -0700 iio:proximity:sx9324: Check ret value of device_property_read_u32_array() 0-day reports: drivers/iio/proximity/sx9324.c:868:3: warning: Value stored to 'ret' is never read [clang-analyzer-deadcode.DeadStores] Put an if condition to break out of switch if ret is non-zero. Signed-off-by: Aashish Sharma Fixes: a8ee3b32f5da ("iio:proximity:sx9324: Add dt_binding support") Reported-by: kernel test robot [swboyd@chromium.org: Reword commit subject, add fixes tag] Signed-off-by: Stephen Boyd Reviewed-by: Gwendal Grignou Link: https://lore.kernel.org/r/20220613232224.2466278-1-swboyd@chromium.org Cc: Signed-off-by: Jonathan Cameron commit bf745142cc0a3e1723f9207fb0c073c88464b7b4 Author: Haibo Chen Date: Wed Jun 15 19:31:58 2022 +0800 iio: accel: mma8452: ignore the return value of reset operation On fxls8471, after set the reset bit, the device will reset immediately, will not give ACK. So ignore the return value of this reset operation, let the following code logic to check whether the reset operation works. Signed-off-by: Haibo Chen Fixes: ecabae713196 ("iio: mma8452: Initialise before activating") Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/1655292718-14287-1-git-send-email-haibo.chen@nxp.com Cc: Signed-off-by: Jonathan Cameron commit 990539486e7e311fb5dab1bf4d85d1a8973ae644 Author: Olivier Moysan Date: Thu Jun 9 11:52:34 2022 +0200 iio: adc: stm32: fix maximum clock rate for stm32mp15x Change maximum STM32 ADC input clock rate to 36MHz, as specified in STM32MP15x datasheets. Fixes: d58c67d1d851 ("iio: adc: stm32-adc: add support for STM32MP1") Signed-off-by: Olivier Moysan Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220609095234.375925-1-olivier.moysan@foss.st.com Cc: Signed-off-by: Jonathan Cameron commit bc05f30fc24705cd023f38659303376eaa5767df Author: Olivier Moysan Date: Thu Jun 9 11:58:56 2022 +0200 iio: adc: stm32: fix vrefint wrong calibration value handling If the vrefint calibration is zero, the vrefint channel output value cannot be computed. Currently, in such case, the raw conversion value is returned, which is not relevant. Do not expose the vrefint channel when the output value cannot be computed, instead. Fixes: 0e346b2cfa85 ("iio: adc: stm32-adc: add vrefint calibration support") Signed-off-by: Olivier Moysan Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220609095856.376961-1-olivier.moysan@foss.st.com Cc: Signed-off-by: Jonathan Cameron commit 106b391e1b859100a3f38f0ad874236e9be06bde Author: Jean-Baptiste Maneyrol Date: Thu Jun 9 12:23:01 2022 +0200 iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) The 0 value used for INV_CHIP_ICM42600 was not working since the match in i2c/spi was checking against NULL value. To keep this check, add a first INV_CHIP_INVALID 0 value as safe guard. Fixes: 31c24c1e93c3 ("iio: imu: inv_icm42600: add core of new inv_icm42600 driver") Signed-off-by: Jean-Baptiste Maneyrol Link: https://lore.kernel.org/r/20220609102301.4794-1-jmaneyrol@invensense.com Cc: Signed-off-by: Jonathan Cameron commit f1a633b15cd5371a2a83f02c513984e51132dd68 Author: Baruch Siach Date: Mon May 30 11:50:26 2022 +0300 iio: adc: vf610: fix conversion mode sysfs node name The documentation missed the "in_" prefix for this IIO_SHARED_BY_DIR entry. Fixes: bf04c1a367e3 ("iio: adc: vf610: implement configurable conversion modes") Signed-off-by: Baruch Siach Acked-by: Haibo Chen Link: https://lore.kernel.org/r/560dc93fafe5ef7e9a409885fd20b6beac3973d8.1653900626.git.baruch@tkos.co.il Signed-off-by: Jonathan Cameron commit ada7b0c0dedafd7d059115adf49e48acba3153a8 Author: Miaoqian Lin Date: Tue May 24 11:45:17 2022 +0400 iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: ef04070692a2 ("iio: adc: adi-axi-adc: add support for AXI ADC IP core") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220524074517.45268-1-linmq006@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 7a2f6f61e8ee016b75e1b1dd62fbd03e6d6db37d Author: Liam Beguin Date: Wed Jun 1 10:21:38 2022 -0400 iio: test: fix missing MODULE_LICENSE for IIO_RESCALE=m When IIO_RESCALE_KUNIT_TEST=y and IIO_RESCALE=m, drivers/iio/afe/iio-rescale.o is built twice causing the MODULE_LICENSE() to be lost, as shown by: ERROR: modpost: missing MODULE_LICENSE() in drivers/iio/afe/iio-rescale.o Rework the build configuration to have the dependency specified in the Kconfig. Reported-by: Randy Dunlap Fixes: 8e74a48d17d5 ("iio: test: add basic tests for the iio-rescale driver") Signed-off-by: Liam Beguin Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220601142138.3331278-1-liambeguin@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 10b9c2c33ac706face458feab8965f11743c98c0 Author: Dmitry Rokosov Date: Tue May 24 18:14:46 2022 +0000 iio:humidity:hts221: rearrange iio trigger get and register IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE. If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour. Fixes: e4a70e3e7d84 ("iio: humidity: add support to hts221 rh/temp combo device") Signed-off-by: Dmitry Rokosov Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220524181150.9240-6-ddrokosov@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit d710359c0b445e8c03e24f19ae2fb79ce7282260 Author: Dmitry Rokosov Date: Tue May 24 18:14:45 2022 +0000 iio:chemical:ccs811: rearrange iio trigger get and register IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE. If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour. Fixes: f1f065d7ac30 ("iio: chemical: ccs811: Add support for data ready trigger") Signed-off-by: Dmitry Rokosov Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220524181150.9240-5-ddrokosov@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit 9354c224c9b4f55847a0de3e968cba2ebf15af3b Author: Dmitry Rokosov Date: Tue May 24 18:14:43 2022 +0000 iio:accel:mxc4005: rearrange iio trigger get and register IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE. If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour. Fixes: 47196620c82f ("iio: mxc4005: add data ready trigger for mxc4005") Signed-off-by: Dmitry Rokosov Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220524181150.9240-4-ddrokosov@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit ed302925d708f2f97ae5e9fd6c56c16bb34f6629 Author: Dmitry Rokosov Date: Tue May 24 18:14:42 2022 +0000 iio:accel:kxcjk-1013: rearrange iio trigger get and register IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE. If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour. Fixes: c1288b833881 ("iio: accel: kxcjk-1013: Increment ref counter for indio_dev->trig") Signed-off-by: Dmitry Rokosov Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220524181150.9240-3-ddrokosov@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit e5f3205b04d7f95a2ef43bce4b454a7f264d6923 Author: Dmitry Rokosov Date: Tue May 24 18:14:39 2022 +0000 iio:accel:bma180: rearrange iio trigger get and register IIO trigger interface function iio_trigger_get() should be called after iio_trigger_register() (or its devm analogue) strictly, because of iio_trigger_get() acquires module refcnt based on the trigger->owner pointer, which is initialized inside iio_trigger_register() to THIS_MODULE. If this call order is wrong, the next iio_trigger_put() (from sysfs callback or "delete module" path) will dereference "default" module refcnt, which is incorrect behaviour. Fixes: 0668a4e4d297 ("iio: accel: bma180: Fix indio_dev->trig assignment") Signed-off-by: Dmitry Rokosov Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220524181150.9240-2-ddrokosov@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit 9decacd8b3a432316d61c4366f302e63384cb08d Author: Linus Walleij Date: Tue May 24 09:54:48 2022 +0200 iio: afe: rescale: Fix boolean logic bug When introducing support for processed channels I needed to invert the expression: if (!iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) || !iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE)) dev_err(dev, "source channel does not support raw/scale\n"); To the inverse, meaning detect when we can usse raw+scale rather than when we can not. This was the result: if (iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) || iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE)) dev_info(dev, "using raw+scale source channel\n"); Ooops. Spot the error. Yep old George Boole came up and bit me. That should be an &&. The current code "mostly works" because we have not run into systems supporting only raw but not scale or only scale but not raw, and I doubt there are few using the rescaler on anything such, but let's fix the logic. Cc: Liam Beguin Cc: stable@vger.kernel.org Fixes: 53ebee949980 ("iio: afe: iio-rescale: Support processed channels") Signed-off-by: Linus Walleij Reviewed-by: Liam Beguin Acked-by: Peter Rosin Link: https://lore.kernel.org/r/20220524075448.140238-1-linus.walleij@linaro.org Signed-off-by: Jonathan Cameron commit 8a2b6b5687984a010ed094b4f436a2f091987758 Author: Miaoqian Lin Date: Mon May 16 11:52:02 2022 +0400 iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: d0a4c17b4073 ("iio: adc: aspeed: Get and set trimming data.") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220516075206.34580-1-linmq006@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 99bded02dae5e1e2312813506c41dc8db2fb656c Author: Yannick Brosseau Date: Mon May 16 16:39:39 2022 -0400 iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message The check for spurious IRQs introduced in 695e2f5c289bb assumed that the bits in the control and status registers are aligned. This is true for the H7 and MP1 version, but not the F4. The interrupt was then never handled on the F4. Instead of increasing the complexity of the comparison and check each bit specifically, we remove this check completely and rely on the generic handler for spurious IRQs. Fixes: 695e2f5c289b ("iio: adc: stm32-adc: fix a regression when using dma and irq") Signed-off-by: Yannick Brosseau Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220516203939.3498673-3-yannick.brosseau@gmail.com Cc: Signed-off-by: Jonathan Cameron commit d2214cca4d3eadc74eac9e30301ec7cad5355f00 Author: Yannick Brosseau Date: Mon May 16 16:39:38 2022 -0400 iio: adc: stm32: Fix ADCs iteration in irq handler The irq handler was only checking the mask for the first ADCs in the case of the F4 and H7 generation, since it was iterating up to the num_irq value. This patch add the maximum number of ADC in the common register, which map to the number of entries of eoc_msk and ovr_msk in stm32_adc_common_regs. This allow the handler to check all ADCs in that module. Tested on a STM32F429NIH6. Fixes: 695e2f5c289b ("iio: adc: stm32-adc: fix a regression when using dma and irq") Signed-off-by: Yannick Brosseau Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220516203939.3498673-2-yannick.brosseau@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 47dcf770abc793f347a65a24c24d550c936f08b0 Author: Jialin Zhang Date: Tue May 17 11:30:20 2022 +0800 iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels() fwnode_handle_put() should be used when terminating device_for_each_child_node() iteration with break or return to prevent stale device node references from being left behind. Fixes: d935eddd2799 ("iio: adc: Add driver for Texas Instruments ADS131E0x ADC family") Reported-by: Hulk Robot Signed-off-by: Jialin Zhang Link: https://lore.kernel.org/r/20220517033020.2033324-1-zhangjialin11@huawei.com Cc: Signed-off-by: Jonathan Cameron commit d836715f588ea15f905f607c27bc693587058db4 Author: Jialin Zhang Date: Tue May 17 11:35:26 2022 +0800 iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties() fwnode_handle_put() should be used when terminating device_for_each_child_node() iteration with break or return to prevent stale device node references from being left behind. Fixes: d484c21bacfa ("iio: adc: Add driver for Renesas RZ/G2L A/D converter") Reported-by: Hulk Robot Signed-off-by: Jialin Zhang Reviewed-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220517033526.2035735-1-zhangjialin11@huawei.com Cc: Signed-off-by: Jonathan Cameron commit 78601726d4a59a291acc5a52da1d3a0a6831e4e8 Author: Vincent Whitchurch Date: Thu May 19 11:19:25 2022 +0200 iio: trigger: sysfs: fix use-after-free on remove Ensure that the irq_work has completed before the trigger is freed. ================================================================== BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt Allocated by task 25: kmem_cache_alloc_trace iio_sysfs_trig_add dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write Freed by task 25: kfree iio_sysfs_trig_remove dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write ================================================================== Fixes: f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly active trigger") Signed-off-by: Vincent Whitchurch Reviewed-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20220519091925.1053897-1-vincent.whitchurch@axis.com Cc: Signed-off-by: Jonathan Cameron commit b2f5ad97645e1deb5ca9bcb7090084b92cae35d2 Author: Zheyu Ma Date: Tue May 10 17:24:31 2022 +0800 iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() The driver should disable regulators when fails at regmap_update_bits(). Signed-off-by: Zheyu Ma Reviewed-by: Linus Walleij Cc: Link: https://lore.kernel.org/r/20220510092431.1711284-1-zheyuma97@gmail.com Signed-off-by: Jonathan Cameron commit 6f6bd7591945c679b7f595119ea997b19f5794db Author: Antoniu Miclaus Date: Wed May 11 12:00:06 2022 +0300 iio: freq: admv1014: Fix warning about dubious x & !y and improve readability The warning comes from __BF_FIELD_CHECK() specifically BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ ~((_mask) >> __bf_shf(_mask)) & (_val) : 0, \ _pfx "value too large for the field"); \ The code was using !(enum value) which is not particularly easy to follow so replace that with explicit matching and use of ? 0 : 1; or ? 1 : 0; to improve readability. Signed-off-by: Antoniu Miclaus Link: https://lore.kernel.org/r/20220511090006.90502-1-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit be33d52ef5b4bdfec04cfdad39368c343bac97a3 Author: Maya Matuszczyk Date: Sun Jun 19 13:19:52 2022 +0200 drm: panel-orientation-quirks: Add quirk for Aya Neo Next The device is identified by "NEXT" in board name, however there are different versions of it, "Next Advance" and "Next Pro", that have different DMI board names. Due to a production error a batch or two have their board names prefixed by "AYANEO", this makes it 6 different DMI board names. To save some space in final kernel image DMI_MATCH is used instead of DMI_EXACT_MATCH. Signed-off-by: Maya Matuszczyk Reviewed-by: Javier Martinez Canillas Reviewed-by: Hans de Goede Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220619111952.8487-1-maccraft123mc@gmail.com commit 05c6ca8512f2722f57743d653bb68cf2a273a55a Merge: 5d770f11a1623 1e7769653b06b Author: Linus Torvalds Date: Sun Jun 19 09:58:28 2022 -0500 Merge tag 'x86-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: - Make RESERVE_BRK() work again with older binutils. The recent 'simplification' broke that. - Make early #VE handling increment RIP when successful. - Make the #VE code consistent vs. the RIP adjustments and add comments. - Handle load_unaligned_zeropad() across page boundaries correctly in #VE when the second page is shared. * tag 'x86-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Handle load_unaligned_zeropad() page-cross to a shared page x86/tdx: Clarify RIP adjustments in #VE handler x86/tdx: Fix early #VE handling x86/mm: Fix RESERVE_BRK() for older binutils commit 5d770f11a1623eef83894b60686fb328794ccd23 Merge: 727c3991dfdb3 7b6c7a877cc61 Author: Linus Torvalds Date: Sun Jun 19 09:54:16 2022 -0500 Merge tag 'objtool-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull build tooling updates from Thomas Gleixner: - Remove obsolete CONFIG_X86_SMAP reference from objtool - Fix overlapping text section failures in faddr2line for real - Remove OBJECT_FILES_NON_STANDARD usage from x86 ftrace and replace it with finegrained annotations so objtool can validate that code correctly. * tag 'objtool-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ftrace: Remove OBJECT_FILES_NON_STANDARD usage faddr2line: Fix overlapping text section failures, the sequel objtool: Fix obsolete reference to CONFIG_X86_SMAP commit 727c3991dfdb3ff104e33307e287692ef01daec9 Merge: 4afb65156a79c 04193d590b390 Author: Linus Torvalds Date: Sun Jun 19 09:51:00 2022 -0500 Merge tag 'sched-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Thomas Gleixner: "A single scheduler fix plugging a race between sched_setscheduler() and balance_push(). sched_setscheduler() spliced the balance callbacks accross a lock break which makes it possible for an interleaving schedule() to observe an empty list" * tag 'sched-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix balance_push() vs __sched_setscheduler() commit 4afb65156a79c59fbdbc10abb0bf06ff83f73e23 Merge: 36da9f5fb6e3a 4051a81774d6d Author: Linus Torvalds Date: Sun Jun 19 09:47:41 2022 -0500 Merge tag 'locking-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull lockdep fix from Thomas Gleixner: "A RT fix for lockdep. lockdep invokes prandom_u32() to create cookies. This worked until prandom_u32() was switched to the real random generator, which takes a spinlock for extraction, which does not work on RT when invoked from atomic contexts. lockdep has no requirement for real random numbers and it turns out sched_clock() is good enough to create the cookie. That works everywhere and is faster" * tag 'locking-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Use sched_clock() for random numbers commit 36da9f5fb6e3a0a88ba28e5a7cc7d5449641a286 Merge: bc94632ceb4b4 6872fcac7158c Author: Linus Torvalds Date: Sun Jun 19 09:45:16 2022 -0500 Merge tag 'irq-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A set of interrupt subsystem updates: Core: - Ensure runtime power management for chained interrupts Drivers: - A collection of OF node refcount fixes - Unbreak MIPS uniprocessor builds - Fix xilinx interrupt controller Kconfig dependencies - Add a missing compatible string to the Uniphier driver" * tag 'irq-urgent-2022-06-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/loongson-liointc: Use architecture register to get coreid irqchip/uniphier-aidet: Add compatible string for NX1 SoC dt-bindings: interrupt-controller/uniphier-aidet: Add bindings for NX1 SoC irqchip/realtek-rtl: Fix refcount leak in map_interrupts irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions irqchip/apple-aic: Fix refcount leak in aic_of_ic_init irqchip/apple-aic: Fix refcount leak in build_fiq_affinity irqchip/gic/realview: Fix refcount leak in realview_gic_of_init irqchip/xilinx: Remove microblaze+zynq dependency genirq: PM: Use runtime PM for chained interrupts commit 140cd9ec8fdddc0e2d1684e6b69bcd05efbc9549 Author: Arnaldo Carvalho de Melo Date: Thu Feb 11 12:50:52 2021 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources To pick the changes in: 9e4ab6c891094720 ("arm64/sme: Implement vector length configuration prctl()s") That don't result in any changes in tooling: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after $ Just silences this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/prctl.h' differs from latest version at 'include/uapi/linux/prctl.h' diff -u tools/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Cc: Catalin Marinas Cc: Mark Brown Link: http://lore.kernel.org/lkml/Yq81we+XFOqlBWyu@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bc94632ceb4b4af47b2c86f8f11177884821fb94 Merge: ee4eb6eeaf146 928ea98252ad7 Author: Linus Torvalds Date: Sun Jun 19 09:37:29 2022 -0500 Merge tag 'char-misc-5.19-rc3-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes for real from Greg KH: "Let's tag the proper branch this time... Here are some small char/misc driver fixes for 5.19-rc3 that resolve some reported issues. They include: - mei driver fixes - comedi driver fix - rtsx build warning fix - fsl-mc-bus driver fix All of these have been in linux-next for a while with no reported issues" This is what the merge in commit f0ec9c65a8d6 _should_ have merged, but Greg fat-fingered the pull request and I got some small changes from linux-next instead there. Credit to Nathan Chancellor for eagle-eyes. Link: https://lore.kernel.org/all/Yqywy+Md2AfGDu8v@dev-arch.thelio-3990X/ * tag 'char-misc-5.19-rc3-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() mei: me: add raptor lake point S DID mei: hbm: drop capability response on early shutdown mei: me: set internal pg flag to off on hardware reset misc: rtsx: Fix clang -Wsometimes-uninitialized in rts5261_init_from_hw() comedi: vmk80xx: fix expression for tx buffer size commit ee4eb6eeaf1468f2524cceef92906a378dd3df7e Merge: 063232b6c46ef de87b603b0919 Author: Linus Torvalds Date: Sun Jun 19 09:35:09 2022 -0500 Merge tag 'i2c-for-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "MAINTAINERS rectifications and a few minor driver fixes" * tag 'i2c-for-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: mediatek: Fix an error handling path in mtk_i2c_probe() i2c: designware: Use standard optional ref clock implementation MAINTAINERS: core DT include belongs to core MAINTAINERS: add include/dt-bindings/i2c to I2C SUBSYSTEM HOST DRIVERS i2c: npcm7xx: Add check for platform_driver_register MAINTAINERS: Update Synopsys DesignWare I2C to Supported commit 063232b6c46ef81a952362647541d897e806ec5d Merge: 354c6e071be98 e89ab76d7e256 Author: Linus Torvalds Date: Sun Jun 19 09:24:49 2022 -0500 Merge tag 'xfs-5.19-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "There's not a whole lot this time around (I'm still on vacation) but here are some important fixes for new features merged in -rc1: - Fix a bug where inode flag changes would accidentally drop nrext64 - Fix a race condition when toggling LARP mode" * tag 'xfs-5.19-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: preserve DIFLAG2_NREXT64 when setting other inode attributes xfs: fix variable state usage xfs: fix TOCTOU race involving the new logged xattrs control knob commit c788ef61ef2ae51dc9cbd589e118f827585c156f Author: Ian Rogers Date: Fri Jun 17 18:39:57 2022 -0700 perf metrics: Ensure at least 1 id per metric We may have no events for a metric evaluated to a constant. In such a case ensure a tool event is at least evaluated for metric parsing and displaying. Fixes: 8586d2744ff3065e ("perf metrics: Don't add all tool events for sharing") Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220618013957.999321-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 37402d5d061ba914a12d16ee8dda6d6964b4819d Author: Arnaldo Carvalho de Melo Date: Sat Apr 9 11:48:15 2022 -0300 tools headers arm64: Sync arm64's cputype.h with the kernel sources To get the changes in: cae889302ebf5a9b ("KVM: arm64: vgic-v3: List M1 Pro/Max as requiring the SEIS workaround") That addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/asm/cputype.h' differs from latest version at 'arch/arm64/include/asm/cputype.h' diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h Cc: Marc Zyngier Link: https://lore.kernel.org/lkml/Yq8w7p4omYKNwOij@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2e323f360a7b635a4df6faea616b80c188e68991 Author: Arnaldo Carvalho de Melo Date: Fri Sep 10 11:46:54 2021 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: f1a9761fbb00639c ("KVM: x86: Allow userspace to opt out of hypercall patching") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Cc: Oliver Upton Cc: Paolo Bonzini Link: https://lore.kernel.org/lkml/Yq8qgiMwRcl9ds+f@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 51ba539f5bdb5a8cc7b1dedd5e73ac54564a7602 Author: Leo Yan Date: Tue May 17 02:03:25 2022 +0000 perf arm-spe: Don't set data source if it's not a memory operation Except for memory load and store operations, ARM SPE records also can support other operation types, bug when set the data source field the current code assumes a record is a either load operation or store operation, this leads to wrongly synthesize memory samples. This patch strictly checks the record operation type, it only sets data source only for the operation types ARM_SPE_LD and ARM_SPE_ST, otherwise, returns zero for data source. Therefore, we can synthesize memory samples only when data source is a non-zero value, the function arm_spe__is_memory_event() is useless and removed. Fixes: e55ed3423c1bb29f ("perf arm-spe: Synthesize memory event") Reviewed-by: Ali Saidi Reviewed-by: German Gomez Signed-off-by: Leo Yan Tested-by: Ali Saidi Cc: Alexander Shishkin Cc: alisaidi@amazon.com Cc: Andrew Kilroy Cc: Benjamin Herrenschmidt Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Leo Yan Cc: Li Huafei Cc: linux-arm-kernel@lists.infradead.org Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Forrington Cc: Peter Zijlstra Cc: Will Deacon Link: http://lore.kernel.org/lkml/20220517020326.18580-5-alisaidi@amazon.com Signed-off-by: Arnaldo Carvalho de Melo commit e5287e6dd3b07e28e6bca5e33a3813a5e83bbc4c Author: Ian Rogers Date: Thu May 26 19:06:53 2022 -0700 perf expr: Allow exponents on floating point values Pass the optional exponent component through to strtod that already supports it. We already have exponents in ScaleUnit and so this adds uniformity. Reported-by: Zhengjun Xing Reviewed-By: Kajol Jain Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Richter Link: https://lore.kernel.org/r/20220527020653.4160884-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b236371421df57b93fc49c4b9d0e53bd1aab2b2e Author: Athira Rajeev Date: Fri Jun 10 19:29:39 2022 +0530 perf test topology: Use !strncmp(right platform) to fix guest PPC comparision check commit cfd7092c31aed728 ("perf test session topology: Fix test to skip the test in guest environment") added check to skip the testcase if the socket_id can't be fetched from topology info. But the condition check uses strncmp which should be changed to !strncmp and to correctly match platform. Fix this condition check. Fixes: cfd7092c31aed728 ("perf test session topology: Fix test to skip the test in guest environment") Reported-by: Thomas Richter Signed-off-by: Athira Jajeev Acked-by: Ian Rogers Cc: Athira Rajeev Cc: Disha Goel Cc: Jiri Olsa Cc: Kajol Jain Cc: linuxppc-dev@lists.ozlabs.org Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Link: https://lore.kernel.org/r/20220610135939.63361-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 72dcae8efd42699bbfd55e1ef187310c4e2e5dcb Author: Michael Petlan Date: Tue Jun 14 12:52:07 2022 +0200 perf test: Record only user callchains on the "Check Arm64 callgraphs are complete in fp mode" test The testcase 'Check Arm64 callgraphs are complete in fp mode' wants to see the following output: 610 leaf 62f parent 648 main However, without excluding kernel callchains, the output might look like: ffffc2ff40ef1b5c arch_local_irq_enable ffffc2ff419d032c __schedule ffffc2ff419d06c0 schedule ffffc2ff40e4da30 do_notify_resume ffffc2ff40e421b0 work_pending 610 leaf 62f parent 648 main Adding '--user-callchains' leaves only the wanted symbols in the chain. Fixes: cd6382d82752737e ("perf test arm64: Test unwinding using fame-pointer (fp) mode") Suggested-by: German Gomez Reviewed-by: German Gomez Reviewed-by: Leo Yan Signed-off-by: Michael Petlan Cc: German Gomez Cc: Jiri Olsa Link: https://lore.kernel.org/r/20220614105207.26223-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit 67e7d771580e9f365e75e1cc3690401526cfbb29 Author: Arnaldo Carvalho de Melo Date: Sat Jun 19 10:09:08 2021 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: f94fd25cb0aaf77f ("tcp: pass back data left in socket after receive") That don't result in any changes in the tables generated from that header. This silences this perf build warning: Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h' diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Cc: Jakub Kicinski Cc: Jens Axboe Link: https://lore.kernel.org/all/YqORj9d58AiGYl8b@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit cc2145526c9889e3dbddc210c21bc3a080b2a29f Author: Ian Rogers Date: Fri Jun 10 11:02:47 2022 -0700 perf test: Fix variable length array undefined behavior in bp_account Fix: tests/bp_account.c:154:9: runtime error: variable length array bound evaluates to non-positive value 0 by switching from a variable length to an allocated array. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220610180247.444798-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 94725994cfd768b9ee1bd06f15c252694b1e9b89 Author: Ian Rogers Date: Wed Jun 8 22:23:52 2022 -0700 libperf evsel: Open shouldn't leak fd on failure If perf_event_open() fails the fd is opened but it is only freed by closing (not by delete). Typically when an open fails you don't call close and so this results in a memory leak. To avoid this, add a close when open fails. Signed-off-by: Ian Rogers Reviewed-By: Kajol Jain Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anshuman Khandual Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220609052355.1300162-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ec906102e5b7d3393cfe83e606b48cf0c1fcb122 Author: Thomas Richter Date: Fri Jun 3 13:30:34 2022 +0200 perf test: Fix "perf stat CSV output linter" test on s390 perf test -F 83 ("perf stat CSV output linter") fails on s390. Reason is the wrong number of fields for certain CPU core/die/socket related output. On x84_64 the output of command: # ./perf stat -x, -A -a --no-merge true CPU0,1.50,msec,cpu-clock,1502781,100.00,1.052,CPUs utilized CPU1,1.48,msec,cpu-clock,1476113,100.00,1.034,CPUs utilized ... results in 8 fields with 7 comma separators. On s390 the output of command: # ./perf stat -x, -A -a --no-merge -- true 0.95,msec,cpu-clock,949800,100.00,1.060,CPUs utilized ... results in 7 fields with 6 comma separators. Therefore this tests fails on s390. Similar issues exist for per-die and per-socket output which is not supported on s390. I have rewritten the python program to count commas in each output line into a bash function to achieve the same result. I hope this makes it a bit easier. Output before: # ./perf test -F 83 83: perf stat CSV output linter : Checking CSV output: no args [Success] Checking CSV output: system wide [Success] Checking CSV output: system wide Checking CSV output: \ system wide no aggregation 6.92,msec,cpu-clock,\ 6918131,100.00,6.972,CPUs utilized ... RuntimeError: wrong number of fields. expected 7 in \ 6.92,msec,cpu-clock,6918131,100.00,6.972,CPUs utilized FAILED! # Output after: # ./perf test -F 83 83: perf stat CSV output linter : Checking CSV output: no args [Success] Checking CSV output: system wide [Success] Checking CSV output: system wide Checking CSV output:\ system wide no aggregation [Success] Checking CSV output: interval [Success] Checking CSV output: event [Success] Checking CSV output: per core [Success] Checking CSV output: per thread [Success] Checking CSV output: per die [Success] Checking CSV output: per node [Success] Checking CSV output: per socket [Success] Ok # Committer notes: Continues to work on x86_64 $ perf test lint 89: perf stat CSV output linter : Ok $ perf test -v lint Couldn't bump rlimit(MEMLOCK), failures may take place when creating BPF maps, etc 89: perf stat CSV output linter : --- start --- test child forked, pid 53133 Checking CSV output: no args [Success] Checking CSV output: system wide [Skip] paranoid and not root Checking CSV output: system wide [Skip] paranoid and not root Checking CSV output: interval [Success] Checking CSV output: event [Success] Checking CSV output: per core [Skip] paranoid and not root Checking CSV output: per thread [Skip] paranoid and not root Checking CSV output: per die [Skip] paranoid and not root Checking CSV output: per node [Skip] paranoid and not root Checking CSV output: per socket [Skip] paranoid and not root test child finished with 0 ---- end ---- perf stat CSV output linter: Ok $ Signed-off-by: Thomas Richter Acked-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Claire Jensen Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Cc: linux390-list@tuxmaker.boeblingen.de.ibm.com Link: https://lore.kernel.org/r/20220603113034.2009728-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 1d98cdf7fa2bc6e8063c0a692a1c091d8ebe3a75 Author: Ian Rogers Date: Mon Jun 6 17:08:51 2022 -0700 perf unwind: Fix uninitialized variable The 'ret' variable may be uninitialized on error goto paths. Fixes: dc2cf4ca866f5715 ("perf unwind: Fix segbase for ld.lld linked objects") Reported-by: Sedat Dilek Reviewed-by: Fangrui Song Signed-off-by: Ian Rogers Tested-by: Sedat Dilek # LLVM-14 (x86-64) Cc: Fangrui Song Cc: Ingo Molnar Cc: llvm@lists.linux.dev Cc: Peter Zijlstra Cc: Sebastian Ullrich Link: https://lore.kernel.org/r/20220607000851.39798-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ca5dabcff1df6bc8c413922b5fa63cc602858803 Author: Christophe Leroy Date: Fri Jun 10 17:43:43 2022 +0200 powerpc/prom_init: Fix build failure with GCC_PLUGIN_STRUCTLEAK_BYREF_ALL and KASAN When CONFIG_KASAN is selected, we expect prom_init to use __memset() because it is too early to use memset(). But with CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL, the compiler adds calls to memset() to clear objects on stack, hence the following failure: PROMCHK arch/powerpc/kernel/prom_init_check Error: External symbol 'memset' referenced from prom_init.c make[2]: *** [arch/powerpc/kernel/Makefile:204 : arch/powerpc/kernel/prom_init_check] Erreur 1 prom_find_machine_type() is called from prom_init() and is called only once, so lets put compat[] in BSS instead of stack to avoid that. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/3802811f7cf94f730be44688539c01bba3a3b5c0.1654875808.git.christophe.leroy@csgroup.eu commit 9926de7315be3d606cc011a305ad9adb9e8e14c9 Author: Oleksij Rempel Date: Sat Jun 18 14:23:33 2022 +0200 net: phy: at803x: fix NULL pointer dereference on AR9331 PHY Latest kernel will explode on the PHY interrupt config, since it depends now on allocated priv. So, run probe to allocate priv to fix it. ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13) CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34 ... Call Trace: [<8050e8a8>] at803x_config_intr+0x5c/0xd0 [<80504b34>] phy_request_interrupt+0xa8/0xd0 [<8050289c>] phylink_bringup_phy+0x2d8/0x3ac [<80502b68>] phylink_fwnode_phy_connect+0x118/0x130 [<8074d8ec>] dsa_slave_create+0x270/0x420 [<80743b04>] dsa_port_setup+0x12c/0x148 [<8074580c>] dsa_register_switch+0xaf0/0xcc0 [<80511344>] ar9331_sw_probe+0x370/0x388 [<8050cb78>] mdio_probe+0x44/0x70 [<804df300>] really_probe+0x200/0x424 [<804df7b4>] __driver_probe_device+0x290/0x298 [<804df810>] driver_probe_device+0x54/0xe4 [<804dfd50>] __device_attach_driver+0xe4/0x130 [<804dcb00>] bus_for_each_drv+0xb4/0xd8 [<804dfac4>] __device_attach+0x104/0x1a4 [<804ddd24>] bus_probe_device+0x48/0xc4 [<804deb44>] deferred_probe_work_func+0xf0/0x10c [<800a0ffc>] process_one_work+0x314/0x4d4 [<800a17fc>] worker_thread+0x2a4/0x354 [<800a9a54>] kthread+0x134/0x13c [<8006306c>] ret_from_kernel_thread+0x14/0x1c Same Issue would affect some other PHYs (QCA8081, QCA9561), so fix it too. Fixes: 3265f4218878 ("net: phy: at803x: add fiber support") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 8fc74d18639a2402ca52b177e990428e26ea881f Author: Wentao_Liang Date: Sun Jun 19 22:14:54 2022 +0800 drivers/net/ethernet/neterion/vxge: Fix a use-after-free bug in vxge-main.c The pointer vdev points to a memory region adjacent to a net_device structure ndev, which is a field of hldev. At line 4740, the invocation to vxge_device_unregister unregisters device hldev, and it also releases the memory region pointed by vdev->bar0. At line 4743, the freed memory region is referenced (i.e., iounmap(vdev->bar0)), resulting in a use-after-free vulnerability. We can fix the bug by calling iounmap before vxge_device_unregister. 4721. static void vxge_remove(struct pci_dev *pdev) 4722. { 4723. struct __vxge_hw_device *hldev; 4724. struct vxgedev *vdev; … 4731. vdev = netdev_priv(hldev->ndev); … 4740. vxge_device_unregister(hldev); 4741. /* Do not call pci_disable_sriov here, as it will break child devices */ 4742. vxge_hw_device_terminate(hldev); 4743. iounmap(vdev->bar0); … 4749 vxge_debug_init(vdev->level_trace, "%s:%d Device unregistered", 4750 __func__, __LINE__); 4751 vxge_debug_entryexit(vdev->level_trace, "%s:%d Exiting...", __func__, 4752 __LINE__); 4753. } This is the screenshot when the vulnerability is triggered by using KASAN. We can see that there is a use-after-free reported by KASAN. /***************************start**************************/ root@kernel:~# echo 1 > /sys/bus/pci/devices/0000:00:03.0/remove [ 178.296316] vxge_remove [ 182.057081] ================================================================== [ 182.057548] BUG: KASAN: use-after-free in vxge_remove+0xe0/0x15c [ 182.057760] Read of size 8 at addr ffff888006c76598 by task bash/119 [ 182.057983] [ 182.058747] CPU: 0 PID: 119 Comm: bash Not tainted 5.18.0 #5 [ 182.058919] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 182.059463] Call Trace: [ 182.059726] [ 182.060017] dump_stack_lvl+0x34/0x44 [ 182.060316] print_report.cold+0xb2/0x6b7 [ 182.060401] ? kfree+0x89/0x290 [ 182.060478] ? vxge_remove+0xe0/0x15c [ 182.060545] kasan_report+0xa9/0x120 [ 182.060629] ? vxge_remove+0xe0/0x15c [ 182.060706] vxge_remove+0xe0/0x15c [ 182.060793] pci_device_remove+0x5d/0xe0 [ 182.060968] device_release_driver_internal+0xf1/0x180 [ 182.061063] pci_stop_bus_device+0xae/0xe0 [ 182.061150] pci_stop_and_remove_bus_device_locked+0x11/0x20 [ 182.061236] remove_store+0xc6/0xe0 [ 182.061297] ? subordinate_bus_number_show+0xc0/0xc0 [ 182.061359] ? __mutex_lock_slowpath+0x10/0x10 [ 182.061438] ? sysfs_kf_write+0x6d/0xa0 [ 182.061525] kernfs_fop_write_iter+0x1b0/0x260 [ 182.061610] ? sysfs_kf_bin_read+0xf0/0xf0 [ 182.061695] new_sync_write+0x209/0x310 [ 182.061789] ? new_sync_read+0x310/0x310 [ 182.061865] ? cgroup_rstat_updated+0x5c/0x170 [ 182.061937] ? preempt_count_sub+0xf/0xb0 [ 182.061995] ? pick_next_entity+0x13a/0x220 [ 182.062063] ? __inode_security_revalidate+0x44/0x80 [ 182.062155] ? security_file_permission+0x46/0x2a0 [ 182.062230] vfs_write+0x33f/0x3e0 [ 182.062303] ksys_write+0xb4/0x150 [ 182.062369] ? __ia32_sys_read+0x40/0x40 [ 182.062451] do_syscall_64+0x3b/0x90 [ 182.062531] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 182.062894] RIP: 0033:0x7f3f37d17274 [ 182.063558] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48 8d 05 89 54 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53 [ 182.063797] RSP: 002b:00007ffd5ba9e178 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 182.064117] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f3f37d17274 [ 182.064219] RDX: 0000000000000002 RSI: 000055bbec327180 RDI: 0000000000000001 [ 182.064315] RBP: 000055bbec327180 R08: 000000000000000a R09: 00007f3f37de7cf0 [ 182.064414] R10: 000000000000000a R11: 0000000000000246 R12: 00007f3f37de8760 [ 182.064513] R13: 0000000000000002 R14: 00007f3f37de3760 R15: 0000000000000002 [ 182.064691] [ 182.064916] [ 182.065224] The buggy address belongs to the physical page: [ 182.065804] page:00000000ef31e4f4 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6c76 [ 182.067419] flags: 0x100000000000000(node=0|zone=1) [ 182.068997] raw: 0100000000000000 0000000000000000 ffffea00001b1d88 0000000000000000 [ 182.069118] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 182.069294] page dumped because: kasan: bad access detected [ 182.069331] [ 182.069360] Memory state around the buggy address: [ 182.070006] ffff888006c76480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 182.070136] ffff888006c76500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 182.070230] >ffff888006c76580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 182.070305] ^ [ 182.070456] ffff888006c76600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 182.070505] ffff888006c76680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 182.070606] ================================================================== [ 182.071374] Disabling lock debugging due to kernel taint /*****************************end*****************************/ After fixing the bug as done in the patch, we can find KASAN do not report the bug and the device(00:03.0) has been successfully removed. /*****************************start***************************/ root@kernel:~# echo 1 > /sys/bus/pci/devices/0000:00:03.0/remove root@kernel:~# /******************************end****************************/ Signed-off-by: Wentao_Liang Signed-off-by: David S. Miller commit a1016ba9f908d3d00b9483e2d9d5840ba744f122 Author: Fabio Estevam Date: Tue Jun 7 13:46:40 2022 -0300 ARM: dts: imx7d-smegw01: Fix the SDIO description usdhc2 is connected to a Wifi chip that is powered by a 3.3V supply. Pass the "no-1-8-v" property to guarantee that no communication is made at 1.8V. While at it, also remove the unnecessary properties: "cap-sd-highspeed", "sd-uhs-ddr50", and "mmc-ddr-1_8v". Fixes: 9ac0ae97e349 ("ARM: dts: imx7d-smegw01: Add support for i.MX7D SMEGW01 board") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 354c6e071be986a44b956f7b57f1884244431048 Merge: ace2045ed56f9 1f3ddff375591 Author: Linus Torvalds Date: Sat Jun 18 21:51:12 2022 -0500 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix a variety of bugs, many of which were found by folks using fuzzing or error injection. Also fix up how test_dummy_encryption mount option is handled for the new mount API. Finally, fix/cleanup a number of comments and ext4 Documentation files" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix a doubled word "need" in a comment ext4: add reserved GDT blocks check ext4: make variable "count" signed ext4: correct the judgment of BUG in ext4_mb_normalize_request ext4: fix bug_on ext4_mb_use_inode_pa ext4: fix up test_dummy_encryption handling for new mount API ext4: use kmemdup() to replace kmalloc + memcpy ext4: fix super block checksum incorrect after mount ext4: improve write performance with disabled delalloc ext4: fix warning when submitting superblock in ext4_commit_super() ext4, doc: remove unnecessary escaping ext4: fix incorrect comment in ext4_bio_write_page() fs: fix jbd2_journal_try_to_free_buffers() kernel-doc comment commit ace2045ed56f9b00beb4cd23c76a5b6cae69f2fe Merge: 4b35035bcf80d 5d24968f5b7e0 Author: Linus Torvalds Date: Sat Jun 18 21:44:44 2022 -0500 Merge tag '5.19-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Two cifs debugging improvements - one found to deal with debugging a multichannel problem and one for a recent fallocate issue This does include the two larger multichannel reconnect (dynamically adjusting interfaces on reconnect) patches, because we recently found an additional problem with multichannel to one server type that I want to include at the same time" * tag '5.19-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: when a channel is not found for server, log its connection id smb3: add trace point for SMB2_set_eof commit 1f3ddff3755915a2b38de92d53508594de432d3d Author: Xiang wangx Date: Sun Jun 5 17:15:03 2022 +0800 ext4: fix a doubled word "need" in a comment Signed-off-by: Xiang wangx Link: https://lore.kernel.org/r/20220605091503.12513-1-wangxiang@cdjrlc.com Signed-off-by: Theodore Ts'o commit b55c3cd102a6f48b90e61c44f7f3dda8c290c694 Author: Zhang Yi Date: Wed Jun 1 17:27:17 2022 +0800 ext4: add reserved GDT blocks check We capture a NULL pointer issue when resizing a corrupt ext4 image which is freshly clear resize_inode feature (not run e2fsck). It could be simply reproduced by following steps. The problem is because of the resize_inode feature was cleared, and it will convert the filesystem to meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was not reduced to zero, so could we mistakenly call reserve_backup_gdb() and passing an uninitialized resize_inode to it when adding new group descriptors. mkfs.ext4 /dev/sda 3G tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck mount /dev/sda /mnt resize2fs /dev/sda 8G ======== BUG: kernel NULL pointer dereference, address: 0000000000000028 CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748 ... RIP: 0010:ext4_flex_group_add+0xe08/0x2570 ... Call Trace: ext4_resize_fs+0xbec/0x1660 __ext4_ioctl+0x1749/0x24e0 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xa6/0x110 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f2dd739617b ======== The fix is simple, add a check in ext4_resize_begin() to make sure that the es->s_reserved_gdt_blocks is zero when the resize_inode feature is disabled. Cc: stable@kernel.org Signed-off-by: Zhang Yi Reviewed-by: Ritesh Harjani Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220601092717.763694-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit bc75a6eb856cb1507fa907bf6c1eda91b3fef52f Author: Ding Xiang Date: Mon May 30 18:00:47 2022 +0800 ext4: make variable "count" signed Since dx_make_map() may return -EFSCORRUPTED now, so change "count" to be a signed integer so we can correctly check for an error code returned by dx_make_map(). Fixes: 46c116b920eb ("ext4: verify dir block before splitting it") Cc: stable@kernel.org Signed-off-by: Ding Xiang Link: https://lore.kernel.org/r/20220530100047.537598-1-dingxiang@cmss.chinamobile.com Signed-off-by: Theodore Ts'o commit cf4ff938b47fc5c00b0ccce53a3b50eca9b32281 Author: Baokun Li Date: Sat May 28 19:00:16 2022 +0800 ext4: correct the judgment of BUG in ext4_mb_normalize_request ext4_mb_normalize_request() can move logical start of allocated blocks to reduce fragmentation and better utilize preallocation. However logical block requested as a start of allocation (ac->ac_o_ex.fe_logical) should always be covered by allocated blocks so we should check that by modifying and to or in the assertion. Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/20220528110017.354175-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit a08f789d2ab5242c07e716baf9a835725046be89 Author: Baokun Li Date: Sat May 28 19:00:15 2022 +0800 ext4: fix bug_on ext4_mb_use_inode_pa Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/mballoc.c:3211! [...] RIP: 0010:ext4_mb_mark_diskspace_used.cold+0x85/0x136f [...] Call Trace: ext4_mb_new_blocks+0x9df/0x5d30 ext4_ext_map_blocks+0x1803/0x4d80 ext4_map_blocks+0x3a4/0x1a10 ext4_writepages+0x126d/0x2c30 do_writepages+0x7f/0x1b0 __filemap_fdatawrite_range+0x285/0x3b0 file_write_and_wait_range+0xb1/0x140 ext4_sync_file+0x1aa/0xca0 vfs_fsync_range+0xfb/0x260 do_fsync+0x48/0xa0 [...] ================================================================== Above issue may happen as follows: ------------------------------------- do_fsync vfs_fsync_range ext4_sync_file file_write_and_wait_range __filemap_fdatawrite_range do_writepages ext4_writepages mpage_map_and_submit_extent mpage_map_one_extent ext4_map_blocks ext4_mb_new_blocks ext4_mb_normalize_request >>> start + size <= ac->ac_o_ex.fe_logical ext4_mb_regular_allocator ext4_mb_simple_scan_group ext4_mb_use_best_found ext4_mb_new_preallocation ext4_mb_new_inode_pa ext4_mb_use_inode_pa >>> set ac->ac_b_ex.fe_len <= 0 ext4_mb_mark_diskspace_used >>> BUG_ON(ac->ac_b_ex.fe_len <= 0); we can easily reproduce this problem with the following commands: `fallocate -l100M disk` `mkfs.ext4 -b 1024 -g 256 disk` `mount disk /mnt` `fsstress -d /mnt -l 0 -n 1000 -p 1` The size must be smaller than or equal to EXT4_BLOCKS_PER_GROUP. Therefore, "start + size <= ac->ac_o_ex.fe_logical" may occur when the size is truncated. So start should be the start position of the group where ac_o_ex.fe_logical is located after alignment. In addition, when the value of fe_logical or EXT4_BLOCKS_PER_GROUP is very large, the value calculated by start_off is more accurate. Cc: stable@kernel.org Fixes: cd648b8a8fd5 ("ext4: trim allocation requests to group size") Reported-by: Hulk Robot Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/20220528110017.354175-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 85456054e10b0247920b00422d27365e689d9f4a Author: Eric Biggers Date: Wed May 25 21:04:12 2022 -0700 ext4: fix up test_dummy_encryption handling for new mount API Since ext4 was converted to the new mount API, the test_dummy_encryption mount option isn't being handled entirely correctly, because the needed fscrypt_set_test_dummy_encryption() helper function combines parsing/checking/applying into one function. That doesn't work well with the new mount API, which split these into separate steps. This was sort of okay anyway, due to the parsing logic that was copied from fscrypt_set_test_dummy_encryption() into ext4_parse_param(), combined with an additional check in ext4_check_test_dummy_encryption(). However, these overlooked the case of changing the value of test_dummy_encryption on remount, which isn't allowed but ext4 wasn't detecting until ext4_apply_options() when it's too late to fail. Another bug is that if test_dummy_encryption was specified multiple times with an argument, memory was leaked. Fix this up properly by using the new helper functions that allow splitting up the parse/check/apply steps for test_dummy_encryption. Fixes: cebe85d570cf ("ext4: switch to the new mount api") Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20220526040412.173025-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit 4efd9f0d120c55b08852ee5605dbb02a77089a5d Author: Shuqi Zhang Date: Wed May 25 11:01:20 2022 +0800 ext4: use kmemdup() to replace kmalloc + memcpy Replace kmalloc + memcpy with kmemdup() Signed-off-by: Shuqi Zhang Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/20220525030120.803330-1-zhangshuqi3@huawei.com Signed-off-by: Theodore Ts'o commit 9b6641dd95a0c441b277dd72ba22fed8d61f76ad Author: Ye Bin Date: Wed May 25 09:29:04 2022 +0800 ext4: fix super block checksum incorrect after mount We got issue as follows: [home]# mount /dev/sda test EXT4-fs (sda): warning: mounting fs with errors, running e2fsck is recommended [home]# dmesg EXT4-fs (sda): warning: mounting fs with errors, running e2fsck is recommended EXT4-fs (sda): Errors on filesystem, clearing orphan list. EXT4-fs (sda): recovery complete EXT4-fs (sda): mounted filesystem with ordered data mode. Quota mode: none. [home]# debugfs /dev/sda debugfs 1.46.5 (30-Dec-2021) Checksum errors in superblock! Retrying... Reason is ext4_orphan_cleanup will reset ‘s_last_orphan’ but not update super block checksum. To solve above issue, defer update super block checksum after ext4_orphan_cleanup. Signed-off-by: Ye Bin Cc: stable@kernel.org Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/20220525012904.1604737-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o commit 173940b3ae40114d4179c251a98ee039dc9cd5b3 Author: Liang He Date: Fri Jun 17 19:53:23 2022 +0800 xtensa: xtfpga: Fix refcount leak bug in setup In machine_setup(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Cc: stable@vger.kernel.org Signed-off-by: Liang He Message-Id: <20220617115323.4046905-1-windhl@126.com> Signed-off-by: Max Filippov commit a0117dc956429f2ede17b323046e1968d1849150 Author: Liang He Date: Fri Jun 17 20:44:32 2022 +0800 xtensa: Fix refcount leak bug in time.c In calibrate_ccount(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Cc: stable@vger.kernel.org Signed-off-by: Liang He Message-Id: <20220617124432.4049006-1-windhl@126.com> Signed-off-by: Max Filippov commit 5d24968f5b7e00bae564b1646c3b9e0e3750aabe Author: Shyam Prasad N Date: Tue Jun 14 11:47:24 2022 +0000 cifs: when a channel is not found for server, log its connection id cifs_ses_get_chan_index gets the index for a given server pointer. When a match is not found, we warn about a possible bug. However, printing details about the non-matching server could be more useful to debug here. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit a6e2af64a79afa7f1b29375b5231e840a84bb845 Author: Kuogee Hsieh Date: Thu Jun 16 13:26:40 2022 -0700 drm/msm/dp: force link training for display resolution change Display resolution change is implemented through drm modeset. Older modeset (resolution) has to be disabled first before newer modeset (resolution) can be enabled. Display disable will turn off both pixel clock and main link clock so that main link have to be re-trained during display enable to have new video stream flow again. At current implementation, display enable function manually kicks up irq_hpd_handle which will read panel link status and start link training if link status is not in sync state. However, there is rare case that a particular panel links status keep staying in sync for some period of time after main link had been shut down previously at display disabled. In this case, main link retraining will not be executed by irq_hdp_handle(). Hence video stream of newer display resolution will fail to be transmitted to panel due to main link is not in sync between host and panel. This patch will bypass irq_hpd_handle() in favor of directly call dp_ctrl_on_stream() to always perform link training in regardless of main link status. So that no unexpected exception resolution change failure cases will happen. Also this implementation are more efficient than manual kicking off irq_hpd_handle function. Changes in v2: -- set force_link_train flag on DP only (is_edp == false) Changes in v3: -- revise commit text -- add Fixes tag Changes in v4: -- revise commit text Changes in v5: -- fix spelling at commit text Changes in v6: -- split dp_ctrl_on_stream() for phy test case -- revise commit text for modeset Changes in v7: -- drop 0 assignment at local variable (ret = 0) Changes in v8: -- add patch to remove pixel_rate from dp_ctrl Changes in v9: -- forward declare dp_ctrl_on_stream_phy_test_report() Fixes: 62671d2ef24b ("drm/msm/dp: fixes wrong connection state caused by failure of link train") Signed-off-by: Kuogee Hsieh Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/489895/ Link: https://lore.kernel.org/r/1655411200-7255-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Rob Clark commit 2211e34a9d57973993b644c4a2c76086cb6ce7fd Author: Abhinav Kumar Date: Thu Jun 16 12:26:46 2022 -0700 drm/msm/dpu: limit wb modes based on max_mixer_width As explained in [1], using max_linewidth to limit the modes does not seem to remove 4K modes on chipsets such as sm8250 where the max_linewidth actually supports 4k. This would have been alright if dual SSPP support was present but otherwise fails the per SSPP bandwidth check. The ideal way to implement this would be to filter out the modes which will exceed the bandwidth check by computing it. But this would be an exhaustive solution till we have dual SSPP support. Let's instead use max_mixer_width to limit the modes. max_mixer_width still remains 2560 on sm8250 so even if the max_linewidth is 4096, the only way 4k modes could have been supported is to have source split enabled on the SSPP. Since source split support is not enabled yet in DPU driver, enforce max_mixer_width as the upper limit on the modes. [1] https://patchwork.freedesktop.org/patch/489662/ Fixes: e67dcecda06f ("drm/msm/dpu: limit writeback modes according to max_linewidth") Signed-off-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/489893/ Link: https://lore.kernel.org/r/1655407606-21760-1-git-send-email-quic_abhinavk@quicinc.com Signed-off-by: Rob Clark commit d80c3ba0ac247791a4ed7a0cd865a64906c8906a Author: Kuogee Hsieh Date: Mon Jun 6 10:55:39 2022 -0700 drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind() During msm initialize phase, dp_display_unbind() will be called to undo initializations had been done by dp_display_bind() previously if there is error happen at msm_drm_bind. In this case, core_initialized flag had to be check to make sure clocks is on before update DP controller register to disable HPD interrupts. Otherwise system will crash due to below NOC fatal error. QTISECLIB [01f01a7ad]CNOC2 ERROR: ERRLOG0_LOW = 0x00061007 QTISECLIB [01f01a7ad]GEM_NOC ERROR: ERRLOG0_LOW = 0x00001007 QTISECLIB [01f0371a0]CNOC2 ERROR: ERRLOG0_HIGH = 0x00000003 QTISECLIB [01f055297]GEM_NOC ERROR: ERRLOG0_HIGH = 0x00000003 QTISECLIB [01f072beb]CNOC2 ERROR: ERRLOG1_LOW = 0x00000024 QTISECLIB [01f0914b8]GEM_NOC ERROR: ERRLOG1_LOW = 0x00000042 QTISECLIB [01f0ae639]CNOC2 ERROR: ERRLOG1_HIGH = 0x00004002 QTISECLIB [01f0cc73f]GEM_NOC ERROR: ERRLOG1_HIGH = 0x00004002 QTISECLIB [01f0ea092]CNOC2 ERROR: ERRLOG2_LOW = 0x0009020c QTISECLIB [01f10895f]GEM_NOC ERROR: ERRLOG2_LOW = 0x0ae9020c QTISECLIB [01f125ae1]CNOC2 ERROR: ERRLOG2_HIGH = 0x00000000 QTISECLIB [01f143be7]GEM_NOC ERROR: ERRLOG2_HIGH = 0x00000000 QTISECLIB [01f16153a]CNOC2 ERROR: ERRLOG3_LOW = 0x00000000 QTISECLIB [01f17fe07]GEM_NOC ERROR: ERRLOG3_LOW = 0x00000000 QTISECLIB [01f19cf89]CNOC2 ERROR: ERRLOG3_HIGH = 0x00000000 QTISECLIB [01f1bb08e]GEM_NOC ERROR: ERRLOG3_HIGH = 0x00000000 QTISECLIB [01f1d8a31]CNOC2 ERROR: SBM1 FAULTINSTATUS0_LOW = 0x00000002 QTISECLIB [01f1f72a4]GEM_NOC ERROR: SBM0 FAULTINSTATUS0_LOW = 0x00000001 QTISECLIB [01f21a217]CNOC3 ERROR: ERRLOG0_LOW = 0x00000006 QTISECLIB [01f23dfd3]NOC error fatal changes in v2: -- drop the first patch (drm/msm: enable msm irq after all initializations are done successfully at msm_drm_init()) since the problem had been fixed by other patch Fixes: 570d3e5d28db ("drm/msm/dp: stop event kernel thread when DP unbind") Signed-off-by: Kuogee Hsieh Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/488387/ Link: https://lore.kernel.org/r/1654538139-7450-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Rob Clark commit b9cc4598607cb7f7eae5c75fc1e3209cd52ff5e0 Author: Miaoqian Lin Date: Tue Jun 7 15:08:38 2022 +0400 drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf of_graph_get_remote_node() returns remote device node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 86418f90a4c1 ("drm: convert drivers to use of_graph_get_remote_node") Signed-off-by: Miaoqian Lin Reviewed-by: Dmitry Baryshkov Reviewed-by: Stephen Boyd Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/488473/ Link: https://lore.kernel.org/r/20220607110841.53889-1-linmq006@gmail.com Signed-off-by: Rob Clark commit c8af219d18502c52319df8d4e3dcfe29a3ca31ab Author: Rob Clark Date: Sat Jun 18 09:11:19 2022 -0700 drm/msm: Don't overwrite hw fence in hw_init Prior to the last commit, this could result in setting the GPU written fence value back to an older value, if we had missed updating completed_fence prior to suspend. This was mostly harmless as the GPU would eventually overwrite it again with the correct value. But we should just not do this. Instead just leave a sanity check that the fence looks plausible (in case the GPU scribbled on memory). Reported-by: Steev Klimaszewski Fixes: 95d1deb02a9c ("drm/msm/gem: Add fenced vma unpin") Signed-off-by: Rob Clark Tested-by: Steev Klimaszewski Patchwork: https://patchwork.freedesktop.org/patch/490138/ Link: https://lore.kernel.org/r/20220618161120.3451993-2-robdclark@gmail.com commit 3c7a52217a8c1e674a9e15b71a7239d71a4d9cfd Author: Rob Clark Date: Sat Jun 18 09:11:18 2022 -0700 drm/msm: Drop update_fences() I noticed while looking at some traces, that we could miss calls to msm_update_fence(), as the irq could have raced with retire_submits() which could have already popped the last submit on a ring out of the queue of in-flight submits. But walking the list of submits in the irq handler isn't really needed, as dma_fence_is_signaled() will dtrt. So lets just drop it entirely. v2: use spin_lock_irqsave/restore as we are no longer protected by the spin_lock_irqsave/restore() in update_fences() Reported-by: Steev Klimaszewski Fixes: 95d1deb02a9c ("drm/msm/gem: Add fenced vma unpin") Signed-off-by: Rob Clark Tested-by: Steev Klimaszewski Patchwork: https://patchwork.freedesktop.org/patch/490136/ Link: https://lore.kernel.org/r/20220618161120.3451993-1-robdclark@gmail.com commit a2b1a5d40bd12b44322c2ccd40bb0ec1699708b6 Author: Peilin Ye Date: Thu Jun 16 16:43:36 2022 -0700 net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms As reported by Yuming, currently tc always show a latency of UINT_MAX for netem Qdisc's on 32-bit platforms: $ tc qdisc add dev dummy0 root netem latency 100ms $ tc qdisc show dev dummy0 qdisc netem 8001: root refcnt 2 limit 1000 delay 275s 275s ^^^^^^^^^^^^^^^^ Let us take a closer look at netem_dump(): qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency, UINT_MAX); qopt.latency is __u32, psched_tdiff_t is signed long, (psched_tdiff_t)(UINT_MAX) is negative for 32-bit platforms, so qopt.latency is always UINT_MAX. Fix it by using psched_time_t (u64) instead. Note: confusingly, users have two ways to specify 'latency': 1. normally, via '__u32 latency' in struct tc_netem_qopt; 2. via the TCA_NETEM_LATENCY64 attribute, which is s64. For the second case, theoretically 'latency' could be negative. This patch ignores that corner case, since it is broken (i.e. assigning a negative s64 to __u32) anyways, and should be handled separately. Thanks Ted Lin for the analysis [1] . [1] https://github.com/raspberrypi/linux/issues/3512 Reported-by: Yuming Chen Fixes: 112f9cb65643 ("netem: convert to qdisc_watchdog_schedule_ns") Reviewed-by: Cong Wang Signed-off-by: Peilin Ye Acked-by: Stephen Hemminger Link: https://lore.kernel.org/r/20220616234336.2443-1-yepeilin.cs@gmail.com Signed-off-by: Jakub Kicinski commit a3bb7b63813f674fb62bac321cdd897cc62de094 Author: Ivan Vecera Date: Thu Jun 16 18:08:55 2022 +0200 ethtool: Fix get module eeprom fallback Function fallback_set_params() checks if the module type returned by a driver is ETH_MODULE_SFF_8079 and in this case it assumes that buffer returns a concatenated content of page A0h and A2h. The check is wrong because the correct type is ETH_MODULE_SFF_8472. Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command") Signed-off-by: Ivan Vecera Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20220616160856.3623273-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 7a9214f3d88cfdb099f3896e102a306b316d8707 Author: Jay Vosburgh Date: Thu Jun 16 12:32:40 2022 -0700 bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers The bonding ARP monitor fails to decrement send_peer_notif, the number of peer notifications (gratuitous ARP or ND) to be sent. This results in a continuous series of notifications. Correct this by decrementing the counter for each notification. Reported-by: Jonathan Toppins Signed-off-by: Jay Vosburgh Fixes: b0929915e035 ("bonding: Fix RTNL: assertion failed at net/core/rtnetlink.c for ab arp monitor") Link: https://lore.kernel.org/netdev/b2fd4147-8f50-bebd-963a-1a3e8d1d9715@redhat.com/ Tested-by: Jonathan Toppins Reviewed-by: Jonathan Toppins Link: https://lore.kernel.org/r/9400.1655407960@famine Signed-off-by: Jakub Kicinski commit 3f6a57ee8544ec3982f8a3cbcbf4aea7d47eb9ec Author: Lorenzo Bianconi Date: Thu Jun 16 16:13:20 2022 +0200 igb: fix a use-after-free issue in igb_clean_tx_ring Fix the following use-after-free bug in igb_clean_tx_ring routine when the NIC is running in XDP mode. The issue can be triggered redirecting traffic into the igb NIC and then closing the device while the traffic is flowing. [ 73.322719] CPU: 1 PID: 487 Comm: xdp_redirect Not tainted 5.18.3-apu2 #9 [ 73.330639] Hardware name: PC Engines APU2/APU2, BIOS 4.0.7 02/28/2017 [ 73.337434] RIP: 0010:refcount_warn_saturate+0xa7/0xf0 [ 73.362283] RSP: 0018:ffffc9000081f798 EFLAGS: 00010282 [ 73.367761] RAX: 0000000000000000 RBX: ffffc90000420f80 RCX: 0000000000000000 [ 73.375200] RDX: ffff88811ad22d00 RSI: ffff88811ad171e0 RDI: ffff88811ad171e0 [ 73.382590] RBP: 0000000000000900 R08: ffffffff82298f28 R09: 0000000000000058 [ 73.390008] R10: 0000000000000219 R11: ffffffff82280f40 R12: 0000000000000090 [ 73.397356] R13: ffff888102343a40 R14: ffff88810359e0e4 R15: 0000000000000000 [ 73.404806] FS: 00007ff38d31d740(0000) GS:ffff88811ad00000(0000) knlGS:0000000000000000 [ 73.413129] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.419096] CR2: 000055cff35f13f8 CR3: 0000000106391000 CR4: 00000000000406e0 [ 73.426565] Call Trace: [ 73.429087] [ 73.431314] igb_clean_tx_ring+0x43/0x140 [igb] [ 73.436002] igb_down+0x1d7/0x220 [igb] [ 73.439974] __igb_close+0x3c/0x120 [igb] [ 73.444118] igb_xdp+0x10c/0x150 [igb] [ 73.447983] ? igb_pci_sriov_configure+0x70/0x70 [igb] [ 73.453362] dev_xdp_install+0xda/0x110 [ 73.457371] dev_xdp_attach+0x1da/0x550 [ 73.461369] do_setlink+0xfd0/0x10f0 [ 73.465166] ? __nla_validate_parse+0x89/0xc70 [ 73.469714] rtnl_setlink+0x11a/0x1e0 [ 73.473547] rtnetlink_rcv_msg+0x145/0x3d0 [ 73.477709] ? rtnl_calcit.isra.0+0x130/0x130 [ 73.482258] netlink_rcv_skb+0x8d/0x110 [ 73.486229] netlink_unicast+0x230/0x340 [ 73.490317] netlink_sendmsg+0x215/0x470 [ 73.494395] __sys_sendto+0x179/0x190 [ 73.498268] ? move_addr_to_user+0x37/0x70 [ 73.502547] ? __sys_getsockname+0x84/0xe0 [ 73.506853] ? netlink_setsockopt+0x1c1/0x4a0 [ 73.511349] ? __sys_setsockopt+0xc8/0x1d0 [ 73.515636] __x64_sys_sendto+0x20/0x30 [ 73.519603] do_syscall_64+0x3b/0x80 [ 73.523399] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 73.528712] RIP: 0033:0x7ff38d41f20c [ 73.551866] RSP: 002b:00007fff3b945a68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 73.559640] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff38d41f20c [ 73.567066] RDX: 0000000000000034 RSI: 00007fff3b945b30 RDI: 0000000000000003 [ 73.574457] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 73.581852] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff3b945ab0 [ 73.589179] R13: 0000000000000000 R14: 0000000000000003 R15: 00007fff3b945b30 [ 73.596545] [ 73.598842] ---[ end trace 0000000000000000 ]--- Fixes: 9cbc948b5a20c ("igb: add XDP support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Jesse Brandeburg Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/e5c01d549dc37bff18e46aeabd6fb28a7bcf84be.1655388571.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 582573f1b23df1cf7458e665e2aa3acd0551fd2c Merge: b4a028c4d031c c0f3bb4054ef0 Author: Jakub Kicinski Date: Fri Jun 17 18:30:01 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2022-06-17 We've added 12 non-merge commits during the last 4 day(s) which contain a total of 14 files changed, 305 insertions(+), 107 deletions(-). The main changes are: 1) Fix x86 JIT tailcall count offset on BPF-2-BPF call, from Jakub Sitnicki. 2) Fix a kprobe_multi link bug which misplaces BPF cookies, from Jiri Olsa. 3) Fix an infinite loop when processing a module's BTF, from Kumar Kartikeya Dwivedi. 4) Fix getting a rethook only in RCU available context, from Masami Hiramatsu. 5) Fix request socket refcount leak in sk lookup helpers, from Jon Maxwell. 6) Fix xsk xmit behavior which wrongly adds skb to already full cq, from Ciara Loftus. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: rethook: Reject getting a rethook if RCU is not watching fprobe, samples: Add use_trace option and show hit/missed counter bpf, docs: Update some of the JIT/maintenance entries selftest/bpf: Fix kprobe_multi bench test bpf: Force cookies array to follow symbols sorting ftrace: Keep address offset in ftrace_lookup_symbols selftests/bpf: Shuffle cookies symbols in kprobe multi test selftests/bpf: Test tail call counting with bpf2bpf and data on stack bpf, x86: Fix tail call count offset calculation on bpf2bpf call bpf: Limit maximum modifier chain length in btf_check_type_tags bpf: Fix request_sock leak in sk lookup helpers xsk: Fix generic transmit when completion queue reservation fails ==================== Link: https://lore.kernel.org/r/20220617202119.2421-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 0c0af88f3f318e73237f7fadd02d0bf2b6c996bb Author: Aswath Govindraju Date: Thu May 12 12:18:58 2022 +0530 arm64: dts: ti: k3-am64-main: Remove support for HS400 speed mode AM64 SoC, does not support HS400 and HS200 is the maximum supported speed mode[1]. Therefore, fix the device tree node to reflect the same. [1] - https://www.ti.com/lit/ds/symlink/am6442.pdf (SPRSP56C – JANUARY 2021 – REVISED FEBRUARY 2022) Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC") Signed-off-by: Aswath Govindraju Signed-off-by: Nishanth Menon Link: https://lore.kernel.org/r/20220512064859.32059-1-a-govindraju@ti.com commit 856216b70a41ff3f8c866b627546afa01567b389 Author: Matt Ranostay Date: Fri Jun 17 08:13:04 2022 -0700 arm64: dts: ti: k3-j721s2: Fix overlapping GICD memory region GICD region was overlapping with GICR causing the latter to not map successfully, and in turn the gic-v3 driver would fail to initialize. This issue was hidden till commit 2b2cd74a06c3 ("irqchip/gic-v3: Claim iomem resources") replaced of_iomap() calls with of_io_request_and_map() that internally called request_mem_region(). Respective console output before this patchset: [ 0.000000] GICv3: /bus@100000/interrupt-controller@1800000: couldn't map region 0 Fixes: b8545f9d3a54 ("arm64: dts: ti: Add initial support for J721S2 SoC") Cc: linux-stable@vger.kernel.org Cc: Marc Zyngier Cc: Robin Murphy Cc: Nishanth Menon Signed-off-by: Matt Ranostay Acked-by: Marc Zyngier Signed-off-by: Nishanth Menon Link: https://lore.kernel.org/r/20220617151304.446607-1-mranostay@ti.com commit 7bc08056a6dabc3a1442216daf527edf61ac24b6 Author: Andrew Donnellan Date: Tue Jun 14 23:49:52 2022 +1000 powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address Add a special case to block_rtas_call() to allow the ibm,platform-dump RTAS call through the RTAS filter if the buffer address is 0. According to PAPR, ibm,platform-dump is called with a null buffer address to notify the platform firmware that processing of a particular dump is finished. Without this, on a pseries machine with CONFIG_PPC_RTAS_FILTER enabled, an application such as rtas_errd that is attempting to retrieve a dump will encounter an error at the end of the retrieval process. Fixes: bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace") Cc: stable@vger.kernel.org Reported-by: Sathvika Vasireddy Signed-off-by: Andrew Donnellan Reviewed-by: Tyrel Datwyler Reviewed-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220614134952.156010-1-ajd@linux.ibm.com commit ec6d0dde71d760aa60316f8d1c9a1b0d99213529 Author: Naveen N. Rao Date: Thu Jun 9 16:03:28 2022 +0530 powerpc: Enable execve syscall exit tracepoint On execve[at], we are zero'ing out most of the thread register state including gpr[0], which contains the syscall number. Due to this, we fail to trigger the syscall exit tracepoint properly. Fix this by retaining gpr[0] in the thread register state. Before this patch: # tail /sys/kernel/debug/tracing/trace cat-123 [000] ..... 61.449351: sys_execve(filename: 7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8) cat-124 [000] ..... 62.428481: sys_execve(filename: 7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8) echo-125 [000] ..... 65.813702: sys_execve(filename: 7fffa6b23378, argv: 7fffa6b233a0, envp: 7fffa6b233b0) echo-125 [000] ..... 65.822214: sys_execveat(fd: 0, filename: 1009ac48, argv: 7ffff65d0c98, envp: 7ffff65d0ca8, flags: 0) After this patch: # tail /sys/kernel/debug/tracing/trace cat-127 [000] ..... 100.416262: sys_execve(filename: 7fffa41b3448, argv: 7fffa41b33e0, envp: 7fffa41b33f8) cat-127 [000] ..... 100.418203: sys_execve -> 0x0 echo-128 [000] ..... 103.873968: sys_execve(filename: 7fffa41b3378, argv: 7fffa41b33a0, envp: 7fffa41b33b0) echo-128 [000] ..... 103.875102: sys_execve -> 0x0 echo-128 [000] ..... 103.882097: sys_execveat(fd: 0, filename: 1009ac48, argv: 7fffd10d2148, envp: 7fffd10d2158, flags: 0) echo-128 [000] ..... 103.883225: sys_execveat -> 0x0 Cc: stable@vger.kernel.org Signed-off-by: Naveen N. Rao Tested-by: Sumit Dubey2 Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220609103328.41306-1-naveen.n.rao@linux.vnet.ibm.com commit e561e472a3d441753bd012333b057f48fef1045b Author: Jason A. Donenfeld Date: Sat Jun 11 17:10:15 2022 +0200 powerpc/pseries: wire up rng during setup_arch() The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call. Fortunately, each platform already has a setup_arch function pointer, which means it's easy to wire this up. This commit also removes some noisy log messages that don't add much. Fixes: a489043f4626 ("powerpc/pseries: Implement arch_get_random_long() based on H_RANDOM") Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Jason A. Donenfeld Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220611151015.548325-4-Jason@zx2c4.com commit 20a9689b3607456d92c6fb764501f6a95950b098 Author: Jason A. Donenfeld Date: Sat Jun 11 17:10:13 2022 +0200 powerpc/microwatt: wire up rng during setup_arch() The platform's RNG must be available before random_init() in order to be useful for initial seeding, which in turn means that it needs to be called from setup_arch(), rather than from an init call. Fortunately, each platform already has a setup_arch function pointer, which means it's easy to wire this up. This commit also removes some noisy log messages that don't add much. Fixes: c25769fddaec ("powerpc/microwatt: Add support for hardware random number generator") Cc: stable@vger.kernel.org # v5.14+ Signed-off-by: Jason A. Donenfeld Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220611151015.548325-2-Jason@zx2c4.com commit 6cf06c17e94f26c290fd3370a5c36514ae15ac43 Author: Michael Ellerman Date: Thu Jun 16 18:41:49 2022 +1000 powerpc/mm: Move CMA reservations after initmem_init() After commit 11ac3e87ce09 ("mm: cma: use pageblock_order as the single alignment") there is an error at boot about the KVM CMA reservation failing, eg: kvm_cma_reserve: reserving 6553 MiB for global area cma: Failed to reserve 6553 MiB That makes it impossible to start KVM guests using the hash MMU with more than 2G of memory, because the VM is unable to allocate a large enough region for the hash page table, eg: $ qemu-system-ppc64 -enable-kvm -M pseries -m 4G ... qemu-system-ppc64: Failed to allocate KVM HPT of order 25: Cannot allocate memory Aneesh pointed out that this happens because when kvm_cma_reserve() is called, pageblock_order has not been initialised yet, and is still zero, causing the checks in cma_init_reserved_mem() against CMA_MIN_ALIGNMENT_PAGES to fail. Fix it by moving the call to kvm_cma_reserve() after initmem_init(). The pageblock_order is initialised in sparse_init() which is called from initmem_init(). Also move the hugetlb CMA reservation. Fixes: 11ac3e87ce09 ("mm: cma: use pageblock_order as the single alignment") Reviewed-by: Aneesh Kumar K.V Reviewed-by: Zi Yan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220616120033.1976732-1-mpe@ellerman.id.au commit 12c3e0c92fd7cb3d3b698d84fdde7dccb6ba8822 Author: Gautam Menghani Date: Sun Jun 12 07:42:32 2022 -0700 tracing/uprobes: Remove unwanted initialization in __trace_uprobe_create() Remove the unwanted initialization of variable 'ret'. This fixes the clang scan warning: Value stored to 'ret' is never read [deadcode.DeadStores] Link: https://lkml.kernel.org/r/20220612144232.145209-1-gautammenghani201@gmail.com Signed-off-by: Gautam Menghani Signed-off-by: Steven Rostedt (Google) commit 93a8c044b9a3711d594702daea9fbe2292c73a42 Author: Xiang wangx Date: Sun Jun 5 17:27:29 2022 +0800 tracefs: Fix syntax errors in comments Delete the redundant word 'to'. Link: https://lkml.kernel.org/r/20220605092729.13010-1-wangxiang@cdjrlc.com Signed-off-by: Xiang wangx Signed-off-by: Steven Rostedt (Google) commit f4b0d318097e45cbac5e14976f8bb56aa2cef504 Author: sunliming Date: Thu Jun 2 22:06:13 2022 +0800 tracing: Simplify conditional compilation code in tracing_set_tracer() Two conditional compilation directives "#ifdef CONFIG_TRACER_MAX_TRACE" are used consecutively, and no other code in between. Simplify conditional the compilation code and only use one "#ifdef CONFIG_TRACER_MAX_TRACE". Link: https://lkml.kernel.org/r/20220602140613.545069-1-sunliming@kylinos.cn Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit 1e7769653b06b56b7ea7d56911d2d5b2957750cd Author: Kirill A. Shutemov Date: Tue Jun 14 15:01:35 2022 +0300 x86/tdx: Handle load_unaligned_zeropad() page-cross to a shared page load_unaligned_zeropad() can lead to unwanted loads across page boundaries. The unwanted loads are typically harmless. But, they might be made to totally unrelated or even unmapped memory. load_unaligned_zeropad() relies on exception fixup (#PF, #GP and now #VE) to recover from these unwanted loads. In TDX guests, the second page can be shared page and a VMM may configure it to trigger #VE. The kernel assumes that #VE on a shared page is an MMIO access and tries to decode instruction to handle it. In case of load_unaligned_zeropad() it may result in confusion as it is not MMIO access. Fix it by detecting split page MMIO accesses and failing them. load_unaligned_zeropad() will recover using exception fixups. The issue was discovered by analysis and reproduced artificially. It was not triggered during testing. [ dhansen: fix up changelogs and comments for grammar and clarity, plus incorporate Kirill's off-by-one fix] Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/20220614120135.14812-4-kirill.shutemov@linux.intel.com commit b9b6d4c925604b70d007feb4c77b8cc4c038d2da Author: Stefan Wahren Date: Wed Jun 15 23:05:34 2022 +0200 ARM: dts: bcm2711-rpi-400: Fix GPIO line names The GPIO expander line names has been fixed in the vendor tree last year, so upstream these changes. Fixes: 1c701accecf2 ("ARM: dts: Add Raspberry Pi 400 support") Reported-by: Ivan T. Ivanov Signed-off-by: Stefan Wahren Signed-off-by: Florian Fainelli commit cc72b72073ac982a954d3b43519ca1c28f03c27c Author: Masami Hiramatsu (Google) Date: Sat May 28 00:55:39 2022 +0900 tracing/kprobes: Check whether get_kretprobe() returns NULL in kretprobe_dispatcher() There is a small chance that get_kretprobe(ri) returns NULL in kretprobe_dispatcher() when another CPU unregisters the kretprobe right after __kretprobe_trampoline_handler(). To avoid this issue, kretprobe_dispatcher() checks the get_kretprobe() return value again. And if it is NULL, it returns soon because that kretprobe is under unregistering process. This issue has been introduced when the kretprobe is decoupled from the struct kretprobe_instance by commit d741bf41d7c7 ("kprobes: Remove kretprobe hash"). Before that commit, the struct kretprob_instance::rp directly points the kretprobe and it is never be NULL. Link: https://lkml.kernel.org/r/165366693881.797669.16926184644089588731.stgit@devnote2 Reported-by: Yonghong Song Fixes: d741bf41d7c7 ("kprobes: Remove kretprobe hash") Cc: Peter Zijlstra Cc: Ingo Molnar Cc: bpf Cc: Kernel Team Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Acked-by: Jiri Olsa Signed-off-by: Steven Rostedt (Google) commit 394e771684f7a2cd4e154647bff50084c31bc7cf Author: Florian Westphal Date: Wed Jun 15 15:36:54 2022 +0200 netfilter: cttimeout: fix slab-out-of-bounds read typo in cttimeout_net_exit syzbot reports: BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42 [..] list_del include/linux/list.h:148 [inline] cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617 Problem is the wrong name of the list member, so container_of() result is wrong. Reported-by: Fixes: 78222bacfca9 ("netfilter: cttimeout: decouple unlink and free on netns destruction") Signed-off-by: Florian Westphal commit 4b35035bcf80ddb47c0112c4fbd84a63a2836a18 Merge: 32efdbffff280 5ee3d10f84d0a Author: Linus Torvalds Date: Fri Jun 17 15:17:57 2022 -0500 Merge tag 'nfs-for-5.19-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Add FMODE_CAN_ODIRECT support to NFSv4 so opens don't fail - Fix trunking detection & cl_max_connect setting - Avoid pnfs_update_layout() livelocks - Don't keep retrying pNFS if the server replies with NFS4ERR_UNAVAILABLE * tag 'nfs-for-5.19-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4: Add FMODE_CAN_ODIRECT after successful open of a NFS4.x file sunrpc: set cl_max_connect when cloning an rpc_clnt pNFS: Avoid a live lock condition in pnfs_update_layout() pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE commit 32efdbffff280b304bb2cd48844ee4166078e69c Merge: 93d17c1c8c1cc a2b36ffbf5b6e Author: Linus Torvalds Date: Fri Jun 17 15:12:20 2022 -0500 Merge tag 'pci-v5.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci fix from Bjorn Helgaas: "Revert clipping of PCI host bridge windows to avoid E820 regions, which broke several machines by forcing unnecessary BAR reassignments (Hans de Goede)" * tag 'pci-v5.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: x86/PCI: Revert "x86/PCI: Clip only host bridge windows for E820 regions" commit 93d17c1c8c1cc987aad378d5266d99e46efca43c Merge: ef06e68290b2b 38335cc5ffafa Author: Linus Torvalds Date: Fri Jun 17 14:57:42 2022 -0500 Merge tag 'printk-for-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixes from Petr Mladek: "Make the global console_sem available for CPU that is handling panic() or shutdown. This is an old problem when an existing console lock owner might block console output, but it became more visible with the kthreads" * tag 'printk-for-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: Wait for the global console lock when the system is going down printk: Block console kthreads when direct printing will be required commit c0f3bb4054ef036e5f67e27f2e3cad9e6512cf00 Author: Masami Hiramatsu (Google) Date: Wed Jun 8 01:11:12 2022 +0900 rethook: Reject getting a rethook if RCU is not watching Since the rethook_recycle() will involve the call_rcu() for reclaiming the rethook_instance, the rethook must be set up at the RCU available context (non idle). This rethook_recycle() in the rethook trampoline handler is inevitable, thus the RCU available check must be done before setting the rethook trampoline. This adds a rcu_is_watching() check in the rethook_try_get() so that it will return NULL if it is called when !rcu_is_watching(). Fixes: 54ecbe6f1ed5 ("rethook: Add a generic return hook") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Daniel Borkmann Acked-by: Steven Rostedt (Google) Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/165461827269.280167.7379263615545598958.stgit@devnote2 commit c88dbbcd88c233cb759ec857b57864c5bfcea26a Author: Masami Hiramatsu (Google) Date: Wed Jun 8 01:11:02 2022 +0900 fprobe, samples: Add use_trace option and show hit/missed counter Add use_trace option to use trace_printk() instead of pr_info() so that the handler doesn't involve the RCU operations. And show the hit and missed counter so that the user can check how many times the probe handler hit and missed. Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/165461826247.280167.11939123218334322352.stgit@devnote2 commit 63ce81d1c40459e2d9d28f90e2a3e3863e2f63d4 Author: Daniel Borkmann Date: Fri Jun 17 21:42:33 2022 +0200 bpf, docs: Update some of the JIT/maintenance entries Various minor updates around some of the BPF-related entries: JITs for ARM32/NFP/SPARC/X86-32 haven't seen updates in quite a while, thus for now, mark them as 'Odd Fixes' until they become more actively developed. JITs for POWERPC/S390 are in good shape and receive active development and review, thus bump to 'Supported' similar as we have with X86-64/ARM64. JITs for MIPS/RISC-V are in similar good shape as the ones mentioned above, but looked after mostly in spare time, thus leave for now in 'Maintained' state. Add Michael to PPC JIT given he's picking up the patches there, so it better reflects today's state. Also, I haven't done much reviewing around BPF sockmap/kTLS after John and I did the big rework back in the days to integrate sockmap with kTLS. These days, most of this is taken care by John, Jakub {Sitnicki,Kicinski} and others in the community, so remove myself from these two. Lastly, move all BPF-related entries into one place, that is, move the sockmap one over near rest of BPF. Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: Alexei Starovoitov Acked-by: John Fastabend Link: https://lore.kernel.org/r/f9b8a63a0b48dc764bd4c50f87632889f5813f69.1655494758.git.daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit a2b36ffbf5b6ec301e61249c8b09e610bc80772f Author: Hans de Goede Date: Sun Jun 12 16:43:25 2022 +0200 x86/PCI: Revert "x86/PCI: Clip only host bridge windows for E820 regions" This reverts commit 4c5e242d3e93. Prior to 4c5e242d3e93 ("x86/PCI: Clip only host bridge windows for E820 regions"), E820 regions did not affect PCI host bridge windows. We only looked at E820 regions and avoided them when allocating new MMIO space. If firmware PCI bridge window and BAR assignments used E820 regions, we left them alone. After 4c5e242d3e93, we removed E820 regions from the PCI host bridge windows before looking at BARs, so firmware assignments in E820 regions looked like errors, and we moved things around to fit in the space left (if any) after removing the E820 regions. This unnecessary BAR reassignment broke several machines. Guilherme reported that Steam Deck fails to boot after 4c5e242d3e93. We clipped the window that contained most 32-bit BARs: BIOS-e820: [mem 0x00000000a0000000-0x00000000a00fffff] reserved acpi PNP0A08:00: clipped [mem 0x80000000-0xf7ffffff window] to [mem 0xa0100000-0xf7ffffff window] for e820 entry [mem 0xa0000000-0xa00fffff] which forced us to reassign all those BARs, for example, this NVMe BAR: pci 0000:00:01.2: PCI bridge to [bus 01] pci 0000:00:01.2: bridge window [mem 0x80600000-0x806fffff] pci 0000:01:00.0: BAR 0: [mem 0x80600000-0x80603fff 64bit] pci 0000:00:01.2: can't claim window [mem 0x80600000-0x806fffff]: no compatible bridge window pci 0000:01:00.0: can't claim BAR 0 [mem 0x80600000-0x80603fff 64bit]: no compatible bridge window pci 0000:00:01.2: bridge window: assigned [mem 0xa0100000-0xa01fffff] pci 0000:01:00.0: BAR 0: assigned [mem 0xa0100000-0xa0103fff 64bit] All the reassignments were successful, so the devices should have been functional at the new addresses, but some were not. Andy reported a similar failure on an Intel MID platform. Benjamin reported a similar failure on a VMWare Fusion VM. Note: this is not a clean revert; this revert keeps the later change to make the clipping dependent on a new pci_use_e820 bool, moving the checking of this bool to arch_remove_reservations(). [bhelgaas: commit log, add more reporters and testers] BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216109 Reported-by: Guilherme G. Piccoli Reported-by: Andy Shevchenko Reported-by: Benjamin Coddington Reported-by: Jongman Heo Fixes: 4c5e242d3e93 ("x86/PCI: Clip only host bridge windows for E820 regions") Link: https://lore.kernel.org/r/20220612144325.85366-1-hdegoede@redhat.com Tested-by: Guilherme G. Piccoli Tested-by: Andy Shevchenko Tested-by: Benjamin Coddington Signed-off-by: Hans de Goede Signed-off-by: Bjorn Helgaas commit ef06e68290b2b1b674950da276d6f7724e0b9874 Merge: cc2fb31d49f89 c50f11c6196f4 Author: Linus Torvalds Date: Fri Jun 17 13:55:19 2022 -0500 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Revert the moving of the jump labels initialisation before setup_machine_fdt(). The bug was fixed in drivers/char/random.c. - Ftrace fixes: branch range check and consistent handling of PLTs. - Clean rather than invalidate FROM_DEVICE buffers at start of DMA transfer (safer if such buffer is mapped in user space). A cache invalidation is done already at the end of the transfer. - A couple of clean-ups (unexport symbol, remove unused label). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer arm64/cpufeature: Unexport set_cpu_feature() arm64: ftrace: remove redundant label arm64: ftrace: consistently handle PLTs. arm64: ftrace: fix branch range checks Revert "arm64: Initialize jump labels before setup_machine_fdt()" commit cc2fb31d49f8956283e7cd25face1327dcfa4c16 Merge: f10516322ddab 03dfb4a3abc4c Author: Linus Torvalds Date: Fri Jun 17 13:50:24 2022 -0500 Merge tag 'loongarch-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Add missing ELF_DETAILS in vmlinux.lds.S and fix document rendering" * tag 'loongarch-fixes-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: docs/zh_CN/LoongArch: Fix notes rendering by using reST directives docs/LoongArch: Fix notes rendering by using reST directives LoongArch: vmlinux.lds.S: Add missing ELF_DETAILS commit f10516322ddab90e2d9b21990d8c8787c2236b26 Merge: 2d806a688f98a c836d9d17a7d1 Author: Linus Torvalds Date: Fri Jun 17 13:45:47 2022 -0500 Merge tag 'riscv-for-linus-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix for the PolarFire SOC's device tree - A handful of fixes for the recently added Svpmbt support - An improvement to the Kconfig text for Svpbmt * tag 'riscv-for-linus-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Improve description for RISCV_ISA_SVPBMT Kconfig symbol riscv: drop cpufeature_apply_feature tracking variable riscv: fix dependency for t-head errata riscv: dts: microchip: re-add pdma to mpfs device tree commit 2d806a688f98a36792e108ca8583712ee235f815 Merge: 462abc9de7a13 49d6a3c062a10 Author: Linus Torvalds Date: Fri Jun 17 13:39:12 2022 -0500 Merge tag 'hyperv-fixes-signed-20220617' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix hv_init_clocksource annotation (Masahiro Yamada) - Two bug fixes for vmbus driver (Saurabh Sengar) - Fix SEV negotiation (Tianyu Lan) - Fix comments in code (Xiang Wang) - One minor fix to HID driver (Michael Kelley) * tag 'hyperv-fixes-signed-20220617' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/Hyper-V: Add SEV negotiate protocol support in Isolation VM Drivers: hv: vmbus: Release cpu lock in error case HID: hyperv: Correctly access fields declared as __le16 clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() Drivers: hv: Fix syntax errors in comments Drivers: hv: vmbus: Don't assign VMbus channel interrupts to isolated CPUs commit 462abc9de7a13d90c5dcb81f440465041d06ba75 Merge: f8e174c3071dc b96f3cab59654 Author: Linus Torvalds Date: Fri Jun 17 11:22:58 2022 -0700 Merge tag 'block-5.19-2022-06-16' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request from Christoph - Quirks, quirks, quirks to work around buggy consumer grade devices (Keith Bush, Ning Wang, Stefan Reiter, Rasheed Hsueh) - Better kernel messages for devices that need quirking (Keith Bush) - Make a kernel message more useful (Thomas Weißschuh) - MD pull request from Song, with a few fixes - blk-mq sysfs locking fixes (Ming) - BFQ stats fix (Bart) - blk-mq offline queue fix (Bart) - blk-mq flush request tag fix (Ming) * tag 'block-5.19-2022-06-16' of git://git.kernel.dk/linux-block: block/bfq: Enable I/O statistics blk-mq: don't clear flush_rq from tags->rqs[] blk-mq: avoid to touch q->elevator without any protection blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none block: Fix handling of offline queues in blk_mq_alloc_request_hctx() md/raid5-ppl: Fix argument order in bio_alloc_bioset() Revert "md: don't unregister sync_thread with reconfig_mutex held" nvme-pci: disable write zeros support on UMIC and Samsung SSDs nvme-pci: avoid the deepest sleep state on ZHITAI TiPro7000 SSDs nvme-pci: sk hynix p31 has bogus namespace ids nvme-pci: smi has bogus namespace ids nvme-pci: phison e12 has bogus namespace ids nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S50 nvme-pci: add trouble shooting steps for timeouts nvme: add bug report info for global duplicate id nvme: add device name to warning in uuid_show() commit f8e174c3071dc7614b2a6aa41494b2756d0cd93d Merge: 5c0cd3d4a976b 6436c770f120a Author: Linus Torvalds Date: Fri Jun 17 11:14:07 2022 -0700 Merge tag 'io_uring-5.19-2022-06-16' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Bigger than usual at this time, both because we missed -rc2, but also because of some reverts that we chose to do. In detail: - Adjust mapped buffer API while we still can (Dylan) - Mapped buffer fixes (Dylan, Hao, Pavel, me) - Fix for uring_cmd wrong API usage for task_work (Dylan) - Fix for bug introduced in fixed file closing (Hao) - Fix race in buffer/file resource handling (Pavel) - Revert the NOP support for CQE32 and buffer selection that was brought up during the merge window (Pavel) - Remove IORING_CLOSE_FD_AND_FILE_SLOT introduced in this merge window. The API needs further refining, so just yank it for now and we'll revisit for a later kernel. - Series cleaning up the CQE32 support added in this merge window, making it more integrated rather than sitting on the side (Pavel)" * tag 'io_uring-5.19-2022-06-16' of git://git.kernel.dk/linux-block: (21 commits) io_uring: recycle provided buffer if we punt to io-wq io_uring: do not use prio task_work_add in uring_cmd io_uring: commit non-pollable provided mapped buffers upfront io_uring: make io_fill_cqe_aux honour CQE32 io_uring: remove __io_fill_cqe() helper io_uring: fix ->extra{1,2} misuse io_uring: fill extra big cqe fields from req io_uring: unite fill_cqe and the 32B version io_uring: get rid of __io_fill_cqe{32}_req() io_uring: remove IORING_CLOSE_FD_AND_FILE_SLOT Revert "io_uring: add buffer selection support to IORING_OP_NOP" Revert "io_uring: support CQE32 for nop operation" io_uring: limit size of provided buffer ring io_uring: fix types in provided buffer ring io_uring: fix index calculation io_uring: fix double unlock for pbuf select io_uring: kbuf: fix bug of not consuming ring buffer in partial io case io_uring: openclose: fix bug of closing wrong fixed file io_uring: fix not locked access to fixed buf table io_uring: fix races with buffer table unregister ... commit c50f11c6196f45c92ca48b16a5071615d4ae0572 Author: Will Deacon Date: Fri Jun 10 16:12:27 2022 +0100 arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer Invalidating the buffer memory in arch_sync_dma_for_device() for FROM_DEVICE transfers When using the streaming DMA API to map a buffer prior to inbound non-coherent DMA (i.e. DMA_FROM_DEVICE), we invalidate any dirty CPU cachelines so that they will not be written back during the transfer and corrupt the buffer contents written by the DMA. This, however, poses two potential problems: (1) If the DMA transfer does not write to every byte in the buffer, then the unwritten bytes will contain stale data once the transfer has completed. (2) If the buffer has a virtual alias in userspace, then stale data may be visible via this alias during the period between performing the cache invalidation and the DMA writes landing in memory. Address both of these issues by cleaning (aka writing-back) the dirty lines in arch_sync_dma_for_device(DMA_FROM_DEVICE) instead of discarding them using invalidation. Cc: Ard Biesheuvel Cc: Christoph Hellwig Cc: Robin Murphy Cc: Russell King Cc: Link: https://lore.kernel.org/r/20220606152150.GA31568@willie-the-truck Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220610151228.4562-2-will@kernel.org Signed-off-by: Catalin Marinas commit 5c0cd3d4a976b906c3953ff0a0595ba37e04aaa6 Merge: 274295c6e53f8 4bca7e80b6455 Author: Linus Torvalds Date: Fri Jun 17 10:09:24 2022 -0700 Merge tag 'fs_for_v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull writeback and ext2 fixes from Jan Kara: "A fix for writeback bug which prevented machines with kdevtmpfs from booting and also one small ext2 bugfix in IO error handling" * tag 'fs_for_v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: init: Initialize noop_backing_dev_info early ext2: fix fs corruption when trying to remove a non-empty directory with IO error commit f4470dbfb5ff92804650bc71d115c3f150d430f6 Author: Liang He Date: Thu Jun 16 10:17:13 2022 +0800 ARM: rockchip: Add missing of_node_put() in rockchip_suspend_init() In rockchip_suspend_init(), of_find_matching_node_and_match() will return a node pointer with refcount incremented. We should use of_node_put() in fail path or when it is not used anymore. Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220616021713.3973472-1-windhl@126.com Signed-off-by: Heiko Stuebner commit 274295c6e53f8b8b8dfa8b24a3fcb8a9d670c22c Merge: a96e902ba9ab8 85e123c27d5cb Author: Linus Torvalds Date: Fri Jun 17 10:03:53 2022 -0700 Merge tag 'for-5.19/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix a race in DM core's dm_start_io_acct that could result in double accounting for abnormal IO (e.g. discards, write zeroes, etc). - Fix a use-after-free in DM core's dm_put_live_table_bio. - Fix a race for REQ_NOWAIT bios being issued despite no support from underlying DM targets (due to DM table reload at an "unlucky" time) - Fix access beyond allocated bitmap in DM mirror's log. * tag 'for-5.19/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm mirror log: round up region bitmap size to BITS_PER_LONG dm: fix narrow race for REQ_NOWAIT bios being issued despite no support dm: fix use-after-free in dm_put_live_table_bio dm: fix race in dm_start_io_acct commit a96e902ba9ab88f4beb8302c9ade1d53b826a602 Merge: 7c2d03f15f52f ec41c6d82056c Author: Linus Torvalds Date: Fri Jun 17 10:02:26 2022 -0700 Merge tag 'hwmon-for-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Add missing lock protection in occ driver - Add missing comma in board name list in asus-ec-sensors driver - Fix devicetree bindings for ti,tmp401 * tag 'hwmon-for-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (asus-ec-sensors) add missing comma in board name list. hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active dt-bindings: hwmon: ti,tmp401: Drop 'items' from 'ti,n-factor' property commit 7c2d03f15f52fb92d3a0602995fd1fb8fbffd475 Merge: 79fe0f863f920 b6c8cd80ace30 Author: Linus Torvalds Date: Fri Jun 17 10:00:25 2022 -0700 Merge tag 'linux-watchdog-5.19-rc3' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog fix from Wim Van Sebroeck: "Add missing MODULE_LICENSE in gxp driver" * tag 'linux-watchdog-5.19-rc3' of git://www.linux-watchdog.org/linux-watchdog: watchdog: gxp: Add missing MODULE_LICENSE commit 79fe0f863f920c5fcf9dea61676742f813f0b7a6 Merge: f0ec9c65a8d67 abfed87e2a12b Author: Linus Torvalds Date: Fri Jun 17 08:27:27 2022 -0700 Merge tag 'v5.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a potential build failure when CRYPTO=m" * tag 'v5.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: memneq - move into lib/ commit f0ec9c65a8d67e50a16745e62a336355ddf5d03e Merge: 9afc441c3c9c5 0a35780c755cc Author: Linus Torvalds Date: Fri Jun 17 07:58:39 2022 -0700 Merge tag 'char-misc-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for 5.19-rc3 that resolve some reported issues. They include: - mei driver fixes - comedi driver fix - rtsx build warning fix - fsl-mc-bus driver fix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: eeprom: at25: Split reads into chunks and cap write size misc: atmel-ssc: Fix IRQ check in ssc_probe char: lp: remove redundant initialization of err commit 9afc441c3c9c56f80468c097d25eb1a2a14f0c95 Merge: 62dcd5e198af3 cd756dafd86ee Author: Linus Torvalds Date: Fri Jun 17 07:55:24 2022 -0700 Merge tag 'staging-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for 5.19-rc3 that resolve reported issues: - remove visorbus.h which was forgotten in the -rc1 merge where the code that used it was removed - olpc_dcon: mark as broken to allow the DRM developers to evolve the fbdev api properly without having to deal with this obsolete driver. It will be removed soon if no one steps up to adopt it and fix the issues with it. - rtl8723bs driver fix - r8188eu driver fix to resolve many reports of the driver being broken with -rc1. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: Also remove the Unisys visorbus.h staging: rtl8723bs: Allocate full pwep structure staging: olpc_dcon: mark driver as broken staging: r8188eu: Fix warning of array overflow in ioctl_linux.c staging: r8188eu: fix rtw_alloc_hwxmits error detection for now commit 62dcd5e198af3b511f3abfd0380a4d71b21b5f6b Merge: 9057a646446c7 be03b0651ffd8 Author: Linus Torvalds Date: Fri Jun 17 07:52:43 2022 -0700 Merge tag 'tty-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for 5.19-rc3 to resolve some reported problems: - 8250 lsr read bugfix - n_gsm line discipline allocation fix - qcom serial driver fix for reported lockups that happened in -rc1 - goldfish tty driver fix All have been in linux-next for a while now with no reported issues" * tag 'tty-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250: Store to lsr_save_flags after lsr read tty: goldfish: Fix free_irq() on remove tty: serial: qcom-geni-serial: Implement start_rx callback serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present. tty: n_gsm: Debug output allocation must use GFP_ATOMIC commit 9057a646446c7ff3f1e7a97d0039bde7e7936279 Merge: 47700948a4abb 0698f0209d803 Author: Linus Torvalds Date: Fri Jun 17 07:50:41 2022 -0700 Merge tag 'usb-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 5.19-rc3 They include: - new usb-serial driver device ids - usb gadget driver fixes for reported problems - cdnsp driver fix - dwc3 driver fixes for reported problems - dwc3 driver fix for merge problem that I caused in 5.18 - xhci driver fixes - dwc2 memory leak fix All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io() usb: gadget: f_fs: change ep->status safe in ffs_epfile_io() xhci: Fix null pointer dereference in resume if xhci has only one roothub USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present" usb: cdnsp: Fixed setting last_trb incorrectly usb: gadget: u_ether: fix regression in setting fixed MAC address usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe usb: dwc2: Fix memory leak in dwc2_hcd_init usb: dwc3: pci: Restore line lost in merge conflict resolution usb: dwc3: gadget: Fix IN endpoint max packet size allocation USB: serial: option: add support for Cinterion MV31 with new baseline USB: serial: io_ti: add Agilent E5805A support commit d49951219b0249d3eff49e4f02e0de82357bc8a0 Author: Tim Crawford Date: Fri Jun 17 07:30:28 2022 -0600 ALSA: hda/realtek: Add quirk for Clevo PD70PNT Fixes speaker output and headset detection on Clevo PD70PNT. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220617133028.50568-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 38335cc5ffafa111210ad6bbe5a63a87db38ee68 Merge: 12831f6486f9d b87f02307d3cf Author: Petr Mladek Date: Fri Jun 17 16:36:48 2022 +0200 Merge branch 'rework/kthreads' into for-linus commit 03dfb4a3abc4cc497850e6968b59005485592369 Author: Yanteng Si Date: Fri Jun 17 20:47:55 2022 +0800 docs/zh_CN/LoongArch: Fix notes rendering by using reST directives Notes are better expressed with reST admonitions. Fixes: f23b22599f8e ("Documentation/zh_CN: Add basic LoongArch documentations") Reviewed-by: WANG Xuerui Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen commit a667e4d3d0b021e13faad19f59cc49b706ae3d16 Author: Yanteng Si Date: Fri Jun 17 20:47:54 2022 +0800 docs/LoongArch: Fix notes rendering by using reST directives Notes are better expressed with reST admonitions. Fixes: 0ea8ce61cb2c ("Documentation: LoongArch: Add basic documentations") Reviewed-by: WANG Xuerui Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen commit b672332ef9161f8cada005aaa9b333a19e496f07 Author: Youling Tang Date: Mon Jun 13 18:54:12 2022 +0800 LoongArch: vmlinux.lds.S: Add missing ELF_DETAILS Commit c604abc3f6e ("vmlinux.lds.h: Split ELF_DETAILS from STABS_DEBUG") splits ELF_DETAILS from STABS_DEBUG, resulting in missing ELF_DETAILS information in LoongArch architecture, so add it. Fixes: c604abc3f6e ("vmlinux.lds.h: Split ELF_DETAILS from STABS_DEBUG") Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit a09b314005f3a0956ebf56e01b3b80339df577cc Author: Christoph Hellwig Date: Tue Jun 14 09:48:27 2022 +0200 block: freeze the queue earlier in del_gendisk Freeze the queue earlier in del_gendisk so that the state does not change while we remove debugfs and sysfs files. Ming mentioned that being able to observer request in debugfs might be useful while the queue is being frozen in del_gendisk, which is made possible by this change. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220614074827.458955-5-hch@lst.de Signed-off-by: Jens Axboe commit 99d055b4fd4bbb309c6cdb51a0d420669f777944 Author: Christoph Hellwig Date: Tue Jun 14 09:48:26 2022 +0200 block: remove per-disk debugfs files in blk_unregister_queue The block debugfs files are created in blk_register_queue, which is called by add_disk and use a naming scheme based on the disk_name. After del_gendisk returns that name can be reused and thus we must not leave these debugfs files around, otherwise the kernel is unhappy and spews messages like: Directory XXXXX with parent 'block' already present! and the newly created devices will not have working debugfs files. Move the unregistration to blk_unregister_queue instead (which matches the sysfs unregistration) to make sure the debugfs life time rules match those of the disk name. As part of the move also make sure the whole debugfs unregistration is inside a single debugfs_mutex critical section. Note that this breaks blktests block/002, which checks that the debugfs directory has not been removed while blktests is running, but that particular check should simply be removed from the test case. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220614074827.458955-4-hch@lst.de Signed-off-by: Jens Axboe commit 5cf9c91ba927119fc6606b938b1895bb2459d3bc Author: Christoph Hellwig Date: Tue Jun 14 09:48:25 2022 +0200 block: serialize all debugfs operations using q->debugfs_mutex Various places like I/O schedulers or the QOS infrastructure try to register debugfs files on demans, which can race with creating and removing the main queue debugfs directory. Use the existing debugfs_mutex to serialize all debugfs operations that rely on q->debugfs_dir or the directories hanging off it. To make the teardown code a little simpler declare all debugfs dentry pointers and not just the main one uncoditionally in blkdev.h. Move debugfs_mutex next to the dentries that it protects and document what it is used for. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220614074827.458955-3-hch@lst.de Signed-off-by: Jens Axboe commit 50e34d78815e474d410f342fbe783b18192ca518 Author: Christoph Hellwig Date: Tue Jun 14 09:48:24 2022 +0200 block: disable the elevator int del_gendisk The elevator is only used for file system requests, which are stopped in del_gendisk. Move disabling the elevator and freeing the scheduler tags to the end of del_gendisk instead of doing that work in disk_release and blk_cleanup_queue to avoid a use after free on q->tag_set from disk_release as the tag_set might not be alive at that point. Move the blk_qos_exit call as well, as it just depends on the elevator exit and would be the only reason to keep the not exactly cheap queue freeze in disk_release. Fixes: e155b0c238b2 ("blk-mq: Use shared tags for shared sbitmap support") Reported-by: syzbot+3e3f419f4a7816471838@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Tested-by: syzbot+3e3f419f4a7816471838@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220614074827.458955-2-hch@lst.de Signed-off-by: Jens Axboe commit e83031564137cf37e07c2d10ad468046ff48a0cf Author: Nathan Chancellor Date: Wed May 18 11:45:29 2022 -0700 riscv: Fix ALT_THEAD_PMA's asm parameters After commit a35707c3d850 ("riscv: add memory-type errata for T-Head"), builds with LLVM's integrated assembler fail like: In file included from arch/riscv/kernel/asm-offsets.c:10: In file included from ./include/linux/mm.h:29: In file included from ./include/linux/pgtable.h:6: In file included from ./arch/riscv/include/asm/pgtable.h:114: ./arch/riscv/include/asm/pgtable-64.h:210:2: error: invalid input constraint '0' in asm ALT_THEAD_PMA(prot_val); ^ ./arch/riscv/include/asm/errata_list.h:88:4: note: expanded from macro 'ALT_THEAD_PMA' : "0"(_val), \ ^ This was reported upstream to LLVM where Jessica pointed out a couple of issues with the existing implementation of ALT_THEAD_PMA: * t3 is modified but not listed in the clobbers list. * "+r"(_val) marks _val as both an input and output of the asm but then "0"(_val) marks _val as an input matching constraint, which does not make much sense in this situation, as %1 is not actually used in the asm and matching constraints are designed to be used for different inputs that need to use the same register. Drop the matching contraint and shift all the operands by one, as %1 is unused, and mark t3 as clobbered. This resolves the build error and goes not cause any problems with GNU as. Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head") Link: https://github.com/ClangBuiltLinux/linux/issues/1641 Link: https://github.com/llvm/llvm-project/issues/55514 Link: https://gcc.gnu.org/onlinedocs/gcc/Simple-Constraints.html Suggested-by: Jessica Clarke Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220518184529.454008-1-nathan@kernel.org Signed-off-by: Palmer Dabbelt commit 6436c770f120a9ffeb4e791650467f30f1d062d1 Author: Jens Axboe Date: Fri Jun 17 06:24:26 2022 -0600 io_uring: recycle provided buffer if we punt to io-wq io_arm_poll_handler() will recycle the buffer appropriately if we end up arming poll (or if we're ready to retry), but not for the io-wq case if we have attempted poll first. Explicitly recycle the buffer to avoid both hanging on to it too long, but also to avoid multiple reads grabbing the same one. This can happen for ring mapped buffers, since it hasn't necessarily been committed. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Link: https://github.com/axboe/liburing/issues/605 Signed-off-by: Jens Axboe commit 85ff37e302efdf173cff6d1a310c2f7f38f1d069 Author: Andy Shevchenko Date: Fri May 20 19:47:26 2022 +0300 gpiolib: cdev: Fix kernel doc for struct line Kernel doc validator is not happy: gpiolib-cdev.c:487: warning: Function parameter or member 'hdesc' not described in 'line' gpiolib-cdev.c:487: warning: Function parameter or member 'raw_level' not described in 'line' gpiolib-cdev.c:487: warning: Function parameter or member 'total_discard_seq' not described in 'line' gpiolib-cdev.c:487: warning: Function parameter or member 'last_seqno' not described in 'line' Describe above mentioned parameters. Fixes: 2068339a6c35 ("gpiolib: cdev: Add hardware timestamp clock type") Signed-off-by: Andy Shevchenko Acked-by: Dipen Patel Acked-by: Bartosz Golaszewski Signed-off-by: Thierry Reding commit b4a028c4d031c27704ad73b1195ca69a1206941e Author: Riccardo Paolo Bestetti Date: Fri Jun 17 10:54:35 2022 +0200 ipv4: ping: fix bind address validity check Commit 8ff978b8b222 ("ipv4/raw: support binding to nonlocal addresses") introduced a helper function to fold duplicated validity checks of bind addresses into inet_addr_valid_or_nonlocal(). However, this caused an unintended regression in ping_check_bind_addr(), which previously would reject binding to multicast and broadcast addresses, but now these are both incorrectly allowed as reported in [1]. This patch restores the original check. A simple reordering is done to improve readability and make it evident that multicast and broadcast addresses should not be allowed. Also, add an early exit for INADDR_ANY which replaces lost behavior added by commit 0ce779a9f501 ("net: Avoid unnecessary inet_addr_type() call when addr is INADDR_ANY"). Furthermore, this patch introduces regression selftests to catch these specific cases. [1] https://lore.kernel.org/netdev/CANP3RGdkAcDyAZoT1h8Gtuu0saq+eOrrTiWbxnOs+5zn+cpyKg@mail.gmail.com/ Fixes: 8ff978b8b222 ("ipv4/raw: support binding to nonlocal addresses") Cc: Miaohe Lin Reported-by: Maciej Żenczykowski Signed-off-by: Carlos Llamas Signed-off-by: Riccardo Paolo Bestetti Signed-off-by: David S. Miller commit 2b04495e21cdb9b45c28c6aeb2da560184de20a3 Author: Xu Jia Date: Fri Jun 17 17:31:06 2022 +0800 hamradio: 6pack: fix array-index-out-of-bounds in decode_std_command() Hulk Robot reports incorrect sp->rx_count_cooked value in decode_std_command(). This should be caused by the subtracting from sp->rx_count_cooked before. It seems that sp->rx_count_cooked value is changed to 0, which bypassed the previous judgment. The situation is shown below: (Thread 1) | (Thread 2) decode_std_command() | resync_tnc() ... | if (rest == 2) | sp->rx_count_cooked -= 2; | else if (rest == 3) | ... | sp->rx_count_cooked = 0; sp->rx_count_cooked -= 1; | for (i = 0; i < sp->rx_count_cooked; i++) // report error checksum += sp->cooked_buf[i]; sp->rx_count_cooked is a shared variable but is not protected by a lock. The same applies to sp->rx_count. This patch adds a lock to fix the bug. The fail log is shown below: ======================================================================= UBSAN: array-index-out-of-bounds in drivers/net/hamradio/6pack.c:925:31 index 400 is out of range for type 'unsigned char [400]' CPU: 3 PID: 7433 Comm: kworker/u10:1 Not tainted 5.18.0-rc5-00163-g4b97bac0756a #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound flush_to_ldisc Call Trace: dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_out_of_bounds.cold+0x62/0x6c sixpack_receive_buf+0xfda/0x1330 tty_ldisc_receive_buf+0x13e/0x180 tty_port_default_receive_buf+0x6d/0xa0 flush_to_ldisc+0x213/0x3f0 process_one_work+0x98f/0x1620 worker_thread+0x665/0x1080 kthread+0x2e9/0x3a0 ret_from_fork+0x1f/0x30 ... Reported-by: Hulk Robot Signed-off-by: Xu Jia Signed-off-by: David S. Miller commit 911600bf5a5e84bfda4d33ee32acc75ecf6159f0 Author: Hoang Le Date: Fri Jun 17 08:45:51 2022 +0700 tipc: fix use-after-free Read in tipc_named_reinit syzbot found the following issue on: ================================================================== BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764 CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 [...] ================================================================== In the commit d966ddcc3821 ("tipc: fix a deadlock when flushing scheduled work"), the cancel_work_sync() function just to make sure ONLY the work tipc_net_finalize_work() is executing/pending on any CPU completed before tipc namespace is destroyed through tipc_exit_net(). But this function is not guaranteed the work is the last queued. So, the destroyed instance may be accessed in the work which will try to enqueue later. In order to completely fix, we re-order the calling of cancel_work_sync() to make sure the work tipc_net_finalize_work() was last queued and it must be completed by calling cancel_work_sync(). Reported-by: syzbot+47af19f3307fc9c5c82e@syzkaller.appspotmail.com Fixes: d966ddcc3821 ("tipc: fix a deadlock when flushing scheduled work") Acked-by: Jon Maloy Signed-off-by: Ying Xue Signed-off-by: Hoang Le Signed-off-by: David S. Miller commit e66e257a5d8368d9c0ba13d4630f474436533e8b Author: Jay Vosburgh Date: Thu Jun 16 12:26:30 2022 -0700 veth: Add updating of trans_start Since commit 21a75f0915dd ("bonding: Fix ARP monitor validation"), the bonding ARP / ND link monitors depend on the trans_start time to determine link availability. NETIF_F_LLTX drivers must update trans_start directly, which veth does not do. This prevents use of the ARP or ND link monitors with veth interfaces in a bond. Resolve this by having veth_xmit update the trans_start time. Reported-by: Jonathan Toppins Tested-by: Jonathan Toppins Signed-off-by: Jay Vosburgh Fixes: 21a75f0915dd ("bonding: Fix ARP monitor validation") Link: https://lore.kernel.org/netdev/b2fd4147-8f50-bebd-963a-1a3e8d1d9715@redhat.com/ Signed-off-by: David S. Miller commit cc26c2661fefea215f41edb665193324a5f99021 Author: Eric Dumazet Date: Thu Jun 16 00:34:34 2022 -0700 net: fix data-race in dev_isalive() dev_isalive() is called under RTNL or dev_base_lock protection. This means that changes to dev->reg_state should be done with both locks held. syzbot reported: BUG: KCSAN: data-race in register_netdevice / type_show write to 0xffff888144ecf518 of 1 bytes by task 20886 on cpu 0: register_netdevice+0xb9f/0xdf0 net/core/dev.c:10050 lapbeth_new_device drivers/net/wan/lapbether.c:414 [inline] lapbeth_device_event+0x4a0/0x6c0 drivers/net/wan/lapbether.c:456 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:455 __dev_notify_flags+0x1d6/0x3a0 dev_change_flags+0xa2/0xc0 net/core/dev.c:8607 do_setlink+0x778/0x2230 net/core/rtnetlink.c:2780 __rtnl_newlink net/core/rtnetlink.c:3546 [inline] rtnl_newlink+0x114c/0x16a0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x811/0x8c0 net/core/rtnetlink.c:6089 netlink_rcv_skb+0x13e/0x240 net/netlink/af_netlink.c:2501 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6107 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x58a/0x660 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x661/0x750 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] __sys_sendto+0x21e/0x2c0 net/socket.c:2119 __do_sys_sendto net/socket.c:2131 [inline] __se_sys_sendto net/socket.c:2127 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2127 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 read to 0xffff888144ecf518 of 1 bytes by task 20423 on cpu 1: dev_isalive net/core/net-sysfs.c:38 [inline] netdev_show net/core/net-sysfs.c:50 [inline] type_show+0x24/0x90 net/core/net-sysfs.c:112 dev_attr_show+0x35/0x90 drivers/base/core.c:2095 sysfs_kf_seq_show+0x175/0x240 fs/sysfs/file.c:59 kernfs_seq_show+0x75/0x80 fs/kernfs/file.c:162 seq_read_iter+0x2c3/0x8e0 fs/seq_file.c:230 kernfs_fop_read_iter+0xd1/0x2f0 fs/kernfs/file.c:235 call_read_iter include/linux/fs.h:2052 [inline] new_sync_read fs/read_write.c:401 [inline] vfs_read+0x5a5/0x6a0 fs/read_write.c:482 ksys_read+0xe8/0x1a0 fs/read_write.c:620 __do_sys_read fs/read_write.c:630 [inline] __se_sys_read fs/read_write.c:628 [inline] __x64_sys_read+0x3e/0x50 fs/read_write.c:628 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 value changed: 0x00 -> 0x01 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 20423 Comm: udevd Tainted: G W 5.19.0-rc2-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit cbc6d44867a24130ee528c20cffcbc28b3e09693 Author: Marc Zyngier Date: Thu Jun 16 09:53:18 2022 +0100 KVM: arm64: Add Oliver as a reviewer Oliver Upton has agreed to help with reviewing the KVM/arm64 patches, and has been doing so for a while now, so adding him as to the reviewer list. Note that Oliver is using a different email address for this purpose, rather than the one his been using for his other contributions. Signed-off-by: Marc Zyngier Acked-by: Oliver Upton Link: https://lore.kernel.org/r/20220616085318.1303657-1-maz@kernel.org commit 56961c6331463cce2d84d0f973177a517fb33a82 Author: Quentin Perret Date: Thu Jun 16 16:11:34 2022 +0000 KVM: arm64: Prevent kmemleak from accessing pKVM memory Commit a7259df76702 ("memblock: make memblock_find_in_range method private") changed the API using which memory is reserved for the pKVM hypervisor. However, memblock_phys_alloc() differs from the original API in terms of kmemleak semantics -- the old one didn't report the reserved regions to kmemleak while the new one does. Unfortunately, when protected KVM is enabled, all kernel accesses to pKVM-private memory result in a fatal exception, which can now happen because of kmemleak scans: $ echo scan > /sys/kernel/debug/kmemleak [ 34.991354] kvm [304]: nVHE hyp BUG at: [] __kvm_nvhe_handle_host_mem_abort+0x270/0x290! [ 34.991580] kvm [304]: Hyp Offset: 0xfffe8be807e00000 [ 34.991813] Kernel panic - not syncing: HYP panic: [ 34.991813] PS:600003c9 PC:0000f418011a3750 ESR:00000000f2000800 [ 34.991813] FAR:ffff000439200000 HPFAR:0000000004792000 PAR:0000000000000000 [ 34.991813] VCPU:0000000000000000 [ 34.993660] CPU: 0 PID: 304 Comm: bash Not tainted 5.19.0-rc2 #102 [ 34.994059] Hardware name: linux,dummy-virt (DT) [ 34.994452] Call trace: [ 34.994641] dump_backtrace.part.0+0xcc/0xe0 [ 34.994932] show_stack+0x18/0x6c [ 34.995094] dump_stack_lvl+0x68/0x84 [ 34.995276] dump_stack+0x18/0x34 [ 34.995484] panic+0x16c/0x354 [ 34.995673] __hyp_pgtable_total_pages+0x0/0x60 [ 34.995933] scan_block+0x74/0x12c [ 34.996129] scan_gray_list+0xd8/0x19c [ 34.996332] kmemleak_scan+0x2c8/0x580 [ 34.996535] kmemleak_write+0x340/0x4a0 [ 34.996744] full_proxy_write+0x60/0xbc [ 34.996967] vfs_write+0xc4/0x2b0 [ 34.997136] ksys_write+0x68/0xf4 [ 34.997311] __arm64_sys_write+0x20/0x2c [ 34.997532] invoke_syscall+0x48/0x114 [ 34.997779] el0_svc_common.constprop.0+0x44/0xec [ 34.998029] do_el0_svc+0x2c/0xc0 [ 34.998205] el0_svc+0x2c/0x84 [ 34.998421] el0t_64_sync_handler+0xf4/0x100 [ 34.998653] el0t_64_sync+0x18c/0x190 [ 34.999252] SMP: stopping secondary CPUs [ 35.000034] Kernel Offset: disabled [ 35.000261] CPU features: 0x800,00007831,00001086 [ 35.000642] Memory Limit: none [ 35.001329] ---[ end Kernel panic - not syncing: HYP panic: [ 35.001329] PS:600003c9 PC:0000f418011a3750 ESR:00000000f2000800 [ 35.001329] FAR:ffff000439200000 HPFAR:0000000004792000 PAR:0000000000000000 [ 35.001329] VCPU:0000000000000000 ]--- Fix this by explicitly excluding the hypervisor's memory pool from kmemleak like we already do for the hyp BSS. Cc: Mike Rapoport Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Quentin Perret Acked-by: Catalin Marinas Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220616161135.3997786-1-qperret@google.com commit bb30b453fedac277d66220431fd7063d9ddc10d8 Author: Pierre-Louis Bossart Date: Thu Jun 16 17:29:10 2022 -0500 ALSA: x86: intel_hdmi_audio: use pm_runtime_resume_and_get() The current code does not check for errors and does not release the reference on errors. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220616222910.136854-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit e87c65aeb46ca4f5b7dc08531200bcb8a426c62e Author: Pierre-Louis Bossart Date: Thu Jun 16 17:29:09 2022 -0500 ALSA: x86: intel_hdmi_audio: enable pm_runtime and set autosuspend delay The existing code uses pm_runtime_get_sync/put_autosuspend, but pm_runtime was not explicitly enabled. The autosuspend delay was not set either, the value is set to 5s since HDMI is rather painful to resume. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220616222910.136854-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 6376ab02374822e1e8758a848ee736a182786a2e Author: Pierre-Louis Bossart Date: Thu Jun 16 17:05:59 2022 -0500 ALSA: hda: intel-nhlt: remove use of __func__ in dev_dbg The module and function information can be added with 'modprobe foo dyndbg=+pmf' Suggested-by: Greg KH Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220616220559.136160-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 33fa35db8917118929edacc7fdeebdcde26a6803 Author: Pierre-Louis Bossart Date: Thu Jun 16 15:10:29 2022 -0500 ALSA: hda: intel-dspcfg: use SOF for UpExtreme and UpExtreme11 boards The UpExtreme BIOS reports microphones that are not physically present, so this module ends-up selecting SOF, while the UpExtreme11 BIOS does not report microphones so the snd-hda-intel driver is selected. For consistency use SOF unconditionally in autodetection mode. The use of the snd-hda-intel driver can still be enabled with 'options snd-intel-dspcfg dsp_driver=1' Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220616201029.130477-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 2328fe7a98db3b9d46c41def169e7915dda4b9a9 Author: Jiapeng Chong Date: Wed Jun 15 21:15:03 2022 +0900 firewire: convert sysfs sprintf/snprintf family to sysfs_emit Fix the following coccicheck warning: ./drivers/firewire/core-device.c:375:8-16: WARNING: use scnprintf or sprintf. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220615121505.61412-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit dda8ad0aa8af937feb5113952fb7886c74315010 Author: Takashi Sakamoto Date: Thu May 12 20:20:37 2022 +0900 firewire: cdev: fix potential leak of kernel stack due to uninitialized value Recent change brings potential leak of value on kernel stack to userspace due to uninitialized value. This commit fixes the bug. Reported-by: Dan Carpenter Fixes: baa914cd81f5 ("firewire: add kernel API to access CYCLE_TIME register") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220512112037.103142-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 540a92bfe6dab7310b9df2e488ba247d784d0163 Author: Edward Wu Date: Fri Jun 17 11:32:20 2022 +0800 ata: libata: add qc->flags in ata_qc_complete_template tracepoint Add flags value to check the result of ata completion Fixes: 255c03d15a29 ("libata: Add tracepoints") Cc: stable@vger.kernel.org Signed-off-by: Edward Wu Signed-off-by: Damien Le Moal commit 47700948a4abb4a5ae13ef943ff682a7f327547a Merge: 0639b599f6f3c 65cf7c02cfc7c Author: Linus Torvalds Date: Thu Jun 16 21:39:51 2022 -0700 Merge tag 'drm-fixes-2022-06-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular drm fixes for rc3. Nothing too serious, i915, amdgpu and exynos all have a few small driver fixes, and two ttm fixes, and one compiler warning. atomic: - fix spurious compiler warning ttm: - add NULL ptr check in swapout code - fix bulk move handling i915: - Fix page fault on error state read - Fix memory leaks in per-gt sysfs - Fix multiple fence handling - Remove accidental static from a local variable amdgpu: - Fix regression in GTT size reporting - OLED backlight fix exynos: - Check a null pointer instead of IS_ERR() - Rework initialization code of Exynos MIC driver" * tag 'drm-fixes-2022-06-17' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Cap OLED brightness per max frame-average luminance drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl drm/exynos: mic: Rework initialization drm/exynos: fix IS_ERR() vs NULL check in probe drm/ttm: fix bulk move handling v2 drm/i915/uc: remove accidental static from a local variable drm/i915: Individualize fences before adding to dma_resv obj drm/i915/gt: Fix memory leaks in per-gt sysfs drm/i915/reset: Fix error_state_read ptr + offset use drm/ttm: fix missing NULL check in ttm_device_swapout drm/atomic: fix warning of unused variable commit 9b7fd1670a94a57d974795acebde843a5c1a354e Author: Claudiu Manoil Date: Fri Jun 10 11:40:37 2022 +0300 phy: aquantia: Fix AN when higher speeds than 1G are not advertised Even when the eth port is resticted to work with speeds not higher than 1G, and so the eth driver is requesting the phy (via phylink) to advertise up to 1000BASET support, the aquantia phy device is still advertising for 2.5G and 5G speeds. Clear these advertising defaults when requested. Cc: Ondrej Spacek Fixes: 09c4c57f7bc41 ("net: phy: aquantia: add support for auto-negotiation configuration") Signed-off-by: Claudiu Manoil Link: https://lore.kernel.org/r/20220610084037.7625-1-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit a4a8b2eea49037c1e9aa79654558b6db8cb9d121 Merge: 5e0b0a4c52d30 730067022c013 Author: Alexei Starovoitov Date: Thu Jun 16 19:42:21 2022 -0700 Merge branch 'bpf: Fix cookie values for kprobe multi' Jiri Olsa says: ==================== hi, there's bug in kprobe_multi link that makes cookies misplaced when using symbols to attach. The reason is that we sort symbols by name but not adjacent cookie values. Current test did not find it because bpf_fentry_test* are already sorted by name. v3 changes: - fixed kprobe_multi bench test to filter out invalid entries from available_filter_functions v2 changes: - rebased on top of bpf/master - checking if cookies are defined later in swap function [Andrii] - added acks thanks, jirka ==================== Signed-off-by: Alexei Starovoitov commit 730067022c0137691b27726377c2d088f7f8e33c Author: Jiri Olsa Date: Wed Jun 15 13:21:18 2022 +0200 selftest/bpf: Fix kprobe_multi bench test With [1] the available_filter_functions file contains records starting with __ftrace_invalid_address___ and marking disabled entries. We need to filter them out for the bench test to pass only resolvable symbols to kernel. [1] commit b39181f7c690 ("ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function") Fixes: b39181f7c690 ("ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20220615112118.497303-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit eb5fb0325698d05f0bf78d322de82c451a3685a2 Author: Jiri Olsa Date: Wed Jun 15 13:21:17 2022 +0200 bpf: Force cookies array to follow symbols sorting When user specifies symbols and cookies for kprobe_multi link interface it's very likely the cookies will be misplaced and returned to wrong functions (via get_attach_cookie helper). The reason is that to resolve the provided functions we sort them before passing them to ftrace_lookup_symbols, but we do not do the same sort on the cookie values. Fixing this by using sort_r function with custom swap callback that swaps cookie values as well. Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20220615112118.497303-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit eb1b2985fe5c5f02e43e4c0d47bbe7ed835007f3 Author: Jiri Olsa Date: Wed Jun 15 13:21:16 2022 +0200 ftrace: Keep address offset in ftrace_lookup_symbols We want to store the resolved address on the same index as the symbol string, because that's the user (bpf kprobe link) code assumption. Also making sure we don't store duplicates that might be present in kallsyms. Acked-by: Song Liu Acked-by: Steven Rostedt (Google) Fixes: bed0d9a50dac ("ftrace: Add ftrace_lookup_symbols function") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20220615112118.497303-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit ad8848535e97f4a5374fc68f7a5d16e2565940cc Author: Jiri Olsa Date: Wed Jun 15 13:21:15 2022 +0200 selftests/bpf: Shuffle cookies symbols in kprobe multi test There's a kernel bug that causes cookies to be misplaced and the reason we did not catch this with this test is that we provide bpf_fentry_test* functions already sorted by name. Shuffling function bpf_fentry_test2 deeper in the list and keeping the current cookie values as before will trigger the bug. The kernel fix is coming in following changes. Acked-by: Song Liu Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20220615112118.497303-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit e67679cc4264cf9b318af4e8616eaa2a7565db1f Author: Christian Marangi Date: Thu Jun 16 00:50:12 2022 +0200 mailmap: add entry for Christian Marangi Add entry to map ansuelsmth@gmail.com to the unique identity of Christian Marangi. Link: https://lkml.kernel.org/r/20220615225012.18782-1-ansuelsmth@gmail.com Signed-off-by: Christian Marangi Cc: Jens Axboe Signed-off-by: Andrew Morton commit 67f22ba7750f940bcd7e1b12720896c505c2d63f Author: zhenwei pi Date: Wed Jun 15 17:32:09 2022 +0800 mm/memory-failure: disable unpoison once hw error happens Currently unpoison_memory(unsigned long pfn) is designed for soft poison(hwpoison-inject) only. Since 17fae1294ad9d, the KPTE gets cleared on a x86 platform once hardware memory corrupts. Unpoisoning a hardware corrupted page puts page back buddy only, the kernel has a chance to access the page with *NOT PRESENT* KPTE. This leads BUG during accessing on the corrupted KPTE. Suggested by David&Naoya, disable unpoison mechanism when a real HW error happens to avoid BUG like this: Unpoison: Software-unpoisoned page 0x61234 BUG: unable to handle page fault for address: ffff888061234000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 2c01067 P4D 2c01067 PUD 107267063 PMD 10382b063 PTE 800fffff9edcb062 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 26551 Comm: stress Kdump: loaded Tainted: G M OE 5.18.0.bm.1-amd64 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ... RIP: 0010:clear_page_erms+0x7/0x10 Code: ... RSP: 0000:ffffc90001107bc8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000901 RCX: 0000000000001000 RDX: ffffea0001848d00 RSI: ffffea0001848d40 RDI: ffff888061234000 RBP: ffffea0001848d00 R08: 0000000000000901 R09: 0000000000001276 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000140dca R15: 0000000000000001 FS: 00007fd8b2333740(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888061234000 CR3: 00000001023d2005 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: prep_new_page+0x151/0x170 get_page_from_freelist+0xca0/0xe20 ? sysvec_apic_timer_interrupt+0xab/0xc0 ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 __alloc_pages+0x17e/0x340 __folio_alloc+0x17/0x40 vma_alloc_folio+0x84/0x280 __handle_mm_fault+0x8d4/0xeb0 handle_mm_fault+0xd5/0x2a0 do_user_addr_fault+0x1d0/0x680 ? kvm_read_and_reset_apf_flags+0x3b/0x50 exc_page_fault+0x78/0x170 asm_exc_page_fault+0x27/0x30 Link: https://lkml.kernel.org/r/20220615093209.259374-2-pizhenwei@bytedance.com Fixes: 847ce401df392 ("HWPOISON: Add unpoisoning support") Fixes: 17fae1294ad9d ("x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned") Signed-off-by: zhenwei pi Acked-by: David Hildenbrand Acked-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Oscar Salvador Cc: Greg Kroah-Hartman Cc: [5.8+] Signed-off-by: Andrew Morton commit 68d32527d340b0d13c8cf6495d6ab4332adca09a Author: Mike Kravetz Date: Mon Jun 13 13:36:48 2022 -0700 hugetlbfs: zero partial pages during fallocate hole punch hugetlbfs fallocate support was originally added with commit 70c3547e36f5 ("hugetlbfs: add hugetlbfs_fallocate()"). Initial support only operated on whole hugetlb pages. This makes sense for populating files as other interfaces such as mmap and truncate require hugetlb page size alignment. Only operating on whole hugetlb pages for the hole punch case was a simplification and there was no compelling use case to zero partial pages. In a recent discussion[1] it was assumed that hugetlbfs hole punch would zero partial hugetlb pages as that is in line with the man page description saying 'partial filesystem blocks are zeroed'. However, the hugetlbfs hole punch code actually does this: hole_start = round_up(offset, hpage_size); hole_end = round_down(offset + len, hpage_size); Modify code to zero partial hugetlb pages in hole punch range. It is possible that application code could note a change in behavior. However, that would imply the code is passing in an unaligned range and expecting only whole pages be removed. This is unlikely as the fallocate documentation states the opposite. The current hugetlbfs fallocate hole punch behavior is tested with the libhugetlbfs test fallocate_align[2]. This test will be updated to validate partial page zeroing. [1] https://lore.kernel.org/linux-mm/20571829-9d3d-0b48-817c-b6b15565f651@redhat.com/ [2] https://github.com/libhugetlbfs/libhugetlbfs/blob/master/tests/fallocate_align.c Link: https://lkml.kernel.org/r/YqeiMlZDKI1Kabfe@monkey Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: David Hildenbrand Cc: Naoya Horiguchi Cc: Axel Rasmussen Cc: Dave Hansen Cc: Michal Hocko Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit df4ae285a3d5ce99d69efe81b21c4fed9bbc51b9 Author: Yang Yang Date: Fri Jun 10 02:44:52 2022 +0000 mm: memcontrol: reference to tools/cgroup/memcg_slabinfo.py There is no slabinfo.py in tools/cgroup, but has memcg_slabinfo.py instead. Link: https://lkml.kernel.org/r/20220610024451.744135-1-yang.yang29@zte.com.cn Signed-off-by: Yang Yang Reviewed-by: Muchun Song Acked-by: Roman Gushchin Signed-off-by: Andrew Morton commit 034e5afad921f1c08c001bf147fb1ba76ae33498 Author: Alex Williamson Date: Fri Jun 10 16:35:13 2022 -0600 mm: re-allow pinning of zero pfns The commit referenced below subtly and inadvertently changed the logic to disallow pinning of zero pfns. This breaks device assignment with vfio and potentially various other users of gup. Exclude the zero page test from the negation. Link: https://lkml.kernel.org/r/165490039431.944052.12458624139225785964.stgit@omen Fixes: 1c563432588d ("mm: fix is_pinnable_page against a cma page") Signed-off-by: Alex Williamson Acked-by: Minchan Kim Acked-by: David Hildenbrand Reported-by: Yishai Hadas Cc: Paul E. McKenney Cc: John Hubbard Cc: John Dias Cc: Jason Gunthorpe Cc: Zhangfei Gao Cc: Matthew Wilcox Cc: Joao Martins Cc: Yi Liu Signed-off-by: Andrew Morton commit 327b18b7aaed5de3b548212e3ab75133bf323759 Author: Jason A. Donenfeld Date: Thu Jun 9 14:33:19 2022 +0200 mm/kfence: select random number before taking raw lock The RNG uses vanilla spinlocks, not raw spinlocks, so kfence should pick its random numbers before taking its raw spinlocks. This also has the nice effect of doing less work inside the lock. It should fix a splat that Geert saw with CONFIG_PROVE_RAW_LOCK_NESTING: dump_backtrace.part.0+0x98/0xc0 show_stack+0x14/0x28 dump_stack_lvl+0xac/0xec dump_stack+0x14/0x2c __lock_acquire+0x388/0x10a0 lock_acquire+0x190/0x2c0 _raw_spin_lock_irqsave+0x6c/0x94 crng_make_state+0x148/0x1e4 _get_random_bytes.part.0+0x4c/0xe8 get_random_u32+0x4c/0x140 __kfence_alloc+0x460/0x5c4 kmem_cache_alloc_trace+0x194/0x1dc __kthread_create_on_node+0x5c/0x1a8 kthread_create_on_node+0x58/0x7c printk_start_kthread.part.0+0x34/0xa8 printk_activate_kthreads+0x4c/0x54 do_one_initcall+0xec/0x278 kernel_init_freeable+0x11c/0x214 kernel_init+0x24/0x124 ret_from_fork+0x10/0x20 Link: https://lkml.kernel.org/r/20220609123319.17576-1-Jason@zx2c4.com Fixes: d4150779e60f ("random32: use real rng for non-deterministic randomness") Signed-off-by: Jason A. Donenfeld Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Reviewed-by: Marco Elver Reviewed-by: Petr Mladek Cc: John Ogness Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit 8a6f62a26d1e4e6835fbd4591c2bedcfcceadb1d Author: Huacai Chen Date: Thu Jun 16 20:14:56 2022 +0800 MAINTAINERS: add maillist information for LoongArch Now there is a dedicated maillist (loongarch@lists.linux.dev) for LoongArch, add it for better collaboration. Link: https://lkml.kernel.org/r/20220616121456.3613470-1-chenhuacai@loongson.cn Signed-off-by: Huacai Chen Reviewed-by: WANG Xuerui Cc: Huacai Chen Cc: Arnd Bergmann Cc: Xuefeng Li Cc: Guo Ren Cc: Xuerui Wang Cc: Jiaxun Yang Signed-off-by: Andrew Morton commit f0a7d33a7184df3193e4bd9ef9283a0a92bed4a6 Author: Andrew Morton Date: Wed Jun 15 14:22:44 2022 -0700 MAINTAINERS: update MM tree references Describe the new kernel.org location of the MM trees. Suggested-by: David Hildenbrand Cc: Muchun Song Cc: Greg Kroah-Hartman Cc: Miaohe Lin Signed-off-by: Andrew Morton commit 8585c3971df4bc3b909b5e7e6c7656f379d2642d Author: Abel Vesa Date: Sat Jun 11 12:31:42 2022 +0300 MAINTAINERS: update Abel Vesa's email Use Abel Vesa's kernel.org account in maintainer entry and mailmap. Link: https://lkml.kernel.org/r/20220611093142.202271-1-abelvesa@kernel.org Signed-off-by: Abel Vesa Cc: Stephen Boyd Cc: Dong Aisheng Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit 7757e7627a05c01d137a7fb87ac9d1533f460d33 Author: David Hildenbrand Date: Fri Jun 10 12:12:58 2022 +0200 MAINTAINERS: add MEMORY HOT(UN)PLUG section and add David as reviewer There are certainly a lot more files that partially fall into the memory hot(un)plug category, including parts of mm/sparse.c, mm/page_isolation.c and mm/page_alloc.c. Let's only add what's almost completely memory hot(un)plug related. Add myself as reviewer so it's easier for contributors to figure out whom to CC. Link: https://lkml.kernel.org/r/20220610101258.75738-1-david@redhat.com Link: https://lkml.kernel.org/r/YqlaE/LYHwB0gpaW@localhost.localdomain Signed-off-by: David Hildenbrand Acked-by: Muchun Song Acked-by: Greg Kroah-Hartman Cc: Miaohe Lin Signed-off-by: Andrew Morton commit 6901c0b6df157a88721e5b71f85af4c684877949 Author: Miaohe Lin Date: Tue Jun 7 22:51:35 2022 +0800 MAINTAINERS: add Miaohe Lin as a memory-failure reviewer I have been focusing on mm for the past two years. e.g. fixing bugs, cleaning up the code and reviewing. I would like to help maintainers and people working on memory-failure by reviewing their work. Let me be Cc'd on patches related to memory-failure. Link: https://lkml.kernel.org/r/20220607145135.38670-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton commit 515e1d86c982b169e77cfe245994d2a60fc0d012 Author: Jarkko Sakkinen Date: Tue Jun 7 19:41:39 2022 +0300 mailmap: add alias for jarkko@profian.com Add alias for patches that I contribute on behalf of Profian (my current employer). Link: https://lkml.kernel.org/r/20220607164140.1230876-1-jarkko@kernel.org Signed-off-by: Jarkko Sakkinen Signed-off-by: Andrew Morton commit 2949282938135ab734c3829495ae393523ceb702 Author: SeongJae Park Date: Sat Jun 4 19:50:51 2022 +0000 mm/damon/reclaim: schedule 'damon_reclaim_timer' only after 'system_wq' is initialized Commit 059342d1dd4e ("mm/damon/reclaim: fix the timer always stays active") made DAMON_RECLAIM's 'enabled' parameter store callback, 'enabled_store()', to schedule 'damon_reclaim_timer'. The scheduling uses 'system_wq', which is initialized in 'workqueue_init_early()'. As kernel parameters parsing function ('parse_args()') is called before 'workqueue_init_early()', 'enabled_store()' can be executed before 'workqueue_init_early()' and end up accessing the uninitialized 'system_wq'. As a result, the booting hang[1]. This commit fixes the issue by checking if the initialization is done before scheduling the timer. [1] https://lkml.kernel.org/20220604192222.1488-1-sj@kernel.org/ Link: https://lkml.kernel.org/r/20220604195051.1589-1-sj@kernel.org Fixes: 059342d1dd4e ("mm/damon/reclaim: fix the timer always stays active") Signed-off-by: SeongJae Park Reported-by: Greg White Cc: Hailong Tu Signed-off-by: Andrew Morton commit d25c83c6606ffc3abdf0868136ad3399f648ad70 Author: Petr Mladek Date: Tue Mar 15 11:24:44 2022 +0100 kthread: make it clear that kthread_create_on_node() might be terminated by any fatal signal The comments in kernel/kthread.c create a feeling that only SIGKILL is able to terminate the creation of kernel kthreads by kthread_create()/_on_node()/_on_cpu() APIs. In reality, wait_for_completion_killable() might be killed by any fatal signal that does not have a custom handler: (!siginmask(signr, SIG_KERNEL_IGNORE_MASK|SIG_KERNEL_STOP_MASK) && \ (t)->sighand->action[(signr)-1].sa.sa_handler == SIG_DFL) static inline void signal_wake_up(struct task_struct *t, bool resume) { signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0); } static void complete_signal(int sig, struct task_struct *p, enum pid_type type) { [...] /* * Found a killable thread. If the signal will be fatal, * then start taking the whole group down immediately. */ if (sig_fatal(p, sig) ...) { if (!sig_kernel_coredump(sig)) { [...] do { task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); sigaddset(&t->pending.signal, SIGKILL); signal_wake_up(t, 1); } while_each_thread(p, t); return; } } } Update the comments in kernel/kthread.c to make this more obvious. The motivation for this change was debugging why a module initialization failed. The module was being loaded from initrd. It "magically" failed when systemd was switching to the real root. The clean up operations sent SIGTERM to various pending processed that were started from initrd. Link: https://lkml.kernel.org/r/20220315102444.2380-1-pmladek@suse.com Signed-off-by: Petr Mladek Reviewed-by: "Eric W. Biederman" Cc: Peter Zijlstra Cc: Mathieu Desnoyers Cc: Kees Cook Cc: Marco Elver Cc: Jens Axboe Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 31733463372e8d88ea54bfa1e35178aad9b2ffd2 Author: Marcelo Tosatti Date: Mon May 30 12:51:56 2022 -0300 mm: lru_cache_disable: use synchronize_rcu_expedited commit ff042f4a9b050 ("mm: lru_cache_disable: replace work queue synchronization with synchronize_rcu") replaced lru_cache_disable's usage of work queues with synchronize_rcu. Some users reported large performance regressions due to this commit, for example: https://lore.kernel.org/all/20220521234616.GO1790663@paulmck-ThinkPad-P17-Gen-1/T/ Switching to synchronize_rcu_expedited fixes the problem. Link: https://lkml.kernel.org/r/YpToHCmnx/HEcVyR@fuller.cnet Fixes: ff042f4a9b050 ("mm: lru_cache_disable: replace work queue synchronization with synchronize_rcu") Signed-off-by: Marcelo Tosatti Tested-by: Stefan Wahren Tested-by: Michael Larabel Cc: Sebastian Andrzej Siewior Cc: Nicolas Saenz Julienne Cc: Borislav Petkov Cc: Minchan Kim Cc: Matthew Wilcox Cc: Mel Gorman Cc: Juri Lelli Cc: Thomas Gleixner Cc: Paul E. McKenney Cc: Phil Elwell Cc: Signed-off-by: Andrew Morton commit 042999388ef3dba43e813fdc6d6133ec9ca405dc Author: Yang Li Date: Thu Jun 2 14:21:16 2022 +0800 mm/page_isolation.c: fix one kernel-doc comment Remove one warning found by running scripts/kernel-doc, which is caused by using 'make W=1': mm/page_isolation.c:304: warning: Function parameter or member 'skip_isolation' not described in 'isolate_single_pageblock' Link: https://lkml.kernel.org/r/20220602062116.61199-1-yang.lee@linux.alibaba.com Signed-off-by: Yang Li Reported-by: Abaci Robot Signed-off-by: Andrew Morton commit aeaadcde1a60138bceb65de3cdaeec78170b4459 Author: Tyrel Datwyler Date: Thu Jun 16 12:11:25 2022 -0700 scsi: ibmvfc: Store vhost pointer during subcrq allocation Currently the back pointer from a queue to the vhost adapter isn't set until after subcrq interrupt registration. The value is available when a queue is first allocated and can/should be also set for primary and async queues as well as subcrqs. This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS interrupt controller where a pending subcrq interrupt from the previous kernel can be replayed immediately upon IRQ registration resulting in dereference of a garbage backpointer in ibmvfc_interrupt_scsi(). Kernel attempted to read user page (58) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000058 Faulting instruction address: 0xc008000003216a08 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c008000003216a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc] LR [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 Call Trace: [c000000047fa3d80] [c0000000123e6180] 0xc0000000123e6180 (unreliable) [c000000047fa3df0] [c0000000082079e8] __handle_irq_event_percpu+0x98/0x270 [c000000047fa3ea0] [c000000008207d18] handle_irq_event+0x98/0x188 [c000000047fa3ef0] [c00000000820f564] handle_fasteoi_irq+0xc4/0x310 [c000000047fa3f40] [c000000008205c60] generic_handle_irq+0x50/0x80 [c000000047fa3f60] [c000000008015c40] __do_irq+0x70/0x1a0 [c000000047fa3f90] [c000000008016d7c] __do_IRQ+0x9c/0x130 [c000000014622f60] [0000000020000000] 0x20000000 [c000000014622ff0] [c000000008016e50] do_IRQ+0x40/0xa0 [c000000014623020] [c000000008017044] replay_soft_interrupts+0x194/0x2f0 [c000000014623210] [c0000000080172a8] arch_local_irq_restore+0x108/0x170 [c000000014623240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0 [c000000014623270] [c00000000820b12c] __setup_irq+0x49c/0x9f0 [c000000014623310] [c00000000820b7c0] request_threaded_irq+0x140/0x230 [c000000014623380] [c008000003212a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc] [c000000014623450] [c008000003213d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc] [c0000000146234d0] [c0080000032145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc] [c000000014623550] [c0080000032147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc] [c0000000146235f0] [c00800000321a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc] Link: https://lore.kernel.org/r/20220616191126.1281259-2-tyreld@linux.ibm.com Fixes: 3034ebe26389 ("scsi: ibmvfc: Add alloc/dealloc routines for SCSI Sub-CRQ Channels") Cc: stable@vger.kernel.org Reviewed-by: Brian King Signed-off-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen commit 72ea7fe0db73d65c7d977208842d8ade9b823de9 Author: Tyrel Datwyler Date: Thu Jun 16 12:11:26 2022 -0700 scsi: ibmvfc: Allocate/free queue resource only during probe/remove Currently, the sub-queues and event pool resources are allocated/freed for every CRQ connection event such as reset and LPM. This exposes the driver to a couple issues. First the inefficiency of freeing and reallocating memory that can simply be resued after being sanitized. Further, a system under memory pressue runs the risk of allocation failures that could result in a crippled driver. Finally, there is a race window where command submission/compeletion can try to pull/return elements from/to an event pool that is being deleted or already has been deleted due to the lack of host state around freeing/allocating resources. The following is an example of list corruption following a live partition migration (LPM): Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: vfat fat isofs cdrom ext4 mbcache jbd2 nft_counter nft_compat nf_tables nfnetlink rpadlpar_io rpaphp xsk_diag nfsv3 nfs_acl nfs lockd grace fscache netfs rfkill bonding tls sunrpc pseries_rng drm drm_panel_orientation_quirks xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth vmx_crypto dm_multipath dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse CPU: 0 PID: 2108 Comm: ibmvfc_0 Kdump: loaded Not tainted 5.14.0-70.9.1.el9_0.ppc64le #1 NIP: c0000000007c4bb0 LR: c0000000007c4bac CTR: 00000000005b9a10 REGS: c00000025c10b760 TRAP: 0700 Not tainted (5.14.0-70.9.1.el9_0.ppc64le) MSR: 800000000282b033 CR: 2800028f XER: 0000000f CFAR: c0000000001f55bc IRQMASK: 0 GPR00: c0000000007c4bac c00000025c10ba00 c000000002a47c00 000000000000004e GPR04: c0000031e3006f88 c0000031e308bd00 c00000025c10b768 0000000000000027 GPR08: 0000000000000000 c0000031e3009dc0 00000031e0eb0000 0000000000000000 GPR12: c0000031e2ffffa8 c000000002dd0000 c000000000187108 c00000020fcee2c0 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 c008000002f81300 GPR24: 5deadbeef0000100 5deadbeef0000122 c000000263ba6910 c00000024cc88000 GPR28: 000000000000003c c0000002430a0000 c0000002430ac300 000000000000c300 NIP [c0000000007c4bb0] __list_del_entry_valid+0x90/0x100 LR [c0000000007c4bac] __list_del_entry_valid+0x8c/0x100 Call Trace: [c00000025c10ba00] [c0000000007c4bac] __list_del_entry_valid+0x8c/0x100 (unreliable) [c00000025c10ba60] [c008000002f42284] ibmvfc_free_queue+0xec/0x210 [ibmvfc] [c00000025c10bb10] [c008000002f4246c] ibmvfc_deregister_scsi_channel+0xc4/0x160 [ibmvfc] [c00000025c10bba0] [c008000002f42580] ibmvfc_release_sub_crqs+0x78/0x130 [ibmvfc] [c00000025c10bc20] [c008000002f4f6cc] ibmvfc_do_work+0x5c4/0xc70 [ibmvfc] [c00000025c10bce0] [c008000002f4fdec] ibmvfc_work+0x74/0x1e8 [ibmvfc] [c00000025c10bda0] [c0000000001872b8] kthread+0x1b8/0x1c0 [c00000025c10be10] [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 40820034 38600001 38210060 4e800020 7c0802a6 7c641b78 3c62fe7a 7d254b78 3863b590 f8010070 4ba309cd 60000000 <0fe00000> 7c0802a6 3c62fe7a 3863b640 ---[ end trace 11a2b65a92f8b66c ]--- ibmvfc 30000003: Send warning. Receive queue closed, will retry. Add registration/deregistration helpers that are called instead during connection resets to sanitize and reconfigure the queues. Link: https://lore.kernel.org/r/20220616191126.1281259-3-tyreld@linux.ibm.com Fixes: 3034ebe26389 ("scsi: ibmvfc: Add alloc/dealloc routines for SCSI Sub-CRQ Channels") Cc: stable@vger.kernel.org Reviewed-by: Brian King Signed-off-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen commit 1d3e0980782fbafaf93285779fd3905e4f866802 Author: Saurabh Sengar Date: Tue Jun 14 00:05:55 2022 -0700 scsi: storvsc: Correct reporting of Hyper-V I/O size limits Current code is based on the idea that the max number of SGL entries also determines the max size of an I/O request. While this idea was true in older versions of the storvsc driver when SGL entry length was limited to 4 Kbytes, commit 3d9c3dcc58e9 ("scsi: storvsc: Enable scatterlist entry lengths > 4Kbytes") removed that limitation. It's now theoretically possible for the block layer to send requests that exceed the maximum size supported by Hyper-V. This problem doesn't currently happen in practice because the block layer defaults to a 512 Kbyte maximum, while Hyper-V in Azure supports 2 Mbyte I/O sizes. But some future configuration of Hyper-V could have a smaller max I/O size, and the block layer could exceed that max. Fix this by correctly setting max_sectors as well as sg_tablesize to reflect the maximum I/O size that Hyper-V reports. While allowing I/O sizes larger than the block layer default of 512 Kbytes doesn’t provide any noticeable performance benefit in the tests we ran, it's still appropriate to report the correct underlying Hyper-V capabilities to the Linux block layer. Also tweak the virt_boundary_mask to reflect that the required alignment derives from Hyper-V communication using a 4 Kbyte page size, and not on the guest page size, which might be bigger (eg. ARM64). Link: https://lore.kernel.org/r/1655190355-28722-1-git-send-email-ssengar@linux.microsoft.com Fixes: 3d9c3dcc58e9 ("scsi: storvsc: Enable scatter list entry lengths > 4Kbytes") Reviewed-by: Michael Kelley Signed-off-by: Saurabh Sengar Signed-off-by: Martin K. Petersen commit 65cf7c02cfc7c36a3e86f3da5818dabc32c270ff Merge: d08227a8b1225 7d787184a18f0 Author: Dave Airlie Date: Fri Jun 17 11:32:22 2022 +1000 Merge tag 'exynos-drm-fixes-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes two regression fixups - Check a null pointer instead of IS_ERR(). - Rework initialization code of Exynos MIC driver. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20220614141336.88614-1-inki.dae@samsung.com commit 2acd76e7b8596e307fcec8fc6bc5fe5ab174749a Author: Bart Van Assche Date: Mon Jun 13 14:44:42 2022 -0700 scsi: ufs: Fix a race between the interrupt handler and the reset handler Prevent that both the interrupt handler and the reset handler try to complete a request at the same time. This patch is the result of an analysis of the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE 5.10.107-android13-4-00051-g1e48e8970cca-ab8664745 #1 pc : ufshcd_release_scsi_cmd+0x30/0x46c lr : __ufshcd_transfer_req_compl+0x4fc/0x9c0 Call trace: ufshcd_release_scsi_cmd+0x30/0x46c __ufshcd_transfer_req_compl+0x4fc/0x9c0 ufshcd_poll+0xf0/0x208 ufshcd_sl_intr+0xb8/0xf0 ufshcd_intr+0x168/0x2f4 __handle_irq_event_percpu+0xa0/0x30c handle_irq_event+0x84/0x178 handle_fasteoi_irq+0x150/0x2e8 __handle_domain_irq+0x114/0x1e4 gic_handle_irq.31846+0x58/0x300 el1_irq+0xe4/0x1c0 cpuidle_enter_state+0x3ac/0x8c4 do_idle+0x2fc/0x55c cpu_startup_entry+0x84/0x90 kernel_init+0x0/0x310 start_kernel+0x0/0x608 start_kernel+0x4ec/0x608 Link: https://lore.kernel.org/r/20220613214442.212466-4-bvanassche@acm.org Reviewed-by: Stanley Chu Reviewed-by: Adrian Hunter Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d1a7644648b7cdacaf8d1013a4285001911e9bc8 Author: Bart Van Assche Date: Mon Jun 13 14:44:41 2022 -0700 scsi: ufs: Support clearing multiple commands at once Modify ufshcd_clear_cmd() such that it supports clearing multiple commands at once instead of one command at a time. This change will be used in a later patch to reduce the time spent in the reset handler. Link: https://lore.kernel.org/r/20220613214442.212466-3-bvanassche@acm.org Reviewed-by: Stanley Chu Reviewed-by: Adrian Hunter Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit da8badd7d3583f447eac2ab65a332f2d773deca1 Author: Bart Van Assche Date: Mon Jun 13 14:44:40 2022 -0700 scsi: ufs: Simplify ufshcd_clear_cmd() Remove the local variable 'err'. This patch does not change any functionality. Link: https://lore.kernel.org/r/20220613214442.212466-2-bvanassche@acm.org Reviewed-by: Stanley Chu Reviewed-by: Adrian Hunter Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d08227a8b1225482aa7640e3f4849595176eac63 Merge: 3f0acf259a287 4fd17f2ac0aa4 Author: Dave Airlie Date: Fri Jun 17 11:17:37 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-06-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-06-15: amdgpu: - Fix regression in GTT size reporting - OLED backlight fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220615205609.28763-1-alexander.deucher@amd.com commit 3f0acf259a287b16ec0af8ea8b2ee3fb37575d92 Merge: 2f90ec127195d 2636e00811246 Author: Dave Airlie Date: Fri Jun 17 10:24:42 2022 +1000 Merge tag 'drm-intel-fixes-2022-06-16' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.19-rc3: - Fix page fault on error state read - Fix memory leaks in per-gt sysfs - Fix multiple fence handling - Remove accidental static from a local variable Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/8735g5xd25.fsf@intel.com commit 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 Author: Mikulas Patocka Date: Thu Jun 16 13:28:57 2022 -0400 dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit_le accesses the bitmap using unsigned long pointers. So, on 64-bit architectures, it may access 4 bytes beyond the allocated size. Fix this bug by rounding up bitset_size to BITS_PER_LONG. This bug was found by running the lvm2 testsuite with kasan. Fixes: 29121bd0b00e ("[PATCH] dm mirror log: bitset_size fix") Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 1ee88de395c3ad6791c4baeba40e83b6ec97657a Author: Mikulas Patocka Date: Thu Jun 16 14:14:39 2022 -0400 dm: fix narrow race for REQ_NOWAIT bios being issued despite no support Starting with the commit 63a225c9fd20, device mapper has an optimization that it will take cheaper table lock (dm_get_live_table_fast instead of dm_get_live_table) if the bio has REQ_NOWAIT. The bios with REQ_NOWAIT must not block in the target request routine, if they did, we would be blocking while holding rcu_read_lock, which is prohibited. The targets that are suitable for REQ_NOWAIT optimization (and that don't block in the map routine) have the flag DM_TARGET_NOWAIT set. Device mapper will test if all the targets and all the devices in a table support nowait (see the function dm_table_supports_nowait) and it will set or clear the QUEUE_FLAG_NOWAIT flag on its request queue according to this check. There's a test in submit_bio_noacct: "if ((bio->bi_opf & REQ_NOWAIT) && !blk_queue_nowait(q)) goto not_supported" - this will make sure that REQ_NOWAIT bios can't enter a request queue that doesn't support them. This mechanism works to prevent REQ_NOWAIT bios from reaching dm targets that don't support the REQ_NOWAIT flag (and that may block in the map routine) - except that there is a small race condition: submit_bio_noacct checks if the queue has the QUEUE_FLAG_NOWAIT without holding any locks. Immediatelly after this check, the device mapper table may be reloaded with a table that doesn't support REQ_NOWAIT (for example, if we start moving the logical volume or if we activate a snapshot). However the REQ_NOWAIT bio that already passed the check in submit_bio_noacct would be sent to device mapper, where it could be redirected to a dm target that doesn't support REQ_NOWAIT - the result is sleeping while we hold rcu_read_lock. In order to fix this race, we double-check if the target supports REQ_NOWAIT while we hold the table lock (so that the table can't change under us). Fixes: 563a225c9fd2 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 5d7362d0d56da3b85b19b5e5ce657026c2eef479 Author: Mikulas Patocka Date: Thu Jun 16 13:21:27 2022 -0400 dm: fix use-after-free in dm_put_live_table_bio dm_put_live_table_bio is called from the end of dm_submit_bio. However, at this point, the bio may be already finished and the caller may have freed the bio. Consequently, dm_put_live_table_bio accesses the stale "bio" pointer. Fix this bug by loading the bi_opf value and passing it to dm_get_live_table_bio and dm_put_live_table_bio instead of the bio. This bug was found by running the lvm2 testsuite with kasan. Fixes: 563a225c9fd2 ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 2f90ec127195d504439f79bbf91eb5e8d0de6ea3 Merge: b13baccc3850c 0f9cd1ea10d30 Author: Dave Airlie Date: Fri Jun 17 09:31:22 2022 +1000 Merge tag 'drm-misc-fixes-2022-06-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Two fixes for TTM, one for a NULL pointer dereference and one to make sure the buffer is pinned prior to a bulk move, and a fix for a spurious compiler warning. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220616072519.qwrsefsemejefowu@houat commit 7c05eae8db9296e28b5dd34deec1ca5ef96d0f08 Author: Steve French Date: Wed Jun 15 22:40:23 2022 -0500 smb3: add trace point for SMB2_set_eof In order to debug problems with file size being reported incorrectly temporarily (in this case xfstest generic/584 intermittent failure) we need to add trace point for the non-compounded code path where we set the file size (SMB2_set_eof). The new trace point is: "smb3_set_eof" Here is sample output from the tracepoint: TASK-PID CPU# ||||| TIMESTAMP FUNCTION | | | ||||| | | xfs_io-75403 [002] ..... 95219.189835: smb3_set_eof: xid=221 sid=0xeef1cbd2 tid=0x27079ee6 fid=0x52edb58c offset=0x100000 aio-dio-append--75418 [010] ..... 95219.242402: smb3_set_eof: xid=226 sid=0xeef1cbd2 tid=0x27079ee6 fid=0xae89852d offset=0x0 Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9b4d5c01eb234f66a15a746b1c73e10209edb199 Author: Joel Savitz Date: Thu Jun 9 16:32:17 2022 -0400 selftests: make use of GUP_TEST_FILE macro Commit 17de1e559cf1 ("selftests: clarify common error when running gup_test") had most of its hunks dropped due to a conflict with another patch accepted into Linux around the same time that implemented the same behavior as a subset of other changes. However, the remaining hunk defines the GUP_TEST_FILE macro without making use of it. This patch makes use of the macro in the two relevant places. Furthermore, the above mentioned commit's log message erroneously describes the changes that were dropped from the patch. This patch corrects the record. Fixes: 17de1e559cf1 ("selftests: clarify common error when running gup_test") Signed-off-by: Joel Savitz Reviewed-by: Shuah Khan Acked-by: Nico Pache Signed-off-by: Shuah Khan commit b96f3cab59654ee2c30e6adf0b1c13cf8c0850fa Author: Bart Van Assche Date: Mon Jun 13 09:32:34 2022 -0700 block/bfq: Enable I/O statistics BFQ uses io_start_time_ns. That member variable is only set if I/O statistics are enabled. Hence this patch that enables I/O statistics at the time BFQ is associated with a request queue. Compile-tested only. Reported-by: Cixi Geng Cc: Cixi Geng Cc: Yu Kuai Cc: Paolo Valente Reviewed-by: Jan Kara Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit 0639b599f6f3cc871a9e024481a25a7d85946eb8 Merge: 6decbf75c93e6 ef79c396c664b Author: Linus Torvalds Date: Thu Jun 16 15:53:38 2022 -0700 Merge tag 'audit-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "A single audit patch to fix a problem where we were not properly freeing memory allocated when recording information related to a module load" * tag 'audit-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: free module name commit 6decbf75c93e654ce6cb0e93a02ca6575dce9922 Merge: 48a23ec6ff2b2 cad140d00899e Author: Linus Torvalds Date: Thu Jun 16 15:50:36 2022 -0700 Merge tag 'selinux-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "A single SELinux patch to fix memory leaks when mounting filesystems with SELinux mount options" * tag 'selinux-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: free contexts previously transferred in selinux_add_opt() commit c836d9d17a7d102ded1ba4dbd4ee0bc42ba26211 Merge: a7c1c97fb1e64 924cbb8cbe346 Author: Palmer Dabbelt Date: Thu Jun 16 15:48:39 2022 -0700 RISC-V: Some Svpbmt fixes Some additionals comments and notes from autobuilders received after the series got applied, warranted some changes. * commit '924cbb8cbe3460ea192e6243017ceb0ceb255b1b': riscv: Improve description for RISCV_ISA_SVPBMT Kconfig symbol riscv: drop cpufeature_apply_feature tracking variable riscv: fix dependency for t-head errata commit 924cbb8cbe3460ea192e6243017ceb0ceb255b1b Author: Heiko Stuebner Date: Thu May 26 22:56:43 2022 +0200 riscv: Improve description for RISCV_ISA_SVPBMT Kconfig symbol This improves the symbol's description to make it easier for people to understand what it is about. Suggested-by: Christoph Hellwig Suggested-by: Philipp Tomsich Signed-off-by: Heiko Stuebner Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220526205646.258337-3-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit 237c0ee4742b6462cb41cdb3fda1ca55011e4aaf Author: Heiko Stuebner Date: Thu May 26 22:56:42 2022 +0200 riscv: drop cpufeature_apply_feature tracking variable The variable was tracking which feature patches got applied but that information was never actually used - and thus resulted in a warning as well. Drop the variable. Reported-by: kernel test robot Signed-off-by: Heiko Stuebner Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220526205646.258337-2-heiko@sntech.de Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Signed-off-by: Palmer Dabbelt commit 21f356f990262329bc387910355833378524fe9f Author: Heiko Stuebner Date: Thu May 26 22:56:45 2022 +0200 riscv: fix dependency for t-head errata alternatives only work correctly on non-xip-kernels and while the selected alternative-symbol has the correct dependency the symbol selecting it also needs that dependency. So add the missing dependency to the T-Head errata Kconfig symbol. Reported-by: kernel test robot Reviewed-by: Guo Ren Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220526205646.258337-5-heiko@sntech.de Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head") Signed-off-by: Palmer Dabbelt commit a7c1c97fb1e64b0825a2ee892d60da6fd22d3b47 Merge: f2906aa863381 5e757deddd918 Author: Palmer Dabbelt Date: Thu Jun 16 15:13:10 2022 -0700 Merge tag 'dt-fixes-for-palmer-5.19-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into fixes Microchip RISC-V devicetree fixes for 5.19-rc3 A single fix for mpfs.dtsi: - The sifive pdma entry fell through the cracks between versions of my dt patches & I gave Zong the wrong conflict resolution, so it is added back. * tag 'dt-fixes-for-palmer-5.19-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: re-add pdma to mpfs device tree commit b0017602fdf6bd3f344dd49eaee8b6ffeed6dbac Author: Dominique Martinet Date: Tue Jun 14 12:19:02 2022 +0900 9p: fix EBADF errors in cached mode cached operations sometimes need to do invalid operations (e.g. read on a write only file) Historic fscache had added a "writeback fid", a special handle opened RW as root, for this. The conversion to new fscache missed that bit. This commit reinstates a slightly lesser variant of the original code that uses the writeback fid for partial pages backfills if the regular user fid had been open as WRONLY, and thus would lack read permissions. Link: https://lkml.kernel.org/r/20220614033802.1606738-1-asmadeus@codewreck.org Fixes: eb497943fa21 ("9p: Convert to using the netfs helper lib to do reads and caching") Cc: stable@vger.kernel.org Cc: David Howells Reported-By: Christian Schoenebeck Reviewed-by: Christian Schoenebeck Tested-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit 6cfeadbff3f8905f2854735ebb88e581402c16c4 Author: Ming Lei Date: Thu Jun 16 09:44:01 2022 +0800 blk-mq: don't clear flush_rq from tags->rqs[] commit 364b61818f65 ("blk-mq: clearing flush request reference in tags->rqs[]") is added to clear the to-be-free flush request from tags->rqs[] for avoiding use-after-free on the flush rq. Yu Kuai reported that blk_mq_clear_flush_rq_mapping() slows down boot time by ~8s because running scsi probe which may create and remove lots of unpresent LUNs on megaraid-sas which uses BLK_MQ_F_TAG_HCTX_SHARED and each request queue has lots of hw queues. Improve the situation by not running blk_mq_clear_flush_rq_mapping if disk isn't added when there can't be any flush request issued. Reviewed-by: Christoph Hellwig Reported-by: Yu Kuai Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220616014401.817001-4-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 4d337cebcb1c27d9b48c48b9a98e939d4552d584 Author: Ming Lei Date: Thu Jun 16 09:44:00 2022 +0800 blk-mq: avoid to touch q->elevator without any protection q->elevator is referred in blk_mq_has_sqsched() without any protection, no .q_usage_counter is held, no queue srcu and rcu read lock is held, so potential use-after-free may be triggered. Fix the issue by adding one queue flag for checking if the elevator uses single queue style dispatch. Meantime the elevator feature flag of ELEVATOR_F_MQ_AWARE isn't needed any more. Cc: Jan Kara Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220616014401.817001-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 5fd7a84a09e640016fe106dd3e992f5210e23dc7 Author: Ming Lei Date: Thu Jun 16 09:43:59 2022 +0800 blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none elevator can be tore down by sysfs switch interface or disk release, so hold ->sysfs_lock before referring to q->elevator, then potential use-after-free can be avoided. Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220616014401.817001-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 Author: Bart Van Assche Date: Wed Jun 15 14:00:04 2022 -0700 block: Fix handling of offline queues in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Cc: Christoph Hellwig Cc: Ming Lei Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU") Signed-off-by: Bart Van Assche Reviewed-by: Christoph Hellwig Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit 3084a4ec7f9bb1ec90036cfd01b1abadc5dd4fb2 Author: Ding Xiang Date: Wed Jun 15 17:36:29 2022 +0800 selftests: vm: Fix resource leak when return error When return on an error path, file handle need to be closed to prevent resource leak Signed-off-by: Ding Xiang Reviewed-by: Shuah Khan Signed-off-by: Shuah Khan commit 12a29115be72dfc72372af9ded4bc4ae7113a729 Author: Yu Liao Date: Tue Jun 14 20:02:35 2022 +0800 selftests dma: fix compile error for dma_map_benchmark When building selftests/dma: $ make -C tools/testing/selftests TARGETS=dma I hit the following compilation error: dma_map_benchmark.c:13:10: fatal error: linux/map_benchmark.h: No such file or directory #include ^~~~~~~~~~~~~~~~~~~~~~~ dma/Makefile does not include the map_benchmark.h path, so add more including path, and fix include order in dma_map_benchmark.c Fixes: 8ddde07a3d28 ("dma-mapping: benchmark: extract a common header file for map_benchmark definition") Signed-off-by: Yu Liao Tested-by: Shuah Khan Signed-off-by: Shuah Khan commit 5e0b0a4c52d30bb09659446f40b77a692361600d Author: Jakub Sitnicki Date: Thu Jun 16 18:20:37 2022 +0200 selftests/bpf: Test tail call counting with bpf2bpf and data on stack Cover the case when tail call count needs to be passed from BPF function to BPF function, and the caller has data on stack. Specifically when the size of data allocated on BPF stack is not a multiple on 8. Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220616162037.535469-3-jakub@cloudflare.com commit ff672c67ee7635ca1e28fb13729e8ef0d1f08ce5 Author: Jakub Sitnicki Date: Thu Jun 16 18:20:36 2022 +0200 bpf, x86: Fix tail call count offset calculation on bpf2bpf call On x86-64 the tail call count is passed from one BPF function to another through %rax. Additionally, on function entry, the tail call count value is stored on stack right after the BPF program stack, due to register shortage. The stored count is later loaded from stack either when performing a tail call - to check if we have not reached the tail call limit - or before calling another BPF function call in order to pass it via %rax. In the latter case, we miscalculate the offset at which the tail call count was stored on function entry. The JIT does not take into account that the allocated BPF program stack is always a multiple of 8 on x86, while the actual stack depth does not have to be. This leads to a load from an offset that belongs to the BPF stack, as shown in the example below: SEC("tc") int entry(struct __sk_buff *skb) { /* Have data on stack which size is not a multiple of 8 */ volatile char arr[1] = {}; return subprog_tail(skb); } int entry(struct __sk_buff * skb): 0: (b4) w2 = 0 1: (73) *(u8 *)(r10 -1) = r2 2: (85) call pc+1#bpf_prog_ce2f79bb5f3e06dd_F 3: (95) exit int entry(struct __sk_buff * skb): 0xffffffffa0201788: nop DWORD PTR [rax+rax*1+0x0] 0xffffffffa020178d: xor eax,eax 0xffffffffa020178f: push rbp 0xffffffffa0201790: mov rbp,rsp 0xffffffffa0201793: sub rsp,0x8 0xffffffffa020179a: push rax 0xffffffffa020179b: xor esi,esi 0xffffffffa020179d: mov BYTE PTR [rbp-0x1],sil 0xffffffffa02017a1: mov rax,QWORD PTR [rbp-0x9] !!! tail call count 0xffffffffa02017a8: call 0xffffffffa02017d8 !!! is at rbp-0x10 0xffffffffa02017ad: leave 0xffffffffa02017ae: ret Fix it by rounding up the BPF stack depth to a multiple of 8, when calculating the tail call count offset on stack. Fixes: ebf7d1f508a7 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT") Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220616162037.535469-2-jakub@cloudflare.com commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447 Author: Tejun Heo Date: Mon Jun 13 12:19:50 2022 -1000 cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tasks about. This is done by linking cset->mg_preload_node on either the mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the same cset->mg_preload_node for both the src and dst lists was deemed okay as a cset can't be both the source and destination at the same time. Unfortunately, this overloading becomes problematic when multiple tasks are involved in a migration and some of them are identity noop migrations while others are actually moving across cgroups. For example, this can happen with the following sequence on cgroup1: #1> mkdir -p /sys/fs/cgroup/misc/a/b #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS & #4> PID=$! #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs the process including the group leader back into a. In this final migration, non-leader threads would be doing identity migration while the group leader is doing an actual one. After #3, let's say the whole process was in cset A, and that after #4, the leader moves to cset B. Then, during #6, the following happens: 1. cgroup_migrate_add_src() is called on B for the leader. 2. cgroup_migrate_add_src() is called on A for the other threads. 3. cgroup_migrate_prepare_dst() is called. It scans the src list. 4. It notices that B wants to migrate to A, so it tries to A to the dst list but realizes that its ->mg_preload_node is already busy. 5. and then it notices A wants to migrate to A as it's an identity migration, it culls it by list_del_init()'ing its ->mg_preload_node and putting references accordingly. 6. The rest of migration takes place with B on the src list but nothing on the dst list. This means that A isn't held while migration is in progress. If all tasks leave A before the migration finishes and the incoming task pins it, the cset will be destroyed leading to use-after-free. This is caused by overloading cset->mg_preload_node for both src and dst preload lists. We wanted to exclude the cset from the src list but ended up inadvertently excluding it from the dst list too. This patch fixes the issue by separating out cset->mg_preload_node into ->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst preloadings don't interfere with each other. Signed-off-by: Tejun Heo Reported-by: Mukesh Ojha Reported-by: shisiyuan Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com Link: https://www.spinics.net/lists/cgroups/msg33313.html Fixes: f817de98513d ("cgroup: prepare migration path for unified hierarchy") Cc: stable@vger.kernel.org # v3.16+ commit 48a23ec6ff2b2a5effe8d3ae5f17fc6b7f35df65 Merge: 30306f6194cad 2e7bf4a6af482 Author: Linus Torvalds Date: Thu Jun 16 11:51:32 2022 -0700 Merge tag 'net-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Mostly driver fixes. Current release - regressions: - Revert "net: Add a second bind table hashed by port and address", needs more work - amd-xgbe: use platform_irq_count(), static setup of IRQ resources had been removed from DT core - dts: at91: ksz9477_evb: add phy-mode to fix port/phy validation Current release - new code bugs: - hns3: modify the ring param print info Previous releases - always broken: - axienet: make the 64b addressable DMA depends on 64b architectures - iavf: fix issue with MAC address of VF shown as zero - ice: fix PTP TX timestamp offset calculation - usb: ax88179_178a needs FLAG_SEND_ZLP Misc: - document some net.sctp.* sysctls" * tag 'net-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (31 commits) net: axienet: add missing error return code in axienet_probe() Revert "net: Add a second bind table hashed by port and address" net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg net: usb: ax88179_178a needs FLAG_SEND_ZLP MAINTAINERS: add include/dt-bindings/net to NETWORKING DRIVERS ARM: dts: at91: ksz9477_evb: fix port/phy validation net: bgmac: Fix an erroneous kfree() in bgmac_remove() ice: Fix memory corruption in VF driver ice: Fix queue config fail handling ice: Sync VLAN filtering features for DVM ice: Fix PTP TX timestamp offset calculation mlxsw: spectrum_cnt: Reorder counter pools docs: networking: phy: Fix a typo amd-xgbe: Use platform_irq_count() octeontx2-vf: Add support for adaptive interrupt coalescing xilinx: Fix build on x86. net: axienet: Use iowrite64 to write all 64b descriptor pointers net: axienet: make the 64b addresable DMA depends on 64b archectures net: hns3: fix tm port shapping of fibre port is incorrect after driver initialization net: hns3: fix PF rss size initialization bug ... commit 2e7bf4a6af482f73f01245f08b4a953412c77070 Author: Yang Yingliang Date: Thu Jun 16 14:29:17 2022 +0800 net: axienet: add missing error return code in axienet_probe() It should return error code in error path in axienet_probe(). Fixes: 00be43a74ca2 ("net: axienet: make the 64b addresable DMA depends on 64b archectures") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220616062917.3601-1-yangyingliang@huawei.com Signed-off-by: Jakub Kicinski commit 593d1ebe00a45af5cb7bda1235c0790987c2a2b2 Author: Joanne Koong Date: Wed Jun 15 12:32:13 2022 -0700 Revert "net: Add a second bind table hashed by port and address" This reverts: commit d5a42de8bdbe ("net: Add a second bind table hashed by port and address") commit 538aaf9b2383 ("selftests: Add test for timing a bind request to a port with a populated bhash entry") Link: https://lore.kernel.org/netdev/20220520001834.2247810-1-kuba@kernel.org/ There are a few things that need to be fixed here: * Updating bhash2 in cases where the socket's rcv saddr changes * Adding bhash2 hashbucket locks Links to syzbot reports: https://lore.kernel.org/netdev/00000000000022208805e0df247a@google.com/ https://lore.kernel.org/netdev/0000000000003f33bc05dfaf44fe@google.com/ Fixes: d5a42de8bdbe ("net: Add a second bind table hashed by port and address") Reported-by: syzbot+015d756bbd1f8b5c8f09@syzkaller.appspotmail.com Reported-by: syzbot+98fd2d1422063b0f8c44@syzkaller.appspotmail.com Reported-by: syzbot+0a847a982613c6438fba@syzkaller.appspotmail.com Signed-off-by: Joanne Koong Link: https://lore.kernel.org/r/20220615193213.2419568-1-joannelkoong@gmail.com Signed-off-by: Jakub Kicinski commit 3f77a1d0570e62cfce8d472319df00008bbeab38 Author: Mark Brown Date: Wed Jun 15 20:15:04 2022 +0100 arm64/cpufeature: Unexport set_cpu_feature() We currently export set_cpu_feature() to modules but there are no in tree users that can be built as modules and it is hard to see cases where it would make sense for there to be any such users. Remove the export to avoid anyone else having to worry about why it is there and ensure that any users that do get added get a bit more visiblity. Signed-off-by: Mark Brown Acked-by: Suzuki K Poulose Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220615191504.626604-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit 8d5459c11f548131ce48b2fbf45cccc5c382558f Author: Jan Kara Date: Fri May 20 13:14:02 2022 +0200 ext4: improve write performance with disabled delalloc When delayed allocation is disabled (either through mount option or because we are running low on free space), ext4_write_begin() allocates blocks with EXT4_GET_BLOCKS_IO_CREATE_EXT flag. With this flag extent merging is disabled and since ext4_write_begin() is called for each page separately, we end up with a *lot* of 1 block extents in the extent tree and following writeback is writing 1 block at a time which results in very poor write throughput (4 MB/s instead of 200 MB/s). These days when ext4_get_block_unwritten() is used only by ext4_write_begin(), ext4_page_mkwrite() and inline data conversion, we can safely allow extent merging to happen from these paths since following writeback will happen on different boundaries anyway. So use EXT4_GET_BLOCKS_CREATE_UNRIT_EXT instead which restores the performance. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220520111402.4252-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 4deb96e35c5c3ebfeb9cf567f3ba80fa54e2cec1 Author: Robin Murphy Date: Thu Jun 16 14:46:46 2022 +0100 irqchip/gicv3: Handle resource request failure consistently Due to a silly oversight on my part, making the simple switch to of_io_request_and_map() in the DT path inadvertently introduced divergent behaviour, whereby failng to request an iomem region now becomes fatal for DT, vs. being silently ignored for ACPI. Refactor a bit harder, so that request errors are non-fatal in both paths as intended, but also consistently reported as well. Reported-by: Matt Ranostay Fixes: 2b2cd74a06c3 ("irqchip/gic-v3: Claim iomem resources") Signed-off-by: Robin Murphy Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/5f2b57a0131f3082fae9d3002d360bf784ccb092.1655387206.git.robin.murphy@arm.com commit 15baa7dcadf1c4f0b4f752dc054191855ff2d78e Author: Zhang Yi Date: Fri May 20 10:32:16 2022 +0800 ext4: fix warning when submitting superblock in ext4_commit_super() We have already check the io_error and uptodate flag before submitting the superblock buffer, and re-set the uptodate flag if it has been failed to write out. But it was lockless and could be raced by another ext4_commit_super(), and finally trigger '!uptodate' WARNING when marking buffer dirty. Fix it by submit buffer directly. Reported-by: Hulk Robot Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/20220520023216.3065073-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 32fc810b364f3dd30930c594e461ffa1761fef39 Author: Dylan Yudaken Date: Thu Jun 16 06:50:11 2022 -0700 io_uring: do not use prio task_work_add in uring_cmd io_req_task_prio_work_add has a strict assumption that it will only be used with io_req_task_complete. There is a codepath that assumes this is the case and will not even call the completion function if it is hit. For uring_cmd with an arbitrary completion function change the call to the correct non-priority version. Fixes: ee692a21e9bf8 ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Dylan Yudaken Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20220616135011.441980-1-dylany@fb.com Signed-off-by: Jens Axboe commit 3103084afcf2341e12b0ee2c7b2ed570164f44a2 Author: Wang Jianjian Date: Fri May 20 10:22:55 2022 +0800 ext4, doc: remove unnecessary escaping Signed-off-by: Wang Jianjian Link: https://lore.kernel.org/r/20220520022255.2120576-2-wangjianjian3@huawei.com Signed-off-by: Theodore Ts'o commit 48e02e6113825db81e4aacc035933c0d0e4e68ce Author: Wang Jianjian Date: Fri May 20 10:22:54 2022 +0800 ext4: fix incorrect comment in ext4_bio_write_page() Signed-off-by: Wang Jianjian Link: https://lore.kernel.org/r/20220520022255.2120576-1-wangjianjian3@huawei.com Signed-off-by: Theodore Ts'o commit 06781a5026350cde699d2d10c9914a25c1524f45 Author: Sascha Hauer Date: Tue Jun 14 10:31:38 2022 +0200 mtd: rawnand: gpmi: Fix setting busy timeout setting The DEVICE_BUSY_TIMEOUT value is described in the Reference Manual as: | Timeout waiting for NAND Ready/Busy or ATA IRQ. Used in WAIT_FOR_READY | mode. This value is the number of GPMI_CLK cycles multiplied by 4096. So instead of multiplying the value in cycles with 4096, we have to divide it by that value. Use DIV_ROUND_UP to make sure we are on the safe side, especially when the calculated value in cycles is smaller than 4096 as typically the case. This bug likely never triggered because any timeout != 0 usually will do. In my case the busy timeout in cycles was originally calculated as 2408, which multiplied with 4096 is 0x968000. The lower 16 bits were taken for the 16 bit wide register field, so the register value was 0x8000. With 2970bf5a32f0 ("mtd: rawnand: gpmi: fix controller timings setting") however the value in cycles became 2384, which multiplied with 4096 is 0x950000. The lower 16 bit are 0x0 now resulting in an intermediate timeout when reading from NAND. Fixes: b1206122069aa ("mtd: rawnand: gpmi: use core timings instead of an empirical derivation") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220614083138.3455683-1-s.hauer@pengutronix.de commit 4f5bf12732fd78e225fc62b7c5c84d9032f8048a Author: Yang Li Date: Thu May 12 15:54:32 2022 +0800 fs: fix jbd2_journal_try_to_free_buffers() kernel-doc comment Add the description of @folio and remove @page in function kernel-doc comment to remove warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. fs/jbd2/transaction.c:2149: warning: Function parameter or member 'folio' not described in 'jbd2_journal_try_to_free_buffers' fs/jbd2/transaction.c:2149: warning: Excess function parameter 'page' description in 'jbd2_journal_try_to_free_buffers' Reported-by: Abaci Robot Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20220512075432.31763-1-yang.lee@linux.alibaba.com Signed-off-by: Theodore Ts'o commit a76c0b31eef50fdb8b21d53a6d050f59241fb88e Author: Jens Axboe Date: Wed Jun 15 19:51:11 2022 -0600 io_uring: commit non-pollable provided mapped buffers upfront For recv/recvmsg, IO either completes immediately or gets queued for a retry. This isn't the case for read/readv, if eg a normal file or a block device is used. Here, an operation can get queued with the block layer. If this happens, ring mapped buffers must get committed immediately to avoid that the next read can consume the same buffer. Check if we're dealing with pollable file, when getting a new ring mapped provided buffer. If it's not, commit it immediately rather than wait post issue. If we don't wait, we can race with completions coming in, or just plain buffer reuse by committing after a retry where others could have grabbed the same buffer. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit 30f8c74ca9b7b3a2db55f6bb1d2e9f8c47a79f94 Author: Maxime Ripard Date: Fri Jun 10 13:51:49 2022 +0200 drm/vc4: Warn if some v3d code is run on BCM2711 The BCM2711 has a separate driver for the v3d, and thus we can't call into any of the driver entrypoints that rely on the v3d being there. Let's add a bunch of checks and complain loudly if that ever happen. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-15-maxime@cerno.tech commit d19e00ee06a9abf590b178c34cad637a516752f8 Author: Maxime Ripard Date: Fri Jun 10 13:51:48 2022 +0200 drm/vc4: crtc: Fix out of order frames during asynchronous page flips When doing an asynchronous page flip (PAGE_FLIP ioctl with the DRM_MODE_PAGE_FLIP_ASYNC flag set), the current code waits for the possible GPU buffer being rendered through a call to vc4_queue_seqno_cb(). On the BCM2835-37, the GPU driver is part of the vc4 driver and that function is defined in vc4_gem.c to wait for the buffer to be rendered, and once it's done, call a callback. However, on the BCM2711 used on the RaspberryPi4, the GPU driver is separate (v3d) and that function won't do anything. This was working because we were going into a path, due to uninitialized variables, that was always scheduling the callback. However, we were never actually waiting for the buffer to be rendered which was resulting in frames being displayed out of order. The generic API to signal those kind of completion in the kernel are the DMA fences, and fortunately the v3d drivers supports them and signal when its job is done. That API also provides an equivalent function that allows to have a callback being executed when the fence is signalled as done. Let's change our driver a bit to rely on the previous function for the older SoCs, and on DMA fences for the BCM2711. Signed-off-by: Maxime Ripard Reviewed-by: Melissa Wen Link: https://lore.kernel.org/r/20220610115149.964394-14-maxime@cerno.tech commit d87db1c79d6f9ec5505be2ff4ca8811d6e88a667 Author: Maxime Ripard Date: Fri Jun 10 13:51:47 2022 +0200 drm/vc4: crtc: Don't call into BO Handling on Async Page-Flips on BCM2711 The BCM2711 doesn't have a v3d GPU so we don't want to call into its BO management code. Let's create an asynchronous page-flip handler for the BCM2711 that just calls into the common code. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-13-maxime@cerno.tech commit f6766fb265b18248d2c4bc643eb99e853f293dd6 Author: Maxime Ripard Date: Fri Jun 10 13:51:46 2022 +0200 drm/vc4: crtc: Move the BO Handling out of Common Page-Flip Handler The function vc4_async_page_flip() handles asynchronous page-flips in the vc4 driver. However, it mixes some generic code with code that should only be run on older generations that have the GPU handled by the vc4 driver. Let's split the generic part out of vc4_async_page_flip() and into a common function that we be reusable by an handler made for the BCM2711. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-12-maxime@cerno.tech commit 4d12c36fb73b5c49fe2f95d06515fd9846010fd2 Author: Maxime Ripard Date: Fri Jun 10 13:51:45 2022 +0200 drm/vc4: crtc: Move the BO handling out of common page-flip callback We'll soon introduce another completion callback source that won't need to use the BO reference counting, so let's move it around to create a function we will be able to share between both callbacks. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-11-maxime@cerno.tech commit 2523e9dcc3be91bf9fdc0d1e542557ca00bbef42 Author: Maxime Ripard Date: Fri Jun 10 13:51:44 2022 +0200 drm/vc4: crtc: Use an union to store the page flip callback We'll need to extend the vc4_async_flip_state structure to rely on another callback implementation, so let's move the current one into a union. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-10-maxime@cerno.tech commit 257add942a477bb99bdf4bacc6190703f796dcff Author: Maxime Ripard Date: Fri Jun 10 13:51:43 2022 +0200 drm/vc4: drv: Skip BO Backend Initialization on BCM2711 On the BCM2711, we currently call the vc4_bo_cache_init() and vc4_gem_init() functions. These functions initialize the BO and GEM backends. However, this code was initially created to accomodate the requirements of the GPU on the older SoCs, while the BCM2711 has a separate driver for it. So let's just skip these calls when we're on a newer hardware. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-9-maxime@cerno.tech commit 2095848661481e31339b32847acf7759b5635f38 Author: Maxime Ripard Date: Fri Jun 10 13:51:42 2022 +0200 drm/vc4: plane: Register a different drm_plane_helper_funcs on BCM2711 On the BCM2711, our current definition of drm_plane_helper_funcs uses the custom vc4_prepare_fb() and vc4_cleanup_fb(). Those functions rely on the buffer allocation path that was relying on the GPU, and is no longer relevant. Let's create another drm_plane_helper_funcs structure that we will register on the BCM2711. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-8-maxime@cerno.tech commit 39a30ec64510f71d2a9f5059a7fc1283c4108a35 Author: Maxime Ripard Date: Fri Jun 10 13:51:41 2022 +0200 drm/vc4: kms: Register a different drm_mode_config_funcs on BCM2711 On the BCM2711, our current definition of drm_mode_config_funcs uses the custom vc4_fb_create(). However, that function relies on the buffer allocation path that was relying on the GPU, and is no longer relevant. Let's create another drm_mode_config_funcs structure that we will register on the BCM2711. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-7-maxime@cerno.tech commit 538f111160618ef56743a5302e114530edb7df77 Author: Maxime Ripard Date: Fri Jun 10 13:51:40 2022 +0200 drm/vc4: drv: Register a different driver on BCM2711 Prior to the BCM2711/RaspberryPi4, the GPU was a part of the display components of the SoC. It was thus a part of the vc4 driver. However, with the BCM2711, it got split out and thus the v3d driver was created. The vc4 driver now only handles the display part. We didn't properly split out the code when doing the BCM2711 support though, and most of the code around buffer allocations is still involved, even though it doesn't have the backing hardware anymore. Let's start the split out by creating a new drm_driver that only reports and uses what we support on the BCM2711. The ioctl were properly filtered already, but we were still exposing a .gem_create_object hook, as well as having an .open and .postclose hooks which are only relevant on older generations. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-6-maxime@cerno.tech commit 3d7637423be8340f40a669beb253aabbf08239ca Author: Maxime Ripard Date: Fri Jun 10 13:51:39 2022 +0200 drm/vc4: bo: Split out Dumb buffers fixup The vc4_bo_dumb_create() both fixes up the allocation arguments to match the hardware constraints and actually performs the allocation. Since we're going to introduce a new function that uses a different allocator, let's split the arguments fixup to a separate function we will be able to reuse. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-5-maxime@cerno.tech commit dd2dfd44edc5ba5b2de3c2e6c1c823a62e8f1e92 Author: Maxime Ripard Date: Fri Jun 10 13:51:38 2022 +0200 drm/vc4: bo: Rename vc4_dumb_create We're going to add a new variant of the dumb BO allocation function, so let's rename vc4_dumb_create() to something a bit more specific. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-4-maxime@cerno.tech commit 1cbc91eb7b518cc5f80442ff9b517dc5b9d3b849 Author: Maxime Ripard Date: Fri Jun 10 13:51:37 2022 +0200 drm/vc4: Consolidate Hardware Revision Check A new generation of controller has been introduced with the BCM2711/RaspberryPi4. This generation needs a bunch of quirks, and over time we've piled on a number of checks in most parts of the drivers. All these checks are performed several times, and are not always consistent. Let's create a single, global, variable to hold it and use it everywhere. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-3-maxime@cerno.tech commit cb468c7d84d174ab9cd638be9f5b3f1ba2b311a0 Author: Maxime Ripard Date: Fri Jun 10 13:51:36 2022 +0200 drm/vc4: plane: Prevent async update if we don't have a dlist The vc4 planes are setup in hardware by creating a hardware descriptor in a dedicated RAM. As part of the process to setup a plane in KMS, we thus need to allocate some part of that dedicated RAM to store our descriptor there. The async update path will just reuse the descriptor already allocated for that plane and will modify it directly in RAM to match whatever has been asked for. In order to do that, it will compare the descriptor for the old plane state and the new plane state, will make sure they fit in the same size, and check that only the position or buffer address have changed. Reviewed-by: Melissa Wen Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220610115149.964394-2-maxime@cerno.tech commit 4bca7e80b6455772b4bf3f536dcbc19aac424d6a Author: Jan Kara Date: Wed Jun 15 15:22:29 2022 +0200 init: Initialize noop_backing_dev_info early noop_backing_dev_info is used by superblocks of various pseudofilesystems such as kdevtmpfs. After commit 10e14073107d ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error") this broke because __mark_inode_dirty() started to access more fields from noop_backing_dev_info and this led to crashes inside locked_inode_to_wb_and_lock_list() called from __mark_inode_dirty(). Fix the problem by initializing noop_backing_dev_info before the filesystems get mounted. Fixes: 10e14073107d ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error") Reported-and-tested-by: Suzuki K Poulose Reported-and-tested-by: Alexandru Elisei Reported-and-tested-by: Guenter Roeck Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara commit 27cfa258951a465e3eae63ee1e715e902cd45578 Author: Ye Bin Date: Wed Jun 15 17:00:10 2022 +0800 ext2: fix fs corruption when trying to remove a non-empty directory with IO error We got issue as follows: [home]# mount /dev/sdd test [home]# cd test [test]# ls dir1 lost+found [test]# rmdir dir1 ext2_empty_dir: inject fault [test]# ls lost+found [test]# cd .. [home]# umount test [home]# fsck.ext2 -fn /dev/sdd e2fsck 1.42.9 (28-Dec-2013) Pass 1: Checking inodes, blocks, and sizes Inode 4065, i_size is 0, should be 1024. Fix? no Pass 2: Checking directory structure Pass 3: Checking directory connectivity Unconnected directory inode 4065 (/???) Connect to /lost+found? no '..' in ... (4065) is / (2), should be (0). Fix? no Pass 4: Checking reference counts Inode 2 ref count is 3, should be 4. Fix? no Inode 4065 ref count is 2, should be 3. Fix? no Pass 5: Checking group summary information /dev/sdd: ********** WARNING: Filesystem still has errors ********** /dev/sdd: 14/128016 files (0.0% non-contiguous), 18477/512000 blocks Reason is same with commit 7aab5c84a0f6. We can't assume directory is empty when read directory entry failed. Link: https://lore.kernel.org/r/20220615090010.1544152-1-yebin10@huawei.com Signed-off-by: Ye Bin Signed-off-by: Jan Kara commit 1342b5b23da9559a1578978eaff7f797d8a87d91 Author: Samuel Holland Date: Wed Jun 15 00:42:53 2022 -0500 drm/sun4i: Fix crash during suspend after component bind failure If the component driver fails to bind, or is unbound, the driver data for the top-level platform device points to a freed drm_device. If the system is then suspended, the driver passes this dangling pointer to drm_mode_config_helper_suspend(), which crashes. Fix this by only setting the driver data while the platform driver holds a reference to the drm_device. Fixes: 624b4b48d9d8 ("drm: sun4i: Add support for suspending the display driver") Signed-off-by: Samuel Holland Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220615054254.16352-1-samuel@sholland.org commit 920169041baa0a7497ed702aa97d6a2d6285efd3 Author: Samuel Holland Date: Tue Jun 14 02:31:00 2022 -0500 drm/sun4i: dw-hdmi: Fix ddc-en GPIO consumer conflict commit 6de79dd3a920 ("drm/bridge: display-connector: add ddc-en gpio support") added a consumer for this GPIO in the HDMI connector device. This new consumer conflicts with the pre-existing GPIO consumer in the sun8i HDMI controller driver, which prevents the driver from probing: [ 4.983358] display-connector connector: GPIO lookup for consumer ddc-en [ 4.983364] display-connector connector: using device tree for GPIO lookup [ 4.983392] gpio-226 (ddc-en): gpiod_request: status -16 [ 4.983399] sun8i-dw-hdmi 6000000.hdmi: Couldn't get ddc-en gpio [ 4.983618] sun4i-drm display-engine: failed to bind 6000000.hdmi (ops sun8i_dw_hdmi_ops [sun8i_drm_hdmi]): -16 [ 4.984082] sun4i-drm display-engine: Couldn't bind all pipelines components [ 4.984171] sun4i-drm display-engine: adev bind failed: -16 [ 4.984179] sun8i-dw-hdmi: probe of 6000000.hdmi failed with error -16 Both drivers have the same behavior: they leave the GPIO active for the life of the device. Let's take advantage of the new implementation, and drop the now-obsolete code from the HDMI controller driver. Fixes: 6de79dd3a920 ("drm/bridge: display-connector: add ddc-en gpio support") Signed-off-by: Samuel Holland Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220614073100.11550-1-samuel@sholland.org commit e89ab76d7e2564c65986add3d634cc5cf5bacf14 Author: Darrick J. Wong Date: Sun Jun 5 18:51:23 2022 -0700 xfs: preserve DIFLAG2_NREXT64 when setting other inode attributes It is vitally important that we preserve the state of the NREXT64 inode flag when we're changing the other flags2 fields. Fixes: 9b7d16e34bbe ("xfs: Introduce XFS_DIFLAG2_NREXT64 and associated helpers") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Chandan Babu R Reviewed-by: Allison Henderson commit 10930b254d5be1cb4350fb7a456ccd5ea7e3cbd9 Author: Darrick J. Wong Date: Sun Jun 5 18:51:22 2022 -0700 xfs: fix variable state usage The variable @args is fed to a tracepoint, and that's the only place it's used. This is fine for the kernel, but for userspace, tracepoints are #define'd out of existence, which results in this warning on gcc 11.2: xfs_attr.c: In function ‘xfs_attr_node_try_addname’: xfs_attr.c:1440:42: warning: unused variable ‘args’ [-Wunused-variable] 1440 | struct xfs_da_args *args = attr->xattri_da_args; | ^~~~ Clean this up. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson commit f4288f01820e2d57722d21874c1fda661003c9b9 Author: Darrick J. Wong Date: Sun Jun 5 18:51:22 2022 -0700 xfs: fix TOCTOU race involving the new logged xattrs control knob I found a race involving the larp control knob, aka the debugging knob that lets developers enable logging of extended attribute updates: Thread 1 Thread 2 echo 0 > /sys/fs/xfs/debug/larp setxattr(REPLACE) xfs_has_larp (returns false) xfs_attr_set echo 1 > /sys/fs/xfs/debug/larp xfs_attr_defer_replace xfs_attr_init_replace_state xfs_has_larp (returns true) xfs_attr_init_remove_state This isn't a particularly severe problem right now because xattr logging is only enabled when CONFIG_XFS_DEBUG=y, and developers *should* know what they're doing. However, the eventual intent is that callers should be able to ask for the assistance of the log in persisting xattr updates. This capability might not be required for /all/ callers, which means that dynamic control must work correctly. Once an xattr update has decided whether or not to use logged xattrs, it needs to stay in that mode until the end of the operation regardless of what subsequent parallel operations might do. Therefore, it is an error to continue sampling xfs_globals.larp once xfs_attr_change has made a decision about larp, and it was not correct for me to have told Allison that ->create_intent functions can sample the global log incompat feature bitfield to decide to elide a log item. Instead, create a new op flag for the xfs_da_args structure, and convert all other callers of xfs_has_larp and xfs_sb_version_haslogxattrs within the attr update state machine to look for the operations flag. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson commit cad140d00899e7a9cb6fe93b282051df589e671c Author: Christian Göttsche Date: Wed Jun 15 17:38:39 2022 +0200 selinux: free contexts previously transferred in selinux_add_opt() `selinux_add_opt()` stopped taking ownership of the passed context since commit 70f4169ab421 ("selinux: parse contexts for mount options early"). unreferenced object 0xffff888114dfd140 (size 64): comm "mount", pid 15182, jiffies 4295687028 (age 796.340s) hex dump (first 32 bytes): 73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f system_u:object_ 72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65 r:test_filesyste backtrace: [] kmemdup_nul+0x24/0x80 [] selinux_sb_eat_lsm_opts+0x293/0x560 [] security_sb_eat_lsm_opts+0x58/0x80 [] generic_parse_monolithic+0x82/0x180 [] do_new_mount+0x1f5/0x550 [] path_mount+0x2ab/0x1570 [] __x64_sys_mount+0x20e/0x280 [] do_syscall_64+0x34/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff888108e71640 (size 64): comm "fsmount", pid 7607, jiffies 4295044974 (age 1601.016s) hex dump (first 32 bytes): 73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f system_u:object_ 72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65 r:test_filesyste backtrace: [] memdup_user+0x21/0x90 [] strndup_user+0x47/0xa0 [] __do_sys_fsconfig+0x485/0x9f0 [] do_syscall_64+0x34/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Cc: stable@vger.kernel.org Fixes: 70f4169ab421 ("selinux: parse contexts for mount options early") Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore commit a79e69c8714f416bd324952d06d1dd7bce3f35bf Author: Lukas Bulwahn Date: Mon Jun 13 10:51:00 2022 +0200 MAINTAINERS: add include/dt-bindings/clock to COMMON CLK FRAMEWORK Maintainers of the directory Documentation/devicetree/bindings/clock are also the maintainers of the corresponding directory in include/dt-bindings/clock. Add the file entry for include/dt-bindings/clock to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220613085100.402-1-lukas.bulwahn@gmail.com Signed-off-by: Stephen Boyd commit ef79c396c664be99d0c5660dc75fe863c1e20315 Author: Christian Göttsche Date: Wed Jun 15 17:44:31 2022 +0200 audit: free module name Reset the type of the record last as the helper `audit_free_module()` depends on it. unreferenced object 0xffff888153b707f0 (size 16): comm "modprobe", pid 1319, jiffies 4295110033 (age 1083.016s) hex dump (first 16 bytes): 62 69 6e 66 6d 74 5f 6d 69 73 63 00 6b 6b 6b a5 binfmt_misc.kkk. backtrace: [] kstrdup+0x2b/0x50 [] __audit_log_kern_module+0x4d/0xf0 [] load_module+0x9d4/0x2e10 [] __do_sys_finit_module+0x114/0x1b0 [] do_syscall_64+0x34/0x80 [] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Cc: stable@vger.kernel.org Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls") Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore commit 30306f6194cadcc29c77f6ddcd416a75bf5c0232 Merge: afe9eb14ea1cb 1dfbe9fcda4af Author: Linus Torvalds Date: Wed Jun 15 14:20:26 2022 -0700 Merge tag 'hardening-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Correctly handle vm_map areas in hardened usercopy (Matthew Wilcox) - Adjust CFI RCU usage to avoid boot splats with cpuidle (Sami Tolvanen) * tag 'hardening-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: usercopy: Make usercopy resilient against ridiculously large copies usercopy: Cast pointer to an integer once usercopy: Handle vm_map_ram() areas cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle commit b4d329c451a299323b26039df97b32896fb46abc Author: Rob Clark Date: Fri Jun 10 10:20:55 2022 -0700 drm/msm/gem: Drop early returns in close/purge vma Keep the warn, but drop the early return. If we do manage to hit this sort of issue, skipping the cleanup just makes things worse (dangling drm_mm_nodes when the msm_gem_vma is freed, etc). Whereas the worst that happens if we tear down a mapping the GPU is accessing is that we get GPU iova faults, but otherwise the world keeps spinning. Signed-off-by: Rob Clark Tested-by: Steev Klimaszewski Reported-by: Steev Klimaszewski Patchwork: https://patchwork.freedesktop.org/patch/489115/ Link: https://lore.kernel.org/r/20220610172055.2337977-1-robdclark@gmail.com commit 311e03c29c255665e10a31910308de3777f21274 Author: Rob Clark Date: Fri May 27 10:23:40 2022 -0700 drm/msm/gem: Separate object and vma unpin Previously the BO_PINNED state in the submit was tracking two related but different things: (1) that the buffer object was pinned, and (2) that the vma (mapping within a set of pagetables) was pinned. But with fenced vma unpin (needed so that userspace couldn't race with retire path for releasing a vma) these two were decoupled. The fact that the BO_PINNED flag was already cleared meant that we leaked the bo pin count which should have been dropped when the submit was retired. So split this state into BO_OBJ_PINNED and BO_VMA_PINNED, so they can be dropped independently. Fixes: 95d1deb02a9c ("drm/msm/gem: Add fenced vma unpin") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/487559/ Link: https://lore.kernel.org/r/20220527172341.2151005-1-robdclark@gmail.com commit b87f02307d3cfbda768520f0687c51ca77e14fc3 Author: Petr Mladek Date: Wed Jun 15 18:28:05 2022 +0200 printk: Wait for the global console lock when the system is going down There are reports that the console kthreads block the global console lock when the system is going down, for example, reboot, panic. First part of the solution was to block kthreads in these problematic system states so they stopped handling newly added messages. Second part of the solution is to wait when for the kthreads when they are actively printing. It solves the problem when a message was printed before the system entered the problematic state and the kthreads managed to step in. A busy waiting has to be used because panic() can be called in any context and in an unknown state of the scheduler. There must be a timeout because the kthread might get stuck or sleeping and never release the lock. The timeout 10s is an arbitrary value inspired by the softlockup timeout. Link: https://lore.kernel.org/r/20220610205038.GA3050413@paulmck-ThinkPad-P17-Gen-1 Link: https://lore.kernel.org/r/CAMdYzYpF4FNTBPZsEFeWRuEwSies36QM_As8osPWZSr2q-viEA@mail.gmail.com Signed-off-by: Petr Mladek Tested-by: Paul E. McKenney Link: https://lore.kernel.org/r/20220615162805.27962-3-pmladek@suse.com commit c3230283e2819a69dad2cf7a63143fde8bab8b5c Author: Petr Mladek Date: Wed Jun 15 18:28:04 2022 +0200 printk: Block console kthreads when direct printing will be required There are known situations when the console kthreads are not reliable or does not work in principle, for example, early boot, panic, shutdown. For these situations there is the direct (legacy) mode when printk() tries to get console_lock() and flush the messages directly. It works very well during the early boot when the console kthreads are not available at all. It gets more complicated in the other situations when console kthreads might be actively printing and block console_trylock() in printk(). The same problem is in the legacy code as well. Any console_lock() owner could block console_trylock() in printk(). It is solved by a trick that the current console_lock() owner is responsible for printing all pending messages. It is actually the reason why there is the risk of softlockups and why the console kthreads were introduced. The console kthreads use the same approach. They are responsible for printing the messages by definition. So that they handle the messages anytime when they are awake and see new ones. The global console_lock is available when there is nothing to do. It should work well when the problematic context is correctly detected and printk() switches to the direct mode. But it seems that it is not enough in practice. There are reports that the messages are not printed during panic() or shutdown() even though printk() tries to use the direct mode here. The problem seems to be that console kthreads become active in these situation as well. They steel the job before other CPUs are stopped. Then they are stopped in the middle of the job and block the global console_lock. First part of the solution is to block console kthreads when the system is in a problematic state and requires the direct printk() mode. Link: https://lore.kernel.org/r/20220610205038.GA3050413@paulmck-ThinkPad-P17-Gen-1 Link: https://lore.kernel.org/r/CAMdYzYpF4FNTBPZsEFeWRuEwSies36QM_As8osPWZSr2q-viEA@mail.gmail.com Suggested-by: John Ogness Tested-by: Paul E. McKenney Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220615162805.27962-2-pmladek@suse.com commit afe9eb14ea1cbac5d91ca04eb64810d2d9fa22b0 Merge: 979086f5e0066 27b5b22d252c6 Author: Linus Torvalds Date: Wed Jun 15 12:34:19 2022 -0700 Merge tag 'tpmdd-next-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Two fixes for this merge window" * tag 'tpmdd-next-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build certs/blacklist_hashes.c: fix const confusion in certs blacklist commit 5ee3d10f84d0a32fc11a55c70c204b6d81fd9ef6 Author: Dave Wysochanski Date: Thu Jun 9 20:46:29 2022 -0400 NFSv4: Add FMODE_CAN_ODIRECT after successful open of a NFS4.x file Commit a2ad63daa88b ("VFS: add FMODE_CAN_ODIRECT file flag") added the FMODE_CAN_ODIRECT flag for NFSv3 but neglected to add it for NFSv4.x. This causes direct io on NFSv4.x to fail open with EINVAL: mount -o vers=4.2 127.0.0.1:/export /mnt/nfs4 dd if=/dev/zero of=/mnt/nfs4/file.bin bs=128k count=1 oflag=direct dd: failed to open '/mnt/nfs4/file.bin': Invalid argument dd of=/dev/null if=/mnt/nfs4/file.bin bs=128k count=1 iflag=direct dd: failed to open '/mnt/dir1/file1.bin': Invalid argument Fixes: a2ad63daa88b ("VFS: add FMODE_CAN_ODIRECT file flag") Signed-off-by: Dave Wysochanski Signed-off-by: Anna Schumaker commit 27b5b22d252c6d71a2a37a4bdf18d0be6d25ee5a Author: Masahiro Yamada Date: Sun Jun 12 02:22:31 2022 +0900 certs: fix and refactor CONFIG_SYSTEM_BLACKLIST_HASH_LIST build Commit addf466389d9 ("certs: Check that builtin blacklist hashes are valid") was applied 8 months after the submission. In the meantime, the base code had been removed by commit b8c96a6b466c ("certs: simplify $(srctree)/ handling and remove config_filename macro"). Fix the Makefile. Create a local copy of $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST). It is included from certs/blacklist_hashes.c and also works as a timestamp. Send error messages from check-blacklist-hashes.awk to stderr instead of stdout. Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid") Signed-off-by: Masahiro Yamada Reviewed-by: Jarkko Sakkinen Reviewed-by: Mickaël Salaün Signed-off-by: Jarkko Sakkinen commit 6a1c3767d82ed8233de1263aa7da81595e176087 Author: Masahiro Yamada Date: Sun Jun 12 02:22:30 2022 +0900 certs/blacklist_hashes.c: fix const confusion in certs blacklist This file fails to compile as follows: CC certs/blacklist_hashes.o certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes] 4 | const char __initdata *const blacklist_hashes[] = { | ^~~~~ In file included from certs/blacklist_hashes.c:2: certs/blacklist.h:5:38: note: previous declaration here 5 | extern const char __initconst *const blacklist_hashes[]; | ^~~~~~~~~~~~~~~~ Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c: fix const confusion in certs blacklist"). Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring") Signed-off-by: Masahiro Yamada Reviewed-by: Jarkko Sakkinen Reviewed-by: Mickaël Salaün Signed-off-by: Jarkko Sakkinen commit 49d6a3c062a1026a5ba957c46f3603c372288ab6 Author: Tianyu Lan Date: Mon Jun 13 21:45:53 2022 -0400 x86/Hyper-V: Add SEV negotiate protocol support in Isolation VM Hyper-V Isolation VM current code uses sev_es_ghcb_hv_call() to read/write MSR via GHCB page and depends on the sev code. This may cause regression when sev code changes interface design. The latest SEV-ES code requires to negotiate GHCB version before reading/writing MSR via GHCB page and sev_es_ghcb_hv_call() doesn't work for Hyper-V Isolation VM. Add Hyper-V ghcb related implementation to decouple SEV and Hyper-V code. Negotiate GHCB version in the hyperv_init() and use the version to communicate with Hyper-V in the ghcb hv call function. Fixes: 2ea29c5abbc2 ("x86/sev: Save the negotiated GHCB version") Signed-off-by: Tianyu Lan Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20220614014553.1915929-1-ltykernel@gmail.com Signed-off-by: Wei Liu commit cdd85786f4b3b9273e4376e69aa95a2d71722764 Author: Kirill A. Shutemov Date: Tue Jun 14 15:01:34 2022 +0300 x86/tdx: Clarify RIP adjustments in #VE handler After successful #VE handling, tdx_handle_virt_exception() has to move RIP to the next instruction. The handler needs to know the length of the instruction. If the #VE happened due to instruction execution, the GET_VEINFO TDX module call provides info on the instruction in R10, including its length. For #VE due to EPT violation, the info in R10 is not populand and the kernel must decode the instruction manually to find out its length. Restructure the code to make it explicit that the instruction length depends on the type of #VE. Make individual #VE handlers return the instruction length on success or -errno on failure. [ dhansen: fix up changelog and comments ] Suggested-by: Dave Hansen Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/20220614120135.14812-3-kirill.shutemov@linux.intel.com commit 51dd64bb99e4478fc5280171acd8e1b529eadaf7 Author: Xiu Jianfeng Date: Fri May 27 19:17:26 2022 +0800 Revert "evm: Fix memleak in init_desc" This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37. Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo], then if init_desc is called next time, there is no need to alloc tfm again, so in the error path of kmalloc desc or crypto_shash_init(desc), It is not a problem without freeing tmp_tfm. And also that commit did not reset the global variable to NULL after freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a UAF issue. Reported-by: Guozihua (Scott) Signed-off-by: Xiu Jianfeng Signed-off-by: Mimi Zohar commit 04cb45b4956728b2cfd064efa1bbfe5a0bad77eb Merge: 2396e958c8169 f34fdcd4a0e7a Author: Jens Axboe Date: Wed Jun 15 11:56:07 2022 -0600 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-5.19 Pull MD fixes from Song. * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid5-ppl: Fix argument order in bio_alloc_bioset() Revert "md: don't unregister sync_thread with reconfig_mutex held" commit 60428d8bc27f52e8f1540f98e1b6ef0156d43f0d Author: Kirill A. Shutemov Date: Tue Jun 14 15:01:33 2022 +0300 x86/tdx: Fix early #VE handling tdx_early_handle_ve() does not increment RIP after successfully handling the exception. That leads to infinite loop of exceptions. Move RIP when exceptions are successfully handled. [ dhansen: make problem statement more clear ] Fixes: 32e72854fa5f ("x86/tdx: Port I/O: Add early boot support") Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://lkml.kernel.org/r/20220614120135.14812-2-kirill.shutemov@linux.intel.com commit f34fdcd4a0e7a0b92340ad7e48e7bcff9393fab5 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:46 2022 -0600 md/raid5-ppl: Fix argument order in bio_alloc_bioset() bio_alloc_bioset() takes a block device, number of vectors, the OP flags, the GFP mask and the bio set. However when the prototype was changed, the callisite in ppl_do_flush() had the OP flags and the GFP flags reversed. This introduced some sparse error: drivers/md/raid5-ppl.c:632:57: warning: incorrect type in argument 3 (different base types) drivers/md/raid5-ppl.c:632:57: expected unsigned int opf drivers/md/raid5-ppl.c:632:57: got restricted gfp_t [usertype] drivers/md/raid5-ppl.c:633:61: warning: incorrect type in argument 4 (different base types) drivers/md/raid5-ppl.c:633:61: expected restricted gfp_t [usertype] gfp_mask drivers/md/raid5-ppl.c:633:61: got unsigned long long The sparse error introduction may not have been reported correctly by 0day due to other work that was cleaning up other sparse errors in this area. Fixes: 609be1066731 ("block: pass a block_device and opf to bio_alloc_bioset") Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu commit d1a374a1aeb7e31191448e225ed2f9c5e894f280 Author: Kumar Kartikeya Dwivedi Date: Wed Jun 15 09:51:51 2022 +0530 bpf: Limit maximum modifier chain length in btf_check_type_tags On processing a module BTF of module built for an older kernel, we might sometimes find that some type points to itself forming a loop. If such a type is a modifier, btf_check_type_tags's while loop following modifier chain will be caught in an infinite loop. Fix this by defining a maximum chain length and bailing out if we spin any longer than that. Fixes: eb596b090558 ("bpf: Ensure type tags precede modifiers in BTF") Reported-by: Daniel Borkmann Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220615042151.2266537-1-memxor@gmail.com commit d0a180341fe00cd0bd1cc259d196dc255c13f229 Author: Guoqing Jiang Date: Tue Jun 7 10:03:56 2022 +0800 Revert "md: don't unregister sync_thread with reconfig_mutex held" The 07reshape5intr test is broke because of below path. md_reap_sync_thread -> mddev_unlock -> md_unregister_thread(&mddev->sync_thread) And md_check_recovery is triggered by, mddev_unlock -> md_wakeup_thread(mddev->thread) then mddev->reshape_position is set to MaxSector in raid5_finish_reshape since MD_RECOVERY_INTR is cleared in md_check_recovery, which means feature_map is not set with MD_FEATURE_RESHAPE_ACTIVE and superblock's reshape_position can't be updated accordingly. Fixes: 8b48ec23cc51a ("md: don't unregister sync_thread with reconfig_mutex held") Reported-by: Logan Gunthorpe Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit 89bcd9a64b849380ef57e3032b307574e48db524 Author: Mengqi Zhang Date: Thu Jun 9 19:22:39 2022 +0800 mmc: mediatek: wait dma stop bit reset to 0 MediaTek IP requires that after dma stop, it need to wait this dma stop bit auto-reset to 0. When bus is in high loading state, it will take a while for the dma stop complete. If there is no waiting operation here, when program runs to clear fifo and reset, bus will hang. In addition, there should be no return in msdc_data_xfer_next() if there is data need be transferred, because no matter what error occurs here, it should continue to excute to the following mmc_request_done. Otherwise the core layer may wait complete forever. Signed-off-by: Mengqi Zhang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220609112239.18911-1-mengqi.zhang@mediatek.com Signed-off-by: Ulf Hansson commit 979086f5e0066b4eff66e1eee123da228489985c Merge: 018ab4fabddd9 168f912893407 Author: Linus Torvalds Date: Wed Jun 15 09:04:55 2022 -0700 Merge tag 'fs.fixes.v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull vfs idmapping fix from Christian Brauner: "This fixes an issue where we fail to change the group of a file when the caller owns the file and is a member of the group to change to. This is only relevant on idmapped mounts. There's a detailed description in the commit message and regression tests have been added to xfstests" * tag 'fs.fixes.v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: fs: account for group membership commit 10eb3a0d517fcc83eeea4242c149461205675eb4 Author: Benjamin Marzinski Date: Tue Jun 14 11:10:28 2022 -0500 dm: fix race in dm_start_io_acct After commit 82f6cdcc3676c ("dm: switch dm_io booleans over to proper flags") dm_start_io_acct stopped atomically checking and setting was_accounted, which turned into the DM_IO_ACCOUNTED flag. This opened the possibility for a race where IO accounting is started twice for duplicate bios. To remove the race, check the flag while holding the io->lock. Fixes: 82f6cdcc3676c ("dm: switch dm_io booleans over to proper flags") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Marzinski Signed-off-by: Mike Snitzer commit 2396e958c816960d445ecbbadd064abc929402d3 Merge: b13baccc3850c 43047e082b90e Author: Jens Axboe Date: Wed Jun 15 09:39:05 2022 -0600 Merge tag 'nvme-5.19-2022-06-15' of git://git.infradead.org/nvme into block-5.19 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - quirks, quirks, quirks to work around buggy consumer grade devices (Keith Bush, Ning Wang, Stefan Reiter, Rasheed Hsueh) - better kernel messages for devices that need quirking (Keith Bush) - make a kernel message more useful (Thomas Weißschuh)" * tag 'nvme-5.19-2022-06-15' of git://git.infradead.org/nvme: nvme-pci: disable write zeros support on UMIC and Samsung SSDs nvme-pci: avoid the deepest sleep state on ZHITAI TiPro7000 SSDs nvme-pci: sk hynix p31 has bogus namespace ids nvme-pci: smi has bogus namespace ids nvme-pci: phison e12 has bogus namespace ids nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S50 nvme-pci: add trouble shooting steps for timeouts nvme: add bug report info for global duplicate id nvme: add device name to warning in uuid_show() commit 0d8116ccd83b7e5384cf04de570ae19771e8a3d0 Author: Mark Rutland Date: Tue Jun 14 09:09:44 2022 +0100 arm64: ftrace: remove redundant label Since commit: c4a0ebf87cebbfa2 ("arm64/ftrace: Make function graph use ftrace directly") The 'ftrace_common_return' label has been unused. Remove it. Signed-off-by: Mark Rutland Cc: Chengming Zhou Cc: Will Deacon Tested-by: "Ivan T. Ivanov" Reviewed-by: Chengming Zhou Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220614080944.1349146-4-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit a6253579977e4c6f7818eeb05bf2bc65678a7187 Author: Mark Rutland Date: Tue Jun 14 09:09:43 2022 +0100 arm64: ftrace: consistently handle PLTs. Sometimes it is necessary to use a PLT entry to call an ftrace trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(), with each having *almost* identical logic, but this is not handled by ftrace_modify_call() since its introduction in commit: 3b23e4991fb66f6d ("arm64: implement ftrace with regs") Due to this, if we ever were to call ftrace_modify_call() for a callsite which requires a PLT entry for a trampoline, then either: a) If the old addr requires a trampoline, ftrace_modify_call() will use an out-of-range address to generate the 'old' branch instruction. This will result in warnings from aarch64_insn_gen_branch_imm() and ftrace_modify_code(), and no instructions will be modified. As ftrace_modify_call() will return an error, this will result in subsequent internal ftrace errors. b) If the old addr does not require a trampoline, but the new addr does, ftrace_modify_call() will use an out-of-range address to generate the 'new' branch instruction. This will result in warnings from aarch64_insn_gen_branch_imm(), and ftrace_modify_code() will replace the 'old' branch with a BRK. This will result in a kernel panic when this BRK is later executed. Practically speaking, case (a) is vastly more likely than case (b), and typically this will result in internal ftrace errors that don't necessarily affect the rest of the system. This can be demonstrated with an out-of-tree test module which triggers ftrace_modify_call(), e.g. | # insmod test_ftrace.ko | test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024 | branch_imm_common: offset out of range | branch_imm_common: offset out of range | ------------[ ftrace bug ]------------ | ftrace failed to modify | [] test_function+0x8/0x38 [test_ftrace] | actual: 1d:00:00:94 | Updating ftrace call site to call a different ftrace function | ftrace record flags: e0000002 | (2) R | expected tramp: ffffb374ae42ed54 | ------------[ cut here ]------------ | WARNING: CPU: 0 PID: 165 at kernel/trace/ftrace.c:2085 ftrace_bug+0x280/0x2b0 | Modules linked in: test_ftrace(+) | CPU: 0 PID: 165 Comm: insmod Not tainted 5.19.0-rc2-00002-g4d9ead8b45ce #13 | Hardware name: linux,dummy-virt (DT) | pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : ftrace_bug+0x280/0x2b0 | lr : ftrace_bug+0x280/0x2b0 | sp : ffff80000839ba00 | x29: ffff80000839ba00 x28: 0000000000000000 x27: ffff80000839bcf0 | x26: ffffb37493994180 x25: ffffb374b0991c28 x24: ffffb374b0d70000 | x23: 00000000ffffffea x22: ffffb374afcc33b0 x21: ffffb374b08f9cc8 | x20: ffff572b8462c000 x19: ffffb374b08f9000 x18: ffffffffffffffff | x17: 6c6c6163202c6331 x16: ffffb374ae5ad110 x15: ffffb374b0d51ee4 | x14: 0000000000000000 x13: 3435646532346561 x12: 3437336266666666 | x11: 203a706d61727420 x10: 6465746365707865 x9 : ffffb374ae5149e8 | x8 : 336266666666203a x7 : 706d617274206465 x6 : 00000000fffff167 | x5 : ffff572bffbc4a08 x4 : 00000000fffff167 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : ffff572b84461e00 x0 : 0000000000000022 | Call trace: | ftrace_bug+0x280/0x2b0 | ftrace_replace_code+0x98/0xa0 | ftrace_modify_all_code+0xe0/0x144 | arch_ftrace_update_code+0x14/0x20 | ftrace_startup+0xf8/0x1b0 | register_ftrace_function+0x38/0x90 | test_ftrace_init+0xd0/0x1000 [test_ftrace] | do_one_initcall+0x50/0x2b0 | do_init_module+0x50/0x1f0 | load_module+0x17c8/0x1d64 | __do_sys_finit_module+0xa8/0x100 | __arm64_sys_finit_module+0x2c/0x3c | invoke_syscall+0x50/0x120 | el0_svc_common.constprop.0+0xdc/0x100 | do_el0_svc+0x3c/0xd0 | el0_svc+0x34/0xb0 | el0t_64_sync_handler+0xbc/0x140 | el0t_64_sync+0x18c/0x190 | ---[ end trace 0000000000000000 ]--- We can solve this by consistently determining whether to use a PLT entry for an address. Note that since (the earlier) commit: f1a54ae9af0da4d7 ("arm64: module/ftrace: intialize PLT at load time") ... we can consistently determine the PLT address that a given callsite will use, and therefore ftrace_make_nop() does not need to skip validation when a PLT is in use. This patch factors the existing logic out of ftrace_make_call() and ftrace_make_nop() into a common ftrace_find_callable_addr() helper function, which is used by ftrace_make_call(), ftrace_make_nop(), and ftrace_modify_call(). In ftrace_make_nop() the patching is consistently validated by ftrace_modify_code() as we can always determine what the old instruction should have been. Fixes: 3b23e4991fb6 ("arm64: implement ftrace with regs") Signed-off-by: Mark Rutland Cc: Ard Biesheuvel Cc: Will Deacon Tested-by: "Ivan T. Ivanov" Reviewed-by: Chengming Zhou Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220614080944.1349146-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit 3eefdf9d1e406f3da47470b2854347009ffcb6fa Author: Mark Rutland Date: Tue Jun 14 09:09:42 2022 +0100 arm64: ftrace: fix branch range checks The branch range checks in ftrace_make_call() and ftrace_make_nop() are incorrect, erroneously permitting a forwards branch of 128M and erroneously rejecting a backwards branch of 128M. This is because both functions calculate the offset backwards, calculating the offset *from* the target *to* the branch, rather than the other way around as the later comparisons expect. If an out-of-range branch were erroeously permitted, this would later be rejected by aarch64_insn_gen_branch_imm() as branch_imm_common() checks the bounds correctly, resulting in warnings and the placement of a BRK instruction. Note that this can only happen for a forwards branch of exactly 128M, and so the caller would need to be exactly 128M bytes below the relevant ftrace trampoline. If an in-range branch were erroeously rejected, then: * For modules when CONFIG_ARM64_MODULE_PLTS=y, this would result in the use of a PLT entry, which is benign. Note that this is the common case, as this is selected by CONFIG_RANDOMIZE_BASE (and therefore RANDOMIZE_MODULE_REGION_FULL), which distributions typically seelct. This is also selected by CONFIG_ARM64_ERRATUM_843419. * For modules when CONFIG_ARM64_MODULE_PLTS=n, this would result in internal ftrace failures. * For core kernel text, this would result in internal ftrace failues. Note that for this to happen, the kernel text would need to be at least 128M bytes in size, and typical configurations are smaller tha this. Fix this by calculating the offset *from* the branch *to* the target in both functions. Fixes: f8af0b364e24 ("arm64: ftrace: don't validate branch via PLT in ftrace_make_nop()") Fixes: e71a4e1bebaf ("arm64: ftrace: add support for far branches to dynamic ftrace") Signed-off-by: Mark Rutland Cc: Ard Biesheuvel Cc: Will Deacon Tested-by: "Ivan T. Ivanov" Reviewed-by: Chengming Zhou Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220614080944.1349146-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit ec41c6d82056cbbd7ec8f44eed6d86fea50acf4e Author: Michael Carns Date: Wed Jun 15 14:25:44 2022 +0200 hwmon: (asus-ec-sensors) add missing comma in board name list. This fixes a regression where coma lead to concatenating board names and broke module loading for C8H. Fixes: 5b4285c57b6f ("hwmon: (asus-ec-sensors) fix Formula VIII definition") Signed-off-by: Michael Carns Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220615122544.140340-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 27d8fa207835fa5c7cd6f969c6cc94d1123951ee Author: Catalin Marinas Date: Wed Jun 15 14:22:38 2022 +0100 Revert "arm64: Initialize jump labels before setup_machine_fdt()" This reverts commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae. The reverted patch was needed as a fix after commit f5bda35fba61 ("random: use static branch for crng_ready()"). However, this was already fixed by 60e5b2886b92 ("random: do not use jump labels before they are initialized") and hence no longer necessary to initialise jump labels before setup_machine_fdt(). Signed-off-by: Catalin Marinas commit 24d0af46d389d70de7d6465801ee1affe0629c88 Merge: aaefa29270d95 ba79c5e45eecb Author: Linus Walleij Date: Wed Jun 15 16:17:08 2022 +0200 Merge tag 'intel-pinctrl-v5.19-3' of gitolite.kernel.org:pub/scm/linux/kernel/git/pinctrl/intel into fixes intel-pinctrl for v5.19-3 * Update a record in the MAINTAINERS database for Intel pin control drivers The following is an automated git shortlog grouped by driver: MAINTAINERS: - Update Intel pin control to Supported commit 3046a827316c0e55fc563b4fb78c93b9ca5c7c37 Author: Jon Maxwell Date: Wed Jun 15 11:15:40 2022 +1000 bpf: Fix request_sock leak in sk lookup helpers A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was finding the request_socket but returning the parent LISTEN socket via sk_to_full_sk() without decrementing the child request socket 1st, resulting in request_sock slab object leak. This patch retains the existing behaviour of returning full socks to the caller but it also decrements the child request_socket if one is present before doing so to prevent the leak. Thanks to Curtis Taylor for all the help in diagnosing and testing this. And thanks to Antoine Tenart for the reproducer and patch input. v2 of this patch contains, refactor as per Daniel Borkmann's suggestions to validate RCU flags on the listen socket so that it balances with bpf_sk_release() and update comments as per Martin KaFai Lau's suggestion. One small change to Daniels suggestion, put "sk = sk2" under "if (sk2 != sk)" to avoid an extra instruction. Fixes: f7355a6c0497 ("bpf: Check sk_fullsock() before returning from bpf_sk_lookup()") Fixes: edbf8c01de5a ("bpf: add skc_lookup_tcp helper") Co-developed-by: Antoine Tenart Signed-off-by: Antoine Tenart Signed-off-by: Jon Maxwell Signed-off-by: Daniel Borkmann Tested-by: Curtis Taylor Cc: Martin KaFai Lau Link: https://lore.kernel.org/bpf/56d6f898-bde0-bb25-3427-12a330b29fb8@iogearbox.net Link: https://lore.kernel.org/bpf/20220615011540.813025-1-jmaxwell37@gmail.com commit aaefa29270d9551b604165a08406543efa9d16f5 Author: Samuel Holland Date: Wed May 25 21:49:56 2022 -0500 pinctrl: sunxi: a83t: Fix NAND function name for some pins The other NAND pins on Port C use the "nand0" function name. "nand0" also matches all of the other Allwinner SoCs. Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support") Signed-off-by: Samuel Holland Acked-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220526024956.49500-1-samuel@sholland.org Signed-off-by: Linus Walleij commit 84a85d3fef2e75b1fe9fc2af6f5267122555a1ed Author: Haowen Bai Date: Thu Apr 21 10:26:59 2022 +0800 pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() pdesc could be null but still dereference pdesc->name and it will lead to a null pointer access. So we move a null check before dereference. Signed-off-by: Haowen Bai Link: https://lore.kernel.org/r/1650508019-22554-1-git-send-email-baihaowen@meizu.com Signed-off-by: Linus Walleij commit c2b3a0759c76d67186199eb1d076fb55497eac98 Author: Kalle Valo Date: Fri Jun 10 16:36:40 2022 +0300 dt-bindings: net: wireless: ath11k: change Kalle's email My codeaurora.org email doesn't work anymore, so switch to my preferred kernel.org address. Signed-off-by: Kalle Valo Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220610133640.10810-2-kvalo@kernel.org commit f424b1a6e1b460c04018ed5508dd7dbae72e27ab Author: Kalle Valo Date: Fri Jun 10 16:36:39 2022 +0300 dt-bindings: net: wireless: ath9k: Change Toke as maintainer Toke now maintains ath9k so update DT bindings as well. Signed-off-by: Kalle Valo Acked-by: Toke Høiland-Jørgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220610133640.10810-1-kvalo@kernel.org commit 933b5f9f98da29af646b51b36a0753692908ef64 Author: Dmitry Klochkov Date: Tue Jun 14 15:11:41 2022 +0300 tools/kvm_stat: fix display of error when multiple processes are found Instead of printing an error message, kvm_stat script fails when we restrict statistics to a guest by its name and there are multiple guests with such name: # kvm_stat -g my_vm Traceback (most recent call last): File "/usr/bin/kvm_stat", line 1819, in main() File "/usr/bin/kvm_stat", line 1779, in main options = get_options() File "/usr/bin/kvm_stat", line 1718, in get_options options = argparser.parse_args() File "/usr/lib64/python3.10/argparse.py", line 1825, in parse_args args, argv = self.parse_known_args(args, namespace) File "/usr/lib64/python3.10/argparse.py", line 1858, in parse_known_args namespace, args = self._parse_known_args(args, namespace) File "/usr/lib64/python3.10/argparse.py", line 2067, in _parse_known_args start_index = consume_optional(start_index) File "/usr/lib64/python3.10/argparse.py", line 2007, in consume_optional take_action(action, args, option_string) File "/usr/lib64/python3.10/argparse.py", line 1935, in take_action action(self, namespace, argument_values, option_string) File "/usr/bin/kvm_stat", line 1649, in __call__ ' to specify the desired pid'.format(" ".join(pids))) TypeError: sequence item 0: expected str instance, int found To avoid this, it's needed to convert pids int values to strings before pass them to join(). Signed-off-by: Dmitry Klochkov Message-Id: <20220614121141.160689-1-kdmitry556@gmail.com> Signed-off-by: Paolo Bonzini commit 219b51a6f040fa5367adadd7d58c4dda0896a01d Author: Duoming Zhou Date: Tue Jun 14 17:25:57 2022 +0800 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg The skb_recv_datagram() in ax25_recvmsg() will hold lock_sock and block until it receives a packet from the remote. If the client doesn`t connect to server and calls read() directly, it will not receive any packets forever. As a result, the deadlock will happen. The fail log caused by deadlock is shown below: [ 369.606973] INFO: task ax25_deadlock:157 blocked for more than 245 seconds. [ 369.608919] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 369.613058] Call Trace: [ 369.613315] [ 369.614072] __schedule+0x2f9/0xb20 [ 369.615029] schedule+0x49/0xb0 [ 369.615734] __lock_sock+0x92/0x100 [ 369.616763] ? destroy_sched_domains_rcu+0x20/0x20 [ 369.617941] lock_sock_nested+0x6e/0x70 [ 369.618809] ax25_bind+0xaa/0x210 [ 369.619736] __sys_bind+0xca/0xf0 [ 369.620039] ? do_futex+0xae/0x1b0 [ 369.620387] ? __x64_sys_futex+0x7c/0x1c0 [ 369.620601] ? fpregs_assert_state_consistent+0x19/0x40 [ 369.620613] __x64_sys_bind+0x11/0x20 [ 369.621791] do_syscall_64+0x3b/0x90 [ 369.622423] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 369.623319] RIP: 0033:0x7f43c8aa8af7 [ 369.624301] RSP: 002b:00007f43c8197ef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 369.625756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f43c8aa8af7 [ 369.626724] RDX: 0000000000000010 RSI: 000055768e2021d0 RDI: 0000000000000005 [ 369.628569] RBP: 00007f43c8197f00 R08: 0000000000000011 R09: 00007f43c8198700 [ 369.630208] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff845e6afe [ 369.632240] R13: 00007fff845e6aff R14: 00007f43c8197fc0 R15: 00007f43c8198700 This patch replaces skb_recv_datagram() with an open-coded variant of it releasing the socket lock before the __skb_wait_for_more_packets() call and re-acquiring it after such call in order that other functions that need socket lock could be executed. what's more, the socket lock will be released only when recvmsg() will block and that should produce nicer overall behavior. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Thomas Osterried Signed-off-by: Duoming Zhou Reported-by: Thomas Habets Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit c5595975b53a487bf329eeba65b5c5f34605a4c0 Author: Pavel Begunkov Date: Wed Jun 15 11:23:07 2022 +0100 io_uring: make io_fill_cqe_aux honour CQE32 Don't let io_fill_cqe_aux() post 16B cqes for CQE32 rings, neither the kernel nor the userspace expect this to happen. Fixes: 76c68fbf1a1f9 ("io_uring: enable CQE32") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/64fae669fae1b7083aa15d0cd807f692b0880b9a.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit cd94903d3ba50d7ae797c603f68996af8d1ba1a1 Author: Pavel Begunkov Date: Wed Jun 15 11:23:06 2022 +0100 io_uring: remove __io_fill_cqe() helper In preparation for the following patch, inline __io_fill_cqe(), there is only one user. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/71dab9afc3cde3f8b64d26f20d3b60bdc40726ff.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2caf9822f0507463168a9e83f93c75b3e3fac971 Author: Pavel Begunkov Date: Wed Jun 15 11:23:05 2022 +0100 io_uring: fix ->extra{1,2} misuse We don't really know the state of req->extra{1,2] fields in __io_fill_cqe_req(), if an opcode handler is not aware of CQE32 option, it never sets them up properly. Track the state of those fields with a request flag. Fixes: 76c68fbf1a1f9 ("io_uring: enable CQE32") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4b3e5be512fbf4debec7270fd485b8a3b014d464.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 29ede2014c87576d2fc83680aa4c1d7403db0dfe Author: Pavel Begunkov Date: Wed Jun 15 11:23:04 2022 +0100 io_uring: fill extra big cqe fields from req The only user of io_req_complete32()-like functions is cmd requests. Instead of keeping the whole complete32 family, remove them and provide the extras in already added for inline completions req->extra{1,2}. When fill_cqe_res() finds CQE32 option enabled it'll use those fields to fill a 32B cqe. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/af1319eb661b1f9a0abceb51cbbf72b8002e019d.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f43de1f88841d59f27f761219b6550bd6ce3dcc1 Author: Pavel Begunkov Date: Wed Jun 15 11:23:03 2022 +0100 io_uring: unite fill_cqe and the 32B version We want just one function that will handle both normal cqes and 32B cqes. Combine __io_fill_cqe_req() and __io_fill_cqe_req32(). It's still not entirely correct yet, but saves us from cases when we fill an CQE of a wrong size. Fixes: 76c68fbf1a1f9 ("io_uring: enable CQE32") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/8085c5b2f74141520f60decd45334f87e389b718.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 91ef75a7db0d0855284b78d60d3fcec5c353ec5a Author: Pavel Begunkov Date: Wed Jun 15 11:23:02 2022 +0100 io_uring: get rid of __io_fill_cqe{32}_req() There are too many cqe filling helpers, kill __io_fill_cqe{32}_req(), use __io_fill_cqe{32}_req_filled() instead, and then rename it. It'll simplify fixing in following patches. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c18e0d191014fb574f24721245e4e3fddd0b6917.1655287457.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 36a15e1cb134c0395261ba1940762703f778438c Author: Jose Alonso Date: Mon Jun 13 15:32:44 2022 -0300 net: usb: ax88179_178a needs FLAG_SEND_ZLP The extra byte inserted by usbnet.c when (length % dev->maxpacket == 0) is causing problems to device. This patch sets FLAG_SEND_ZLP to avoid this. Tested with: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet Problems observed: ====================================================================== 1) Using ssh/sshfs. The remote sshd daemon can abort with the message: "message authentication code incorrect" This happens because the tcp message sent is corrupted during the USB "Bulk out". The device calculate the tcp checksum and send a valid tcp message to the remote sshd. Then the encryption detects the error and aborts. 2) NETDEV WATCHDOG: ... (ax88179_178a): transmit queue 0 timed out 3) Stop normal work without any log message. The "Bulk in" continue receiving packets normally. The host sends "Bulk out" and the device responds with -ECONNRESET. (The netusb.c code tx_complete ignore -ECONNRESET) Under normal conditions these errors take days to happen and in intense usage take hours. A test with ping gives packet loss, showing that something is wrong: ping -4 -s 462 {destination} # 462 = 512 - 42 - 8 Not all packets fail. My guess is that the device tries to find another packet starting at the extra byte and will fail or not depending on the next bytes (old buffer content). ====================================================================== Signed-off-by: Jose Alonso Signed-off-by: David S. Miller commit 371de1aa000dd5265a32ed934792a306ec873d6e Merge: b60377de77905 efe41860008e5 Author: David S. Miller Date: Wed Jun 15 09:15:33 2022 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-06-14 This series contains updates to ice driver only. Michal fixes incorrect Tx timestamp offset calculation for E822 devices. Roman enforces required VLAN filtering settings for double VLAN mode. Przemyslaw fixes memory corruption issues with VFs by ensuring queues are disabled in the error path of VF queue configuration and to disabled VFs during reset. ==================== Signed-off-by: David S. Miller commit b60377de779052bf00b34a62f0bae03c92b88776 Author: Lukas Bulwahn Date: Mon Jun 13 14:18:26 2022 +0200 MAINTAINERS: add include/dt-bindings/net to NETWORKING DRIVERS Maintainers of the directory Documentation/devicetree/bindings/net are also the maintainers of the corresponding directory include/dt-bindings/net. Add the file entry for include/dt-bindings/net to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220613121826.11484-1-lukas.bulwahn@gmail.com Signed-off-by: Jakub Kicinski commit 56ec3e755bd1041d35bdec020a99b327697ee470 Author: Takashi Iwai Date: Tue Jun 14 07:48:31 2022 +0200 ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly It turned out that Lenovo shipped two completely different products with the very same PCI SSID, where both require different quirks; namely, Lenovo C940 has already the fixup for its speaker (ALC298_FIXUP_LENOVO_SPK_VOLUME) with the PCI SSID 17aa:3818, while Yoga Duet 7 has also the very same PCI SSID but requires a different quirk, ALC287_FIXUP_YOGA7_14TIL_SPEAKERS. Fortunately, both are with different codecs (C940 with ALC298 and Duet 7 with ALC287), hence we can apply different fixes by checking the codec ID. This patch implements that special fixup function. For easier handling, the internal function for applying a specific fixup entry is exported as __snd_hda_apply_fixup(), so that it can be called from the codec driver. The rest is simply calling it with a different fixup ID depending on the codec ID. Reported-by: Hans de Goede Tested-by: nikitashvets@flyium.com Cc: Link: https://lore.kernel.org/r/5ca147d1-3a2d-60c6-c491-8aa844183222@redhat.com Link: https://lore.kernel.org/r/20220614054831.14648-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 56315b6bf7fc63d2b26c37869d2753f765849bd6 Author: Oleksij Rempel Date: Fri Jun 10 10:16:21 2022 +0200 ARM: dts: at91: ksz9477_evb: fix port/phy validation Latest drivers version requires phy-mode to be set. Otherwise we will use "NA" mode and the switch driver will invalidate this port mode. Fixes: 65ac79e18120 ("net: dsa: microchip: add the phylink get_caps") Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20220610081621.584393-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 2a3dcbccd64ba35c045fac92272ff981c4cbef44 Author: Tyler Hicks Date: Thu May 26 18:59:59 2022 -0500 9p: Fix refcounting during full path walks for fid lookups Decrement the refcount of the parent dentry's fid after walking each path component during a full path walk for a lookup. Failure to do so can lead to fids that are not clunked until the filesystem is unmounted, as indicated by this warning: 9pnet: found fid 3 not clunked The improper refcounting after walking resulted in open(2) returning -EIO on any directories underneath the mount point when using the virtio transport. When using the fd transport, there's no apparent issue until the filesytem is unmounted and the warning above is emitted to the logs. In some cases, the user may not yet be attached to the filesystem and a new root fid, associated with the user, is created and attached to the root dentry before the full path walk is performed. Increment the new root fid's refcount to two in that situation so that it can be safely decremented to one after it is used for the walk operation. The new fid will still be attached to the root dentry when v9fs_fid_lookup_with_uid() returns so a final refcount of one is correct/expected. Link: https://lkml.kernel.org/r/20220527000003.355812-2-tyhicks@linux.microsoft.com Link: https://lkml.kernel.org/r/20220612085330.1451496-4-asmadeus@codewreck.org Fixes: 6636b6dcc3db ("9p: add refcount to p9_fid struct") Cc: stable@vger.kernel.org Signed-off-by: Tyler Hicks Reviewed-by: Christian Schoenebeck [Dominique: fix clunking fid multiple times discussed in second link] Signed-off-by: Dominique Martinet commit e5690f263208c5abce7451370b7786eb25b405eb Author: Dominique Martinet Date: Sun Jun 12 17:14:55 2022 +0900 9p: fix fid refcount leak in v9fs_vfs_get_link we check for protocol version later than required, after a fid has been obtained. Just move the version check earlier. Link: https://lkml.kernel.org/r/20220612085330.1451496-3-asmadeus@codewreck.org Fixes: 6636b6dcc3db ("9p: add refcount to p9_fid struct") Cc: stable@vger.kernel.org Reviewed-by: Tyler Hicks Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit beca774fc51a9ba8abbc869cf0c3d965ff17cd24 Author: Dominique Martinet Date: Sun Jun 12 16:00:05 2022 +0900 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl We need to release directory fid if we fail halfway through open This fixes fid leaking with xfstests generic 531 Link: https://lkml.kernel.org/r/20220612085330.1451496-2-asmadeus@codewreck.org Fixes: 6636b6dcc3db ("9p: add refcount to p9_fid struct") Cc: stable@vger.kernel.org Reported-by: Tyler Hicks Reviewed-by: Tyler Hicks Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit d7dd6eccfbc95ac47a12396f84e7e1b361db654b Author: Christophe JAILLET Date: Mon Jun 13 22:53:50 2022 +0200 net: bgmac: Fix an erroneous kfree() in bgmac_remove() 'bgmac' is part of a managed resource allocated with bgmac_alloc(). It should not be freed explicitly. Remove the erroneous kfree() from the .remove() function. Fixes: 34a5102c3235 ("net: bgmac: allocate struct bgmac just once & don't copy it") Signed-off-by: Christophe JAILLET Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/a026153108dd21239036a032b95c25b5cece253b.1655153616.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit e591fcf6b4e39335c9b128b17738fcd2fdd278ae Author: Chevron Li Date: Thu Jun 2 06:25:43 2022 -0700 mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing The result from ->get_cd() may be incorrect as the card detect debouncing isn't managed correctly. Let's fix it. Signed-off-by: Chevron Li Fixes: 7d44061704dd ("mmc: sdhci-pci-o2micro: Fix O2 Host data read/write DLL Lock phase shift issue") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220602132543.596-1-chevron.li@bayhubtech.com [Ulf: Updated the commit message] Signed-off-by: Ulf Hansson commit de87b603b0919e31578c8fa312a3541f1fb37e1c Author: Christophe JAILLET Date: Sun May 22 14:22:07 2022 +0200 i2c: mediatek: Fix an error handling path in mtk_i2c_probe() The clsk are prepared, enabled, then disabled. So if an error occurs after the disable step, they are still prepared. Add an error handling path to unprepare the clks in such a case, as already done in the .remove function. Fixes: 8b4fc246c3ff ("i2c: mediatek: Optimize master_xfer() and avoid circular locking") Signed-off-by: Christophe JAILLET Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Qii Wang Signed-off-by: Wolfram Sang commit 62b5e322fb6cc5a5a91fdeba0e4e57e75d9f4387 Author: Jonathan Marek Date: Mon Jun 13 18:10:19 2022 -0400 drm/msm: use for_each_sgtable_sg to iterate over scatterlist The dma_map_sgtable() call (used to invalidate cache) overwrites sgt->nents with 1, so msm_iommu_pagetable_map maps only the first physical segment. To fix this problem use for_each_sgtable_sg(), which uses orig_nents. Fixes: b145c6e65eb0 ("drm/msm: Add support to create a local pagetable") Signed-off-by: Jonathan Marek Link: https://lore.kernel.org/r/20220613221019.11399-1-jonathan@marek.ca Signed-off-by: Rob Clark commit 018ab4fabddd94f1c96f3b59e180691b9e88d5d8 Author: Linus Torvalds Date: Tue Jun 14 10:36:11 2022 -0700 netfs: fix up netfs_inode_init() docbook comment Commit e81fb4198e27 ("netfs: Further cleanups after struct netfs_inode wrapper introduced") changed the argument types and names, and actually updated the comment too (although that was thanks to David Howells, not me: my original patch only changed the code). But the comment fixup didn't go quite far enough, and didn't change the argument name in the comment, resulting in include/linux/netfs.h:314: warning: Function parameter or member 'ctx' not described in 'netfs_inode_init' include/linux/netfs.h:314: warning: Excess function parameter 'inode' description in 'netfs_inode_init' during htmldoc generation. Fixes: e81fb4198e27 ("netfs: Further cleanups after struct netfs_inode wrapper introduced") Reported-by: Stephen Rothwell Signed-off-by: Linus Torvalds commit 795285ef242543bb636556b7225f20adb7d3795c Author: Mark Brown Date: Tue Jun 14 13:10:45 2022 +0100 selftests: Fix clang cross compilation Unlike GCC clang uses a single compiler image to support multiple target architectures meaning that we can't simply rely on CROSS_COMPILE to select the output architecture. Instead we must pass --target to the compiler to tell it what to output, kselftest was not doing this so cross compilation of kselftest using clang resulted in kselftest being built for the host architecture. More work is required to fix tests using custom rules but this gets the bulk of things building. Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit 4fd17f2ac0aa4e48823ac2ede5b050fb70300bf4 Author: Roman Li Date: Thu May 19 14:41:16 2022 -0400 drm/amd/display: Cap OLED brightness per max frame-average luminance [Why] For OLED eDP the Display Manager uses max_cll value as a limit for brightness control. max_cll defines the content light luminance for individual pixel. Whereas max_fall defines frame-average level luminance. The user may not observe the difference in brightness in between max_fall and max_cll. That negatively impacts the user experience. [How] Use max_fall value instead of max_cll as a limit for brightness control. Reviewed-by: Rodrigo Siqueira Acked-by: Hamza Mahfooz Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c904e3acbab3fd97649cd4ab1ff7f1521ad3a255 Author: Michel Dänzer Date: Fri Jun 10 15:54:26 2022 +0200 drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl The commit below changed the TTM manager size unit from pages to bytes, but failed to adjust the corresponding calculations in amdgpu_ioctl. Fixes: dfa714b88eb0 ("drm/amdgpu: remove GTT accounting v2") Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1930 Bug: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6642 Tested-by: Martin Roukala Tested-by: Mike Lothian Reviewed-by: Christian König Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit d884b6498d2f022098502e106d5a45ab635f2e9a Author: Pavel Begunkov Date: Tue Jun 14 17:51:18 2022 +0100 io_uring: remove IORING_CLOSE_FD_AND_FILE_SLOT This partially reverts a7c41b4687f5902af70cd559806990930c8a307b Even though IORING_CLOSE_FD_AND_FILE_SLOT might save cycles for some users, but it tries to do two things at a time and it's not clear how to handle errors and what to return in a single result field when one part fails and another completes well. Kill it for now. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/837c745019b3795941eee4fcfd7de697886d645b.1655224415.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit aa165d6d2bb55f8b1bb5047fd634311681316fa2 Author: Pavel Begunkov Date: Tue Jun 14 17:51:17 2022 +0100 Revert "io_uring: add buffer selection support to IORING_OP_NOP" This reverts commit 3d200242a6c968af321913b635fc4014b238cba4. Buffer selection with nops was used for debugging and benchmarking but is useless in real life. Let's revert it before it's released. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c5012098ca6b51dfbdcb190f8c4e3c0bf1c965dc.1655224415.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 8899ce4b2f7364a90e3b9cf332dfd9993c61f46c Author: Pavel Begunkov Date: Tue Jun 14 17:51:16 2022 +0100 Revert "io_uring: support CQE32 for nop operation" This reverts commit 2bb04df7c2af9dad5d28771c723bc39b01cf7df4. CQE32 nops were used for debugging and benchmarking but it doesn't target any real use case. Revert it, we can return it back if someone finds a good way to use it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/5ff623d84ccb4b3f3b92a3ea41cdcfa612f3d96f.1655224415.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit efe41860008e57fb6b69855b4b93fdf34bc42798 Author: Przemyslaw Patynowski Date: Thu Jun 2 12:09:17 2022 +0200 ice: Fix memory corruption in VF driver Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may unmap DMA resources. In such scenario device still can map packets to memory, which ends up silently corrupting it. Previously, VF driver could experience memory corruption, which lead to crash: [ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237 [ 5119.170166] PGD 0 P4D 0 [ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI [ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 [ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 [ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf] [ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30 [ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74 [ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 [ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002 [ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203 [ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009 [ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000 [ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS: 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 [ 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 [ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5119.170290] PKRU: 55555554 [ 5119.170292] Call Trace: [ 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] [ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] [ 5119.170358] iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] [ 5119.170377] ? iavf_clean_arq_element+0x210/0x280 [iavf] [ 5119.170397] iavf_adminq_task+0x126/0x2e0 [iavf] [ 5119.170416] process_one_work+0x18f/0x420 [ 5119.170429] worker_thread+0x30/0x370 [ 5119.170437] ? process_one_work+0x420/0x420 [ 5119.170445] kthread+0x151/0x170 [ 5119.170452] ? set_kthread_struct+0x40/0x40 [ 5119.170460] ret_from_fork+0x35/0x40 [ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas [ 5119.170613] i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf] [ 5119.170627] CR2: 00001b9780003237 Fixes: ec4f5a436bdf ("ice: Check if VF is disabled for Opcode and other operations") Signed-off-by: Przemyslaw Patynowski Co-developed-by: Slawomir Laba Signed-off-by: Slawomir Laba Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit be2af71496a54a7195ac62caba6fab49cfe5006c Author: Przemyslaw Patynowski Date: Thu Jun 2 12:09:04 2022 +0200 ice: Fix queue config fail handling Disable VF's RX/TX queues, when VIRTCHNL_OP_CONFIG_VSI_QUEUES fail. Not disabling them might lead to scenario, where PF driver leaves VF queues enabled, when VF's VSI failed queue config. In this scenario VF should not have RX/TX queues enabled. If PF failed to set up VF's queues, VF will reset due to TX timeouts in VF driver. Initialize iterator 'i' to -1, so if error happens prior to configuring queues then error path code will not disable queue 0. Loop that configures queues will is using same iterator, so error path code will only disable queues that were configured. Fixes: 77ca27c41705 ("ice: add support for virtchnl_queue_select.[tx|rx]_queues bitmap") Suggested-by: Slawomir Laba Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 9542ef4fba8c73e176b8aa18a8adf04aecb889e5 Author: Roman Storozhenko Date: Tue Jun 7 08:54:57 2022 +0200 ice: Sync VLAN filtering features for DVM VLAN filtering features, that is C-Tag and S-Tag, in DVM mode must be both enabled or disabled. In case of turning off/on only one of the features, another feature must be turned off/on automatically with issuing an appropriate message to the kernel log. Fixes: 1babaf77f49d ("ice: Advertise 802.1ad VLAN filtering and offloads for PF netdev") Signed-off-by: Roman Storozhenko Co-developed-by: Anatolii Gerasymenko Signed-off-by: Anatolii Gerasymenko Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 71a579f0d3777a704355e6f1572dfba92a9b58b2 Author: Michal Michalik Date: Tue May 10 13:03:43 2022 +0200 ice: Fix PTP TX timestamp offset calculation The offset was being incorrectly calculated for E822 - that led to collisions in choosing TX timestamp register location when more than one port was trying to use timestamping mechanism. In E822 one quad is being logically split between ports, so quad 0 is having trackers for ports 0-3, quad 1 ports 4-7 etc. Each port should have separate memory location for tracking timestamps. Due to error for example ports 1 and 2 had been assigned to quad 0 with same offset (0), while port 1 should have offset 0 and 1 offset 16. Fix it by correctly calculating quad offset. Fixes: 3a7496234d17 ("ice: implement basic E822 PTP support") Signed-off-by: Michal Michalik Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 24625f7d91fb86b91e14749633a7f022f5866116 Merge: 8e8afafb0b557 e0f3f46e42064 Author: Linus Torvalds Date: Tue Jun 14 07:57:18 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "While last week's pull request contained miscellaneous fixes for x86, this one covers other architectures, selftests changes, and a bigger series for APIC virtualization bugs that were discovered during 5.20 development. The idea is to base 5.20 development for KVM on top of this tag. ARM64: - Properly reset the SVE/SME flags on vcpu load - Fix a vgic-v2 regression regarding accessing the pending state of a HW interrupt from userspace (and make the code common with vgic-v3) - Fix access to the idreg range for protected guests - Ignore 'kvm-arm.mode=protected' when using VHE - Return an error from kvm_arch_init_vm() on allocation failure - A bunch of small cleanups (comments, annotations, indentation) RISC-V: - Typo fix in arch/riscv/kvm/vmid.c - Remove broken reference pattern from MAINTAINERS entry x86-64: - Fix error in page tables with MKTME enabled - Dirty page tracking performance test extended to running a nested guest - Disable APICv/AVIC in cases that it cannot implement correctly" [ This merge also fixes a misplaced end parenthesis bug introduced in commit 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") pointed out by Sean Christopherson ] Link: https://lore.kernel.org/all/20220610191813.371682-1-seanjc@google.com/ * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (34 commits) KVM: selftests: Restrict test region to 48-bit physical addresses when using nested KVM: selftests: Add option to run dirty_log_perf_test vCPUs in L2 KVM: selftests: Clean up LIBKVM files in Makefile KVM: selftests: Link selftests directly with lib object files KVM: selftests: Drop unnecessary rule for STATIC_LIBS KVM: selftests: Add a helper to check EPT/VPID capabilities KVM: selftests: Move VMX_EPT_VPID_CAP_AD_BITS to vmx.h KVM: selftests: Refactor nested_map() to specify target level KVM: selftests: Drop stale function parameter comment for nested_map() KVM: selftests: Add option to create 2M and 1G EPT mappings KVM: selftests: Replace x86_page_size with PG_LEVEL_XX KVM: x86: SVM: fix nested PAUSE filtering when L0 intercepts PAUSE KVM: x86: SVM: drop preempt-safe wrappers for avic_vcpu_load/put KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un|}blocking KVM: x86: disable preemption while updating apicv inhibition KVM: x86: SVM: fix avic_kick_target_vcpus_fast KVM: x86: SVM: remove avic's broken code that updated APIC ID KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base KVM: x86: document AVIC/APICv inhibit reasons KVM: x86/mmu: Set memory encryption "value", not "mask", in shadow PDPTRs ... commit a6e944f25cdbe6b82275402b8bc9a55ad7aac10b Author: Ciara Loftus Date: Tue Jun 14 07:07:46 2022 +0000 xsk: Fix generic transmit when completion queue reservation fails Two points of potential failure in the generic transmit function are: 1. completion queue (cq) reservation failure. 2. skb allocation failure Originally the cq reservation was performed first, followed by the skb allocation. Commit 675716400da6 ("xdp: fix possible cq entry leak") reversed the order because at the time there was no mechanism available to undo the cq reservation which could have led to possible cq entry leaks in the event of skb allocation failure. However if the skb allocation is performed first and the cq reservation then fails, the xsk skb destructor is called which blindly adds the skb address to the already full cq leading to undefined behavior. This commit restores the original order (cq reservation followed by skb allocation) and uses the xskq_prod_cancel helper to undo the cq reserve in event of skb allocation failure. Fixes: 675716400da6 ("xdp: fix possible cq entry leak") Signed-off-by: Ciara Loftus Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20220614070746.8871-1-ciara.loftus@intel.com commit 8e8afafb0b5571b7cb10b529dc60cadb7241bed4 Merge: b13baccc3850c 1dc6ff02c8bf7 Author: Linus Torvalds Date: Tue Jun 14 07:43:15 2022 -0700 Merge tag 'x86-bugs-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 MMIO stale data fixes from Thomas Gleixner: "Yet another hw vulnerability with a software mitigation: Processor MMIO Stale Data. They are a class of MMIO-related weaknesses which can expose stale data by propagating it into core fill buffers. Data which can then be leaked using the usual speculative execution methods. Mitigations include this set along with microcode updates and are similar to MDS and TAA vulnerabilities: VERW now clears those buffers too" * tag 'x86-bugs-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation/mmio: Print SMT warning KVM: x86/speculation: Disable Fill buffer clear within guests x86/speculation/mmio: Reuse SRBDS mitigation for SBDS x86/speculation/srbds: Update SRBDS mitigation selection x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data x86/speculation/mmio: Enable CPU Fill buffer clearing on idle x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data x86/speculation: Add a common function for MD_CLEAR mitigation update x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug Documentation: Add documentation for Processor MMIO Stale Data commit 4b7a632ac4e7101ceefee8484d5c2ca505d347b3 Author: Petr Machata Date: Mon Jun 13 15:50:17 2022 +0300 mlxsw: spectrum_cnt: Reorder counter pools Both RIF and ACL flow counters use a 24-bit SW-managed counter address to communicate which counter they want to bind. In a number of Spectrum FW releases, binding a RIF counter is broken and slices the counter index to 16 bits. As a result, on Spectrum-2 and above, no more than about 410 RIF counters can be effectively used. This translates to 205 netdevices for which L3 HW stats can be enabled. (This does not happen on Spectrum-1, because there are fewer counters available overall and the counter index never exceeds 16 bits.) Binding counters to ACLs does not have this issue. Therefore reorder the counter allocation scheme so that RIF counters come first and therefore get lower indices that are below the 16-bit barrier. Fixes: 98e60dce4da1 ("Merge branch 'mlxsw-Introduce-initial-Spectrum-2-support'") Reported-by: Maksym Yaremchuk Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Link: https://lore.kernel.org/r/20220613125017.2018162-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 7d787184a18f0f84e996de8ff007e4395c1978ea Author: Marek Szyprowski Date: Fri May 13 10:31:05 2022 +0200 drm/exynos: mic: Rework initialization Commit dd8b6803bc49 ("exynos: drm: dsi: Attach in_bridge in MIC driver") moved Exynos MIC attaching from DSI to MIC driver. However the method proposed there is incomplete and cannot really work. To properly attach it to the bridge chain, access to the respective encoder is needed. The Exynos MIC driver always attaches to the encoder created by the Exynos DSI driver, so grab it via available helpers for getting access to the CRTC and encoders. This also requires to change the order of driver component binding to let DSI to be bound before MIC. Fixes: dd8b6803bc49 ("exynos: drm: dsi: Attach in_bridge in MIC driver") Signed-off-by: Marek Szyprowski Fixed merge conflict. Signed-off-by: Inki Dae commit 5c2b745173347ba21e3995d815f26925c91c517d Author: Dan Carpenter Date: Fri Apr 8 13:21:34 2022 +0300 drm/exynos: fix IS_ERR() vs NULL check in probe The of_drm_find_bridge() does not return error pointers, it returns NULL on error. Fixes: dd8b6803bc49 ("exynos: drm: dsi: Attach in_bridge in MIC driver") Signed-off-by: Dan Carpenter Signed-off-by: Inki Dae commit 5e93207e962a6d23893ff4405f6c5d4396fb5934 Author: Serge Semin Date: Fri Jun 10 13:40:30 2022 +0300 bus: bt1-axi: Don't print error on -EPROBE_DEFER The Baikal-T1 AXI bus driver correctly handles the deferred probe situation, but still pollutes the system log with a misleading error message. Let's fix that by using the dev_err_probe() method to print the log message in case of the clocks/resets request errors. Signed-off-by: Serge Semin Link: https://lore.kernel.org/r/20220610104030.28399-2-Sergey.Semin@baikalelectronics.ru' Signed-off-by: Arnd Bergmann commit be5cddef05f519a321a543906f255ac247246074 Author: Serge Semin Date: Fri Jun 10 13:40:29 2022 +0300 bus: bt1-apb: Don't print error on -EPROBE_DEFER The Baikal-T1 APB bus driver correctly handles the deferred probe situation, but still pollutes the system log with a misleading error message. Let's fix that by using the dev_err_probe() method to print the log message in case of the clocks/resets request errors. Signed-off-by: Serge Semin Link: https://lore.kernel.org/r/20220610104030.28399-1-Sergey.Semin@baikalelectronics.ru' Signed-off-by: Arnd Bergmann commit 965890425271b6a35a07b85384f4a6e4fc517322 Merge: 11bb764fbf51b 46d6e11320d21 Author: Arnd Bergmann Date: Tue Jun 14 12:20:46 2022 +0200 Merge tag 'arm-soc/for-5.19/maintainers-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains MAINTAINERS file update for Broadcom SoCs, please pull the following: - Nicolas steps down from maintaining the BCM283x/BCM2711 (Raspberry Pi) architecture and designates Florian to take care of that * tag 'arm-soc/for-5.19/maintainers-fixes' of https://github.com/Broadcom/stblinux: MAINTAINERS: Update BCM2711/BCM2835 maintainer Link: https://lore.kernel.org/r/20220608093132.1465703-2-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 11bb764fbf51bc8c859484104553f3d627db8b1e Merge: 2d2cb31bd36b7 37d838de369b0 Author: Arnd Bergmann Date: Tue Jun 14 12:20:30 2022 +0200 Merge tag 'arm-soc/for-5.19/drivers-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs driver fixes for 5.19, please pull the following: - Miaoqian fixes a device tree node reference count in the system sleep code for Broadcom STB chips * tag 'arm-soc/for-5.19/drivers-fixes' of https://github.com/Broadcom/stblinux: soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe Link: https://lore.kernel.org/r/20220608093132.1465703-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 2d2cb31bd36b758e20c6922a9793df9ce41e9bc6 Merge: 7c7ff68daa93d 680c0aee97690 Author: Arnd Bergmann Date: Tue Jun 14 12:19:57 2022 +0200 Merge tag 's32g2-fixes-5.19' of https://github.com/chesterlintw/linux-s32g into arm/fixes S32G2 fixes for 5.19 - MAINTAINERS: Add s32@nxp.com as a review group. - dts: Pass unit name to soc node to fix a W=1 build warning. * tag 's32g2-fixes-5.19' of https://github.com/chesterlintw/linux-s32g: MAINTAINERS: add a new reviewer for S32G arm64: s32g2: Pass unit name to soc node Link: https://lore.kernel.org/r/Yp9Y4nGrQ2kVKV6S@linux-8mug Signed-off-by: Arnd Bergmann commit 7c7ff68daa93d8c4cdea482da4f2429c0398fcde Author: Miaoqian Lin Date: Wed Jun 1 13:05:48 2022 +0400 ARM: Fix refcount leak in axxia_boot_secondary of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 1d22924e1c4e ("ARM: Add platform support for LSI AXM55xx SoC") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220601090548.47616-1-linmq006@gmail.com' Signed-off-by: Arnd Bergmann commit 168f912893407a5acb798a4a58613b5f1f98c717 Author: Christian Brauner Date: Mon Jun 13 13:15:17 2022 +0200 fs: account for group membership When calling setattr_prepare() to determine the validity of the attributes the ia_{g,u}id fields contain the value that will be written to inode->i_{g,u}id. This is exactly the same for idmapped and non-idmapped mounts and allows callers to pass in the values they want to see written to inode->i_{g,u}id. When group ownership is changed a caller whose fsuid owns the inode can change the group of the inode to any group they are a member of. When searching through the caller's groups we need to use the gid mapped according to the idmapped mount otherwise we will fail to change ownership for unprivileged users. Consider a caller running with fsuid and fsgid 1000 using an idmapped mount that maps id 65534 to 1000 and 65535 to 1001. Consequently, a file owned by 65534:65535 in the filesystem will be owned by 1000:1001 in the idmapped mount. The caller now requests the gid of the file to be changed to 1000 going through the idmapped mount. In the vfs we will immediately map the requested gid to the value that will need to be written to inode->i_gid and place it in attr->ia_gid. Since this idmapped mount maps 65534 to 1000 we place 65534 in attr->ia_gid. When we check whether the caller is allowed to change group ownership we first validate that their fsuid matches the inode's uid. The inode->i_uid is 65534 which is mapped to uid 1000 in the idmapped mount. Since the caller's fsuid is 1000 we pass the check. We now check whether the caller is allowed to change inode->i_gid to the requested gid by calling in_group_p(). This will compare the passed in gid to the caller's fsgid and search the caller's additional groups. Since we're dealing with an idmapped mount we need to pass in the gid mapped according to the idmapped mount. This is akin to checking whether a caller is privileged over the future group the inode is owned by. And that needs to take the idmapped mount into account. Note, all helpers are nops without idmapped mounts. New regression test sent to xfstests. Link: https://github.com/lxc/lxd/issues/10537 Link: https://lore.kernel.org/r/20220613111517.2186646-1-brauner@kernel.org Fixes: 2f221d6f7b88 ("attr: handle idmapped mounts") Cc: Seth Forshee Cc: Christoph Hellwig Cc: Aleksa Sarai Cc: Al Viro Cc: stable@vger.kernel.org # 5.15+ CC: linux-fsdevel@vger.kernel.org Reviewed-by: Seth Forshee Signed-off-by: Christian Brauner (Microsoft) commit 89931cb463d861faf987dbbff9db986fe59293f7 Author: Alexandre Torgue Date: Mon Jun 13 09:19:20 2022 +0200 ARM: dts: stm32: move SCMI related nodes in a dedicated file for stm32mp15 Adding a "secure" version of STM32 boards (DK1/DK2/ED1/EV1), SCMI (clock/ reset) protocol and OP-TEE node have been added in SoC dtsi file (stm32mp151.dtsi). They have been added with a status disabled in order to keep our legacy unchanged. It is actually not enough to keep our legacy unchanged. First, just a reminder about our use case: TF-A (BL2) loads and starts OP-TEE, then loads and runs U-Boot. U-Boot code checks if an OP-TEE is running, if yes it searches in Kernel device tree if an OP-TEE node is present: -If the OP-TEE node is not present then U-Boot copies OP-TEE node and its reserved memory region from U-Boot device tree to the kernel device tree. -If the OP-TEE node is present then it does nothing (this OP-TEE node will be used by Linux). So U-Boot lets the kernel device tree unchanged thinking it is correct for an OP-TEE usage. It is the case for our legacy boards, the OP-TEE node is present (although disabled) but the reserved memory region is not declared. As no memory region has been reserved for OP-TEE, the end of DDR is seen by the kernel as free and then used for CMA. But as OP-TEE is running, this end of DDR is already used by OP-TEE. So as soon as kernel tries to access to the CMA region OP-TEE raises an error. To fix it, all OP-TEE node and SCMI is moved in a dedicated file. Fixes: 40b4157dbd8c ("ARM: dts: stm32: enable optee firmware and SCMI support on STM32MP15") Signed-off-by: Alexandre Torgue Link: https://lore.kernel.org/r/20220613071920.5463-1-alexandre.torgue@foss.st.com' Signed-off-by: Arnd Bergmann commit 002ec157477c727e238087c8cf3d02962d7bd64e Merge: 2916bf223379c 44dbdf3bb3f44 Author: Arnd Bergmann Date: Tue Jun 14 12:16:34 2022 +0200 Merge tag 'scmi-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI firmware driver fixes for v5.19 Bunch of fixes to address: 1. Issues reported on RK3568 EVB1 and BPI-R2 pro platforms using SCMI. More checks were added to validate the firmware response but that resulted in breaking above platforms, so the checks are relaxed when for cases where there is no potential memory corruption issues. 2. Possible data leak by reading more than required length from the firmware. Recent addition of support for v3.1 extended names used larger buffers in the kernel and used their size to read response from the firmware even for cases where shorter formats are used. While that is mostly harmless except when firmware sends malformed non-NULL terminated buffers. 3. Possible issues sending unsupported commands to the firmware. SENSOR_AXIS_NAME_GET added in v3.1 needs to be used only if the firmware supports it. While the firmware conformant to the spec must return not supported error for any unsupported features, it is always safer to avoid issuing commands that are known to be unsupported. 4. Incorrect error propagation in scmi_voltage_descriptors_get. Since the return value is not reset for each iteration of the loop, the error value in the previous iteration will be carried for the current one. Fix that by not saving the return values into local variable. 5. Some warnings reported by cppcheck * tag 'scmi-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix incorrect error propagation in scmi_voltage_descriptors_get firmware: arm_scmi: Avoid using extended string-buffers sizes if not necessary firmware: arm_scmi: Fix SENSOR_AXIS_NAME_GET behaviour when unsupported firmware: arm_scmi: Remove all the unused local variables firmware: arm_scmi: Relax base protocol sanity checks on the protocol list Link: https://lore.kernel.org/r/20220614100007.1029881-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 2916bf223379c7a61ef2b796e547c56894ad9695 Merge: b13baccc3850c 7c7eaeefb0ae2 Author: Arnd Bergmann Date: Tue Jun 14 12:15:43 2022 +0200 Merge tag 'imx-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.19: - Correct i.MX7 power domain for HSIC USB PHY node to fix an USB Host issue, that is all downstream events will be lost if USB host is runtime suspended. - Fix i.MX8M blk-ctrl LCDIF2 power domain to point to refer to the correct clock. - Correct i.MX6Q/DL PU regulator ramp delay to fix some peripherals power-up failure especially when the chip is at a low temperature. - Fix capacitive touch reset polarity for imx6qdl-colibri board. * tag 'imx-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx: imx8m-blk-ctrl: fix display clock for LCDIF2 power domain ARM: dts: imx6qdl-colibri: Fix capacitive touch reset polarity ARM: dts: imx6qdl: correct PU regulator ramp delay ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node Link: https://lore.kernel.org/r/20220614095515.GU254723@dragon Signed-off-by: Arnd Bergmann commit 0f9cd1ea10d307cad221d6693b648a8956e812b0 Author: Christian König Date: Mon Jun 13 09:37:03 2022 +0200 drm/ttm: fix bulk move handling v2 The resource must be on the LRU before ttm_lru_bulk_move_add() is called and we need to check if the BO is pinned or not before adding it. Additional to that we missed taking the LRU spinlock in ttm_bo_unpin(). Signed-off-by: Christian König Reviewed-by: Arunpravin Paneer Selvam Acked-by: Luben Tuikov Link: https://patchwork.freedesktop.org/patch/msgid/20220613080816.4965-1-christian.koenig@amd.com Fixes: fee2ede15542 ("drm/ttm: rework bulk move handling v5") commit 9cc8ea99bf7ae6f5a5a305bb14a6f1e3f18f5f54 Author: Jonathan Neuschäfer Date: Fri Jun 10 09:28:08 2022 +0200 docs: networking: phy: Fix a typo Write "to be operated" instead of "to be operate". Signed-off-by: Jonathan Neuschäfer Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220610072809.352962-1-j.neuschaefer@gmx.net Signed-off-by: Jakub Kicinski commit 884c65e4daf3eab8730b2bbd5abc5a2c0403b3f3 Author: Jean-Philippe Brucker Date: Thu Jun 9 17:14:59 2022 +0100 amd-xgbe: Use platform_irq_count() The AMD XGbE driver currently counts the number of interrupts assigned to the device by inspecting the pdev->resource array. Since commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") removed IRQs from this array, the driver now attempts to get all interrupts from 1 to -1U and gives up probing once it reaches an invalid interrupt index. Obtain the number of IRQs with platform_irq_count() instead. Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") Signed-off-by: Jean-Philippe Brucker Acked-by: Rob Herring Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220609161457.69614-1-jean-philippe@linaro.org Signed-off-by: Jakub Kicinski commit 7c7eaeefb0ae226da9233d5db265652d900e1fcb Author: Alexander Stein Date: Tue May 24 09:39:34 2022 +0200 soc: imx: imx8m-blk-ctrl: fix display clock for LCDIF2 power domain LCDIF2 has its own display clock, use this one. Fixes: 07614fed00e9 ("soc: imx: imx8m-blk-ctrl: Add i.MX8MP media blk-ctrl") Signed-off-by: Alexander Stein Reviewed-by: Paul Elder Tested-by: Martyn Welch Signed-off-by: Shawn Guo commit b426310e509a1fde077fbe684ecc4a4a694d2bab Author: Max Krummenacher Date: Fri May 13 12:26:12 2022 +0200 ARM: dts: imx6qdl-colibri: Fix capacitive touch reset polarity The commit feedaacdadfc ("Input: atmel_mxt_ts - fix up inverted RESET handler") requires the reset GPIO to have GPIO_ACTIVE_LOW. Fixes: 1524b27c94a6 ("ARM: dts: imx6dl-colibri: Move common nodes to SoM dtsi") Reviewed-by: Fabio Estevam Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 93a8ba2a619816d631bd69e9ce2172b4d7a481b8 Author: Lucas Stach Date: Wed May 11 18:08:23 2022 +0200 ARM: dts: imx6qdl: correct PU regulator ramp delay Contrary to what was believed at the time, the ramp delay of 150us is not plenty for the PU LDO with the default step time of 512 pulses of the 24MHz clock. Measurements have shown that after enabling the LDO the voltage on VDDPU_CAP jumps to ~750mV in the first step and after that the regulator executes the normal ramp up as defined by the step size control. This means it takes the regulator between 360us and 370us to ramp up to the nominal 1.15V voltage for this power domain. With the old setting of the ramp delay the power up of the PU GPC domain would happen in the middle of the regulator ramp with the voltage being at around 900mV. Apparently this was enough for most units to properly power up the peripherals in the domain and execute the reset. Some units however, fail to power up properly, especially when the chip is at a low temperature. In that case any access to the GPU registers would yield an incorrect result with no way to recover from this situation. Change the ramp delay to 380us to cover the measured ramp up time with a bit of additional slack. Fixes: 40130d327f72 ("ARM: dts: imx6qdl: Allow disabling the PU regulator, add a enable ramp delay") Signed-off-by: Lucas Stach Signed-off-by: Shawn Guo commit f6eed15f3ea76596ccc689331e1cc850b999133b Author: Sergey Gorenko Date: Mon Jun 13 15:38:54 2022 +0300 scsi: iscsi: Exclude zero from the endpoint ID range The kernel returns an endpoint ID as r.ep_connect_ret.handle in the iscsi_uevent. The iscsid validates a received endpoint ID and treats zero as an error. The commit referenced in the fixes line changed the endpoint ID range, and zero is always assigned to the first endpoint ID. So, the first attempt to create a new iSER connection always fails. Link: https://lore.kernel.org/r/20220613123854.55073-1-sergeygo@nvidia.com Fixes: 3c6ae371b8a1 ("scsi: iscsi: Release endpoint ID when its freed") Reviewed-by: Max Gurtovoy Reviewed-by: Mike Christie Reviewed-by: Lee Duncan Signed-off-by: Sergey Gorenko Signed-off-by: Martin K. Petersen commit 49e477610087a02c3604061b8f3ee3a25a493987 Author: Rob Clark Date: Wed Jun 8 09:13:34 2022 -0700 drm/msm: Switch ordering of runpm put vs devfreq_idle In msm_devfreq_suspend() we cancel idle_work synchronously so that it doesn't run after we power of the hw or in the resume path. But this means that we want to ensure that idle_work is not scheduled *after* we no longer hold a runpm ref. So switch the ordering of pm_runtime_put() vs msm_devfreq_idle(). v2. Only move the runpm _put_autosuspend, and not the _mark_last_busy() Fixes: 9bc95570175a ("drm/msm: Devfreq tuning") Signed-off-by: Rob Clark Link: https://lore.kernel.org/r/20210927152928.831245-1-robdclark@gmail.com Reviewed-by: Akhil P Oommen Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20220608161334.2140611-1-robdclark@gmail.com Signed-off-by: Rob Clark commit 43047e082b90ead395c44b0e8497bc853bd13845 Author: rasheed.hsueh Date: Fri Jun 10 14:27:34 2022 +0800 nvme-pci: disable write zeros support on UMIC and Samsung SSDs Like commit 5611ec2b9814 ("nvme-pci: prevent SK hynix PC400 from using Write Zeroes command"), UMIS and Samsung has the same issue: [ 6305.633887] blk_update_request: operation not supported error, dev nvme0n1, sector 340812032 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 So also disable Write Zeroes command on UMIS and Samsung. Signed-off-by: rasheed.hsueh Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 6b961bce50e489186232cef51036ddb8d672bc3b Author: Ning Wang Date: Sun Jun 5 20:36:48 2022 +0000 nvme-pci: avoid the deepest sleep state on ZHITAI TiPro7000 SSDs When ZHITAI TiPro7000 SSDs entered deepest power state(ps4) it has the same APST sleep problem as Kingston A2000. by chance the system crashes and displays the same dmesg info: https://bugzilla.kernel.org/show_bug.cgi?id=195039#c65 As the Archlinux wiki suggest (enlat + exlat) < 25000 is fine and my testing shows no system crashes ever since. Therefore disabling the deepest power state will fix the APST sleep issue. https://wiki.archlinux.org/title/Solid_state_drive/NVMe This is the APST data from 'nvme id-ctrl /dev/nvme1' NVME Identify Controller: vid : 0x1e49 ssvid : 0x1e49 sn : [...] mn : ZHITAI TiPro7000 1TB fr : ZTA32F3Y [...] ps 0 : mp:3.50W operational enlat:5 exlat:5 rrt:0 rrl:0 rwt:0 rwl:0 idle_power:- active_power:- ps 1 : mp:3.30W operational enlat:50 exlat:100 rrt:1 rrl:1 rwt:1 rwl:1 idle_power:- active_power:- ps 2 : mp:2.80W operational enlat:50 exlat:200 rrt:2 rrl:2 rwt:2 rwl:2 idle_power:- active_power:- ps 3 : mp:0.1500W non-operational enlat:500 exlat:5000 rrt:3 rrl:3 rwt:3 rwl:3 idle_power:- active_power:- ps 4 : mp:0.0200W non-operational enlat:2000 exlat:60000 rrt:4 rrl:4 rwt:4 rwl:4 idle_power:- active_power:- Signed-off-by: Ning Wang Signed-off-by: Christoph Hellwig commit c4f01a776b28378f4f61b53f8cb0e358f4fa3721 Author: Keith Busch Date: Mon Jun 13 07:45:49 2022 -0700 nvme-pci: sk hynix p31 has bogus namespace ids Add the quirk. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216049 Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit c98a879312caf775c9768faed25ce1c013b4df04 Author: Keith Busch Date: Mon Jun 13 07:45:48 2022 -0700 nvme-pci: smi has bogus namespace ids Add the quirk. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216096 Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 2cf7a77ed5f8903606f4f7833d02d67b08650442 Author: Keith Busch Date: Mon Jun 13 07:45:47 2022 -0700 nvme-pci: phison e12 has bogus namespace ids Add the quirk. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216049 Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 3765fad508964f433ac111c127d6bedd19bdfa04 Author: Stefan Reiter Date: Mon Jun 6 13:01:29 2022 +0000 nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S50 ADATA XPG GAMMIX S50 drives report bogus eui64 values that appear to be the same across drives in one system. Quirk them out so they are not marked as "non globally unique" duplicates. Signed-off-by: Stefan Reiter Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 4641a8e6e145f595059e695f0f8dbbe608134086 Author: Keith Busch Date: Mon Jun 6 09:53:17 2022 -0700 nvme-pci: add trouble shooting steps for timeouts Many users have encountered IO timeouts with a CSTS value of 0xffffffff, which indicates a failure to read the register. While there are various potential causes for this observation, faulty NVMe APST has been the culprit quite frequently. Add the recommended troubleshooting steps in the error output when this condition occurs. Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 2f0dad1719cbbd690e916a42d937b7605ee63964 Author: Keith Busch Date: Tue Jun 7 08:30:29 2022 -0700 nvme: add bug report info for global duplicate id The recent global id check is finding poorly implemented devices in the wild. Include relavant device information in the output to help quicken an appropriate quirk patch. Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 1fc766b5c08417248e0008bca14c3572ac0f1c26 Author: Thomas Weißschuh Date: Tue Jun 7 17:55:55 2022 +0200 nvme: add device name to warning in uuid_show() This provides more context to users. Old message: [ 00.000000] No UUID available providing old NGUID New message: [ 00.000000] block nvme0n1: No UUID available providing old NGUID Fixes: d934f9848a77 ("nvme: provide UUID value to userspace") Signed-off-by: Thomas Weißschuh Signed-off-by: Christoph Hellwig commit 1dfbe9fcda4afc957f0e371e207ae3cb7e8f3b0e Author: Matthew Wilcox (Oracle) Date: Sun Jun 12 22:32:27 2022 +0100 usercopy: Make usercopy resilient against ridiculously large copies If 'n' is so large that it's negative, we might wrap around and mistakenly think that the copy is OK when it's not. Such a copy would probably crash, but just doing the arithmetic in a more simple way lets us detect and refuse this case. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Tested-by: Zorro Lang Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220612213227.3881769-4-willy@infradead.org commit 35fb9ae4aa2e838b234323e6f7cf6336ff019e5a Author: Matthew Wilcox (Oracle) Date: Sun Jun 12 22:32:26 2022 +0100 usercopy: Cast pointer to an integer once Get rid of a lot of annoying casts by setting 'addr' once at the top of the function. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Tested-by: Zorro Lang Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220612213227.3881769-3-willy@infradead.org commit 993d0b287e2ef7bee2e8b13b0ce4d2b5066f278e Author: Matthew Wilcox (Oracle) Date: Sun Jun 12 22:32:25 2022 +0100 usercopy: Handle vm_map_ram() areas vmalloc does not allocate a vm_struct for vm_map_ram() areas. That causes us to deny usercopies from those areas. This affects XFS which uses vm_map_ram() for its directories. Fix this by calling find_vmap_area() instead of find_vm_area(). Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Tested-by: Zorro Lang Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220612213227.3881769-2-willy@infradead.org commit 57cd6d157eb479f0a8e820fd36b7240845c8a937 Author: Sami Tolvanen Date: Tue May 31 10:59:10 2022 -0700 cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle RCU_NONIDLE usage during __cfi_slowpath_diag can result in an invalid RCU state in the cpuidle code path: WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcu_eqs_enter+0xe4/0x138 ... Call trace: rcu_eqs_enter+0xe4/0x138 rcu_idle_enter+0xa8/0x100 cpuidle_enter_state+0x154/0x3a8 cpuidle_enter+0x3c/0x58 do_idle.llvm.6590768638138871020+0x1f4/0x2ec cpu_startup_entry+0x28/0x2c secondary_start_kernel+0x1b8/0x220 __secondary_switched+0x94/0x98 Instead, call rcu_irq_enter/exit to wake up RCU only when needed and disable interrupts for the entire CFI shadow/module check when we do. Signed-off-by: Sami Tolvanen Link: https://lore.kernel.org/r/20220531175910.890307-1-samitolvanen@google.com Fixes: cf68fffb66d6 ("add support for Clang CFI") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit a01a40e334996b05df92d5a9d594cb5937dd3cc0 Author: Sander Vanheule Date: Sun Jun 12 13:23:09 2022 +0200 gpio: realtek-otto: Make the irqchip immutable Since commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") a warning is issued for the realtek-otto driver: gpio gpiochip0: (18003500.gpio): not an immutable chip, please consider fixing it! Make the driver's irqchip immutable to fix this. Signed-off-by: Sander Vanheule Signed-off-by: Bartosz Golaszewski commit 30756cc1645080445c957192bc8a7af3b193d617 Author: Tom Schwindl Date: Sun Jun 12 19:01:09 2022 +0000 docs: driver-api: gpio: Fix filename mismatch The filenames were changed a while ago, but board.rst, consumer.rst and intro.rst still refer to the old names. Fix those references to match the Actual names and avoid possible confusion. Signed-off-by: Tom Schwindl Signed-off-by: Bartosz Golaszewski commit 97a4087a363888b818225d890c912a52a24b9f73 Author: Lukas Bulwahn Date: Mon Jun 13 13:11:34 2022 +0200 MAINTAINERS: add include/dt-bindings/gpio to GPIO SUBSYSTEM Maintainers of the directory Documentation/devicetree/bindings/gpio are also the maintainers of the corresponding directory include/dt-bindings/gpio. Add the file entry for include/dt-bindings/gpio to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Signed-off-by: Bartosz Golaszewski commit fe6900bd8156467365bd5b976df64928fdebfeb0 Author: Kailang Yang Date: Mon Jun 13 14:57:19 2022 +0800 ALSA: hda/realtek - ALC897 headset MIC no sound There is not have Headset Mic verb table in BIOS default. So, it will have recording issue from headset MIC. Add the verb table value without jack detect. It will turn on Headset Mic. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/719133a27d8844a890002cb817001dfa@realtek.com Signed-off-by: Takashi Iwai commit eeaa345e128515135ccb864c04482180c08e3259 Author: Jann Horn Date: Wed Jun 8 20:22:05 2022 +0200 mm/slub: add missing TID updates on slab deactivation The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race the right way, this could lead to an object getting lost; or, in an even more unlikely situation, it could even lead to an object being freed onto the wrong slab's freelist, messing up the `inuse` counter and eventually causing a page to be freed to the page allocator while it still contains slab objects. (I haven't actually tested these cases though, this is just based on looking at the code. Writing testcases for this stuff seems like it'd be a pain...) The race leading to state inconsistency is (all operations on the same CPU and kmem_cache): - task A: begin do_slab_free(): - read TID - read pcpu freelist (==NULL) - check `slab == c->slab` (true) - [PREEMPT A->B] - task B: begin slab_alloc_node(): - fastpath fails (`c->freelist` is NULL) - enter __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - take local_lock_irqsave() - read c->freelist as NULL - get_freelist() returns NULL - write `c->slab = NULL` - drop local_unlock_irqrestore() - goto new_slab - slub_percpu_partial() is NULL - get_partial() returns NULL - slub_put_cpu_ptr() (enables preemption) - [PREEMPT B->A] - task A: finish do_slab_free(): - this_cpu_cmpxchg_double() succeeds() - [CORRUPT STATE: c->slab==NULL, c->freelist!=NULL] From there, the object on c->freelist will get lost if task B is allowed to continue from here: It will proceed to the retry_load_slab label, set c->slab, then jump to load_freelist, which clobbers c->freelist. But if we instead continue as follows, we get worse corruption: - task A: run __slab_free() on object from other struct slab: - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial) - task A: run slab_alloc_node() with NUMA node constraint: - fastpath fails (c->slab is NULL) - call __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - c->slab is NULL: goto new_slab - slub_percpu_partial() is non-NULL - set c->slab to slub_percpu_partial(c) - [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects from slab-2] - goto redo - node_match() fails - goto deactivate_slab - existing c->freelist is passed into deactivate_slab() - inuse count of slab-1 is decremented to account for object from slab-2 At this point, the inuse count of slab-1 is 1 lower than it should be. This means that if we free all allocated objects in slab-1 except for one, SLUB will think that slab-1 is completely unused, and may free its page, leading to use-after-free. Fixes: c17dda40a6a4e ("slub: Separate out kmem_cache_cpu processing from deactivate_slab") Fixes: 03e404af26dc2 ("slub: fast release on full slab") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Acked-by: Christoph Lameter Acked-by: David Rientjes Reviewed-by: Muchun Song Tested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Vlastimil Babka Link: https://lore.kernel.org/r/20220608182205.2945720-1-jannh@google.com commit c4cf6785599b8126ea29160800fec5f1db0a6a30 Author: Sebastian Andrzej Siewior Date: Tue Jun 7 17:20:10 2022 +0200 mm/slub: Move the stackdepot related allocation out of IRQ-off section. The set_track() invocation in free_debug_processing() is invoked with acquired slab_lock(). The lock disables interrupts on PREEMPT_RT and this forbids to allocate memory which is done in stack_depot_save(). Split set_track() into two parts: set_track_prepare() which allocate memory and set_track_update() which only performs the assignment of the trace data structure. Use set_track_prepare() before disabling interrupts. [ vbabka@suse.cz: make set_track() call set_track_update() instead of open-coded assignments ] Fixes: 5cf909c553e9e ("mm/slub: use stackdepot to save stack trace in objects") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Vlastimil Babka Link: https://lore.kernel.org/r/Yp9sqoUi4fVa5ExF@linutronix.de commit 27071b5cbca59d8e8f8750c199a6cbf8c9799963 Author: Serge Semin Date: Fri Jun 10 10:42:33 2022 +0300 i2c: designware: Use standard optional ref clock implementation Even though the DW I2C controller reference clock source is requested by the method devm_clk_get() with non-optional clock requirement the way the clock handler is used afterwards has a pure optional clock semantic (though in some circumstances we can get a warning about the clock missing printed in the system console). There is no point in reimplementing that functionality seeing the kernel clock framework already supports the optional interface from scratch. Thus let's convert the platform driver to using it. Note by providing this commit we get to fix two problems. The first one was introduced in commit c62ebb3d5f0d ("i2c: designware: Add support for an interface clock"). It causes not having the interface clock (pclk) enabled/disabled in case if the reference clock isn't provided. The second problem was first introduced in commit b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided"). Since that modification the deferred probe procedure has been unsupported in case if the interface clock isn't ready. Fixes: c62ebb3d5f0d ("i2c: designware: Add support for an interface clock") Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided") Signed-off-by: Serge Semin Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 5edc99f0c5b753eb34defad1cdb164824056a487 Author: Wolfram Sang Date: Mon Jun 13 16:45:19 2022 +0200 MAINTAINERS: core DT include belongs to core Signed-off-by: Wolfram Sang commit 6e21408774da49b34fbe258d161e6329a43fcbe8 Author: Lukas Bulwahn Date: Mon Jun 13 13:46:14 2022 +0200 MAINTAINERS: add include/dt-bindings/i2c to I2C SUBSYSTEM HOST DRIVERS Maintainers of the directory Documentation/devicetree/bindings/i2c are also the maintainers of the corresponding directory include/dt-bindings/i2c. Add the file entry for include/dt-bindings/i2c to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Signed-off-by: Wolfram Sang commit feaf625e7055cdfd2c3d82cf60fb3892e27ea7bb Merge: f9437ac0f851c fc9375e3f763b Author: Jens Axboe Date: Mon Jun 13 06:52:52 2022 -0600 Merge branch 'io_uring/io_uring-5.19' of https://github.com/isilence/linux into io_uring-5.19 Pull io_uring fixes from Pavel. * 'io_uring/io_uring-5.19' of https://github.com/isilence/linux: io_uring: fix double unlock for pbuf select io_uring: kbuf: fix bug of not consuming ring buffer in partial io case io_uring: openclose: fix bug of closing wrong fixed file io_uring: fix not locked access to fixed buf table io_uring: fix races with buffer table unregister io_uring: fix races with file table unregister commit 619c010a65391d06bc96e79fa0e7725790e5d1a9 Author: Suman Ghosh Date: Sun Jun 12 23:15:36 2022 +0530 octeontx2-vf: Add support for adaptive interrupt coalescing Fixes: 6e144b47f560 (octeontx2-pf: Add support for adaptive interrupt coalescing) Added support for VF interfaces as well. Signed-off-by: Suman Ghosh Signed-off-by: David S. Miller commit 5f7b84151a89f6f3a8d1db4db2bc4f5b270d66ee Author: David S. Miller Date: Mon Jun 13 12:49:21 2022 +0100 xilinx: Fix build on x86. CONFIG_64BIT is not sufficient for checking for availability of iowrite64() and friends. Also, the out_addr helpers need to be inline. Fixes: b690f8df6497 ("net: axienet: Use iowrite64 to write all 64b descriptor pointers") Signed-off-by: David S. Miller commit a7ffce959cca257ea5a6d3ee9bfa2d7fb12bb9fa Merge: a5b00f5b78b7a b690f8df6497b Author: David S. Miller Date: Mon Jun 13 12:36:56 2022 +0100 Merge branch 'axienet-fixes' Andy Chiu says: ==================== net: axienet: fix DMA Tx error We ran into multiple DMA TX errors while writing files over a network block device running on top of a DMA-connected AXI Ethernet device on 64-bit RISC-V machines. The errors indicated that the DMA had fetched a null descriptor and we found that the reason for this is that AXI DMA had unexpectedly processed a partially updated tail descriptor pointer. To fix it, we suggest that the driver should use one 64-bit write instead of two 32-bit writes to perform such update if possible. For those archectures where double-word load/stores are unavailable, e.g. 32-bit archectures, force a driver probe failure if the driver finds 64-bit capability on DMA. ==================== Signed-off-by: David S. Miller commit b690f8df6497b654c2c871871e0a598e9750c0eb Author: Andy Chiu Date: Mon Jun 13 11:42:02 2022 +0800 net: axienet: Use iowrite64 to write all 64b descriptor pointers According to commit f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability") and AXI-DMA spec (pg021), on 64-bit capable dma, only writing MSB part of tail descriptor pointer causes DMA engine to start fetching descriptors. However, we found that it is true only if dma is in idle state. In other words, dma would use a tailp even if it only has LSB updated, when the dma is running. The non-atomicity of this behavior could be problematic if enough delay were introduced in between the 2 writes. For example, if an interrupt comes right after the LSB write and the cpu spends long enough time in the handler for the dma to get back into idle state by completing descriptors, then the seconcd write to MSB would treat dma to start fetching descriptors again. Since the descriptor next to the one pointed by current tail pointer is not filled by the kernel yet, fetching a null descriptor here causes a dma internal error and halt the dma engine down. We suggest that the dma engine should start process a 64-bit MMIO write to the descriptor pointer only if ONE 32-bit part of it is written on all states. Or we should restrict the use of 64-bit addressable dma on 32-bit platforms, since those devices have no instruction to guarantee the write to LSB and MSB part of tail pointer occurs atomically to the dma. initial condition: curp = x-3; tailp = x-2; LSB = x; MSB = 0; cpu: |dma: iowrite32(LSB, tailp) | completes #(x-3) desc, curp = x-3 ... | tailp updated => irq | completes #(x-2) desc, curp = x-2 ... | completes #(x-1) desc, curp = x-1 ... | ... ... | completes #x desc, curp = tailp = x <= irqreturn | reaches tailp == curp = x, idle iowrite32(MSB, tailp + 4) | ... | tailp updated, starts fetching... | fetches #(x + 1) desc, sees cntrl = 0 | post Tx error, halt Signed-off-by: Andy Chiu Reported-by: Max Hsu Reviewed-by: Greentime Hu Signed-off-by: David S. Miller commit 00be43a74ca262267ceb96c0c5e3f51d3a56342e Author: Andy Chiu Date: Mon Jun 13 11:42:01 2022 +0800 net: axienet: make the 64b addresable DMA depends on 64b archectures Currently it is not safe to config the IP as 64-bit addressable on 32-bit archectures, which cannot perform a double-word store on its descriptor pointers. The pointer is 64-bit wide if the IP is configured as 64-bit, and the device would process the partially updated pointer on some states if the pointer was updated via two store-words. To prevent such condition, we force a probe fail if we discover that the IP has 64-bit capability but it is not running on a 64-Bit kernel. This is a series of patch (1/2). The next patch must be applied in order to make 64b DMA safe on 64b archectures. Signed-off-by: Andy Chiu Reported-by: Max Hsu Reviewed-by: Greentime Hu Signed-off-by: David S. Miller commit f9437ac0f851cea2374d53594f52fbbefdd977bd Author: Dylan Yudaken Date: Mon Jun 13 03:11:57 2022 -0700 io_uring: limit size of provided buffer ring The type of head and tail do not allow more than 2^15 entries in a provided buffer ring, so do not allow this. At 2^16 while each entry can be indexed, there is no way to disambiguate full vs empty. Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220613101157.3687-4-dylany@fb.com Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit c6e9fa5c0ab811f4bec36a96337f4b1bb77d142c Author: Dylan Yudaken Date: Mon Jun 13 03:11:56 2022 -0700 io_uring: fix types in provided buffer ring The type of head needs to match that of tail in order for rollover and comparisons to work correctly. Without this change the comparison of tail to head might incorrectly allow io_uring to use a buffer that userspace had not given it. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220613101157.3687-3-dylany@fb.com Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit 97da4a537924d87e2261773f3ac9365abb191fc9 Author: Dylan Yudaken Date: Mon Jun 13 03:11:55 2022 -0700 io_uring: fix index calculation When indexing into a provided buffer ring, do not subtract 1 from the index. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220613101157.3687-2-dylany@fb.com Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit a5b00f5b78b7adb9f6f37381da2a54db6d37cd11 Merge: 6f0e1efc880ae 12a3670887725 Author: David S. Miller Date: Mon Jun 13 11:56:01 2022 +0100 Merge branch 'hns3-fixres' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 12a3670887725df364cc3e030cf3bede6f13b364 Author: Guangbin Huang Date: Sat Jun 11 20:25:29 2022 +0800 net: hns3: fix tm port shapping of fibre port is incorrect after driver initialization Currently in driver initialization process, driver will set shapping parameters of tm port to default speed read from firmware. However, the speed of SFP module may not be default speed, so shapping parameters of tm port may be incorrect. To fix this problem, driver sets new shapping parameters for tm port after getting exact speed of SFP module in this case. Fixes: 88d10bd6f730 ("net: hns3: add support for multiple media type") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 71b215f36dca1a3d5d1c576b2099e6d7ea03047e Author: Jie Wang Date: Sat Jun 11 20:25:28 2022 +0800 net: hns3: fix PF rss size initialization bug Currently hns3 driver misuses the VF rss size to initialize the PF rss size in hclge_tm_vport_tc_info_update. So this patch fix it by checking the vport id before initialization. Fixes: 7347255ea389 ("net: hns3: refactor PF rss get APIs with new common rss get APIs") Signed-off-by: Jie Wang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e93530ae0e5d8fcf2d908933d206e0c93bc3c09b Author: Guangbin Huang Date: Sat Jun 11 20:25:27 2022 +0800 net: hns3: restore tm priority/qset to default settings when tc disabled Currently, settings parameters of schedule mode, dwrr, shaper of tm priority or qset of one tc are only be set when tc is enabled, they are not restored to the default settings when tc is disabled. It confuses users when they cat tm_priority or tm_qset files of debugfs. So this patch fixes it. Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit cfd80687a5388e731b3db65ad6a557ede9b45905 Author: Jie Wang Date: Sat Jun 11 20:25:26 2022 +0800 net: hns3: modify the ring param print info Currently tx push is also a ring param. So the original ring param print info in hns3_is_ringparam_changed should be adjusted. Fixes: 07fdc163ac88 ("net: hns3: refactor hns3_set_ringparam()") Signed-off-by: Jie Wang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 283847e3ef6dbf79bf67083b5ce7b8033e8b6f34 Author: Jian Shen Date: Sat Jun 11 20:25:25 2022 +0800 net: hns3: don't push link state to VF if unalive It's unnecessary to push link state to unalive VF, and the VF will query link state from PF when it being start works. Fixes: 18b6e31f8bf4 ("net: hns3: PF add support for pushing link status to VFs") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 9eda7d8bcbdb6909f202edeedff51948f1cad1e5 Author: Guangbin Huang Date: Sat Jun 11 20:25:24 2022 +0800 net: hns3: set port base vlan tbl_sta to false before removing old vlan When modify port base vlan, the port base vlan tbl_sta needs to set to false before removing old vlan, to indicate this operation is not finish. Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 2636e008112465ca54559ac4898da5a2515e118a Author: Jani Nikula Date: Wed May 11 12:46:19 2022 +0300 drm/i915/uc: remove accidental static from a local variable The arrays are static const, but the pointer shouldn't be static. Fixes: 3d832f370d16 ("drm/i915/uc: Allow platforms to have GuC but not HuC") Cc: John Harrison Cc: Lucas De Marchi Cc: Daniele Ceraolo Spurio Signed-off-by: Jani Nikula Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20220511094619.27889-1-jani.nikula@intel.com (cherry picked from commit 5821a0bbb4c39960975d29d6b58ae290088db0ed) commit fc9375e3f763b06c3c90c5f5b2b84d3e07c1f4c2 Author: Pavel Begunkov Date: Sun Jun 12 14:31:38 2022 +0100 io_uring: fix double unlock for pbuf select io_buffer_select(), which is the only caller of io_ring_buffer_select(), fully handles locking, mutex unlock in io_ring_buffer_select() will lead to double unlock. Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Pavel Begunkov commit 42db0c00e275877eb92480beaa16b33507dc3bda Author: Hao Xu Date: Sat Jun 11 20:29:52 2022 +0800 io_uring: kbuf: fix bug of not consuming ring buffer in partial io case When we use ring-mapped provided buffer, we should consume it before arm poll if partial io has been done. Otherwise the buffer may be used by other requests and thus we lost the data. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Hao Xu [pavel: 5.19 rebase] Signed-off-by: Pavel Begunkov commit e71d7c56dd69f720169c1675f87a1d22d8167767 Author: Hao Xu Date: Sat Jun 11 20:22:20 2022 +0800 io_uring: openclose: fix bug of closing wrong fixed file Don't update ret until fixed file is closed, otherwise the file slot becomes the error code. Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots") Signed-off-by: Hao Xu [pavel: 5.19 rebase] Signed-off-by: Pavel Begunkov commit 842d9346b2fdda4d2fb8ccb5b87faef1ac01ab51 Author: Nirmoy Das Date: Wed May 25 11:59:55 2022 +0200 drm/i915: Individualize fences before adding to dma_resv obj _i915_vma_move_to_active() can receive > 1 fences for multiple batch buffers submission. Because dma_resv_add_fence() can only accept one fence at a time, change _i915_vma_move_to_active() to be aware of multiple fences so that it can add individual fences to the dma resv object. v6: fix multi-line comment. v5: remove double fence reservation for batch VMAs. v4: Reserve fences for composite_fence on multi-batch contexts and also reserve fence slots to composite_fence for each VMAs. v3: dma_resv_reserve_fences is not cumulative so pass num_fences. v2: make sure to reserve enough fence slots before adding. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5614 Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Cc: # v5.16+ Signed-off-by: Nirmoy Das Reviewed-by: Matthew Auld Reviewed-by: Andrzej Hajda Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220525095955.15371-1-nirmoy.das@intel.com (cherry picked from commit 420a07b841d03f6a436d8c06571c69aa5c783897) Signed-off-by: Jani Nikula commit 6e3f3c239ee547c5b55a85f467c92a6ba7eee83a Author: Ashutosh Dixit Date: Wed May 25 06:19:20 2022 -0700 drm/i915/gt: Fix memory leaks in per-gt sysfs All kmalloc'd kobjects need a kobject_put() to free memory. For example in previous code, kobj_gt_release() never gets called. The requirement of kobject_put() now results in a slightly different code organization. v2: s/gtn/gt/ (Andi) Fixes: b770bcfae9ad ("drm/i915/gt: create per-tile sysfs interface") Signed-off-by: Ashutosh Dixit Reviewed-by: Andi Shyti Acked-by: Andrzej Hajda Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/a6f6686517c85fba61a0c45097f5bb4fe7e257fb.1653484574.git.ashutosh.dixit@intel.com (cherry picked from commit 69d6bf5c3754ffc491896632438417d1cedc2c68) Signed-off-by: Jani Nikula commit c9b576d0c7bf55aeae1a736da7974fa202c4394d Author: Alan Previn Date: Thu Mar 10 16:43:11 2022 -0800 drm/i915/reset: Fix error_state_read ptr + offset use Fix our pointer offset usage in error_state_read when there is no i915_gpu_coredump but buf offset is non-zero. This fixes a kernel page fault can happen when multiple tests are running concurrently in a loop and one is producing engine resets and consuming the i915 error_state dump while the other is forcing full GT resets. (takes a while to trigger). The dmesg call trace: [ 5590.803000] BUG: unable to handle page fault for address: ffffffffa0b0e000 [ 5590.803009] #PF: supervisor read access in kernel mode [ 5590.803013] #PF: error_code(0x0000) - not-present page [ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067 PTE 0 [ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U 5.17.0-rc5-ups69-guc-err-capt-rev6+ #136 [ 5590.803033] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00. 3031.A02.2201171222 01/17/2022 [ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 [ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282 [ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00 RCX: 0000000000000f8f [ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000 RDI: ffff888107ee9071 [ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000019 [ 5590.803073] R13: 0000000000174fff R14: 0000000000001000 R15: ffff888107ee9000 [ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000) knlGS:0000000000000000 [ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004 CR4: 0000000000770ee0 [ 5590.803089] PKRU: 55555554 [ 5590.803091] Call Trace: [ 5590.803093] [ 5590.803096] error_state_read+0xa1/0xd0 [i915] [ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0 [ 5590.803180] new_sync_read+0x116/0x1a0 [ 5590.803185] vfs_read+0x114/0x1b0 [ 5590.803189] ksys_read+0x63/0xe0 [ 5590.803193] do_syscall_64+0x38/0xc0 [ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 5590.803201] RIP: 0033:0x7f62aaea5912 [ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f62aaea5912 [ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f RDI: 0000000000000006 [ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010 R09: 0000000000101000 [ 5590.803229] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000006 [ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010 R15: 0000000000200000 [ 5590.803238] [ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops prime_numbers nfnetlink br_netfilter overlay mei_pxp mei_hdcp x86_pkg_temp_thermal coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep snd_hda_core snd_pcm mei_me mei fuse ip_tables x_tables crct10dif_pclmul e1000e crc32_pclmul ptp i2c_i801 ghash_clmulni_intel i2c_smbus pps_core [last unloa ded: ttm] [ 5590.803277] CR2: ffffffffa0b0e000 [ 5590.803280] ---[ end trace 0000000000000000 ]--- Fixes: 0e39037b3165 ("drm/i915: Cache the error string") Signed-off-by: Alan Previn Reviewed-by: John Harrison Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220311004311.514198-2-alan.previn.teres.alexis@intel.com (cherry picked from commit 3304033a1e69cd81a2044b4422f0d7e593afb4e6) Signed-off-by: Jani Nikula commit 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 Author: Pavel Begunkov Date: Thu Jun 9 08:34:35 2022 +0100 io_uring: fix not locked access to fixed buf table We can look inside the fixed buffer table only while holding ->uring_lock, however in some cases we don't do the right async prep for IORING_OP_{WRITE,READ}_FIXED ending up with NULL req->imu forcing making an io-wq worker to try to resolve the fixed buffer without proper locking. Move req->imu setup into early req init paths, i.e. io_prep_rw(), which is called unconditionally for rw requests and under uring_lock. Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support") Signed-off-by: Pavel Begunkov commit d11d31fc5d8a96f707facee0babdcffaafa38de2 Author: Pavel Begunkov Date: Mon Jun 13 06:30:06 2022 +0100 io_uring: fix races with buffer table unregister Fixed buffer table quiesce might unlock ->uring_lock, potentially letting new requests to be submitted, don't allow those requests to use the table as they will race with unregistration. Reported-and-tested-by: van fantasy Fixes: bd54b6fe3316ec ("io_uring: implement fixed buffers registration similar to fixed files") Signed-off-by: Pavel Begunkov commit b0380bf6dad4601d92025841e2b7a135d566c6e3 Author: Pavel Begunkov Date: Mon Jun 13 06:32:44 2022 +0100 io_uring: fix races with file table unregister Fixed file table quiesce might unlock ->uring_lock, potentially letting new requests to be submitted, don't allow those requests to use the table as they will race with unregistration. Reported-and-tested-by: van fantasy Fixes: 05f3fb3c53975 ("io_uring: avoid ring quiesce for fixed file set unregister and update") Signed-off-by: Pavel Begunkov commit 4051a81774d6d8e28192742c26999d6f29bc0e68 Author: Sebastian Andrzej Siewior Date: Tue May 17 11:16:14 2022 +0200 locking/lockdep: Use sched_clock() for random numbers Since the rewrote of prandom_u32(), in the commit mentioned below, the function uses sleeping locks which extracing random numbers and filling the batch. This breaks lockdep on PREEMPT_RT because lock_pin_lock() disables interrupts while calling __lock_pin_lock(). This can't be moved earlier because the main user of the function (rq_pin_lock()) invokes that function after disabling interrupts in order to acquire the lock. The cookie does not require random numbers as its goal is to provide a random value in order to notice unexpected "unlock + lock" sites. Use sched_clock() to provide random numbers. Fixes: a0103f4d86f88 ("random32: use real rng for non-deterministic randomness") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/YoNn3pTkm5+QzE5k@linutronix.de commit 04193d590b390ec7a0592630f46d559ec6564ba1 Author: Peter Zijlstra Date: Tue Jun 7 22:41:55 2022 +0200 sched: Fix balance_push() vs __sched_setscheduler() The purpose of balance_push() is to act as a filter on task selection in the case of CPU hotplug, specifically when taking the CPU out. It does this by (ab)using the balance callback infrastructure, with the express purpose of keeping all the unlikely/odd cases in a single place. In order to serve its purpose, the balance_push_callback needs to be (exclusively) on the callback list at all times (noting that the callback always places itself back on the list the moment it runs, also noting that when the CPU goes down, regular balancing concerns are moot, so ignoring them is fine). And here-in lies the problem, __sched_setscheduler()'s use of splice_balance_callbacks() takes the callbacks off the list across a lock-break, making it possible for, an interleaving, __schedule() to see an empty list and not get filtered. Fixes: ae7927023243 ("sched: Optimize finish_lock_switch()") Reported-by: Jing-Ting Wu Signed-off-by: Peter Zijlstra (Intel) Tested-by: Jing-Ting Wu Link: https://lkml.kernel.org/r/20220519134706.GH2578@worktop.programming.kicks-ass.net commit e32683c6f7d22ba624e0bfc58b02cf3348bdca63 Author: Josh Poimboeuf Date: Thu Jun 9 00:17:32 2022 -0700 x86/mm: Fix RESERVE_BRK() for older binutils With binutils 2.26, RESERVE_BRK() causes a build failure: /tmp/ccnGOKZ5.s: Assembler messages: /tmp/ccnGOKZ5.s:98: Error: missing ')' /tmp/ccnGOKZ5.s:98: Error: missing ')' /tmp/ccnGOKZ5.s:98: Error: missing ')' /tmp/ccnGOKZ5.s:98: Error: junk at end of line, first unrecognized character is `U' The problem is this line: RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE) Specifically, the INIT_PGT_BUF_SIZE macro which (via PAGE_SIZE's use _AC()) has a "1UL", which makes older versions of the assembler unhappy. Unfortunately the _AC() macro doesn't work for inline asm. Inline asm was only needed here to convince the toolchain to add the STT_NOBITS flag. However, if a C variable is placed in a section whose name is prefixed with ".bss", GCC and Clang automatically set STT_NOBITS. In fact, ".bss..page_aligned" already relies on this trick. So fix the build failure (and simplify the macro) by allocating the variable in C. Also, add NOLOAD to the ".brk" output section clause in the linker script. This is a failsafe in case the ".bss" prefix magic trick ever stops working somehow. If there's a section type mismatch, the GNU linker will force the ".brk" output section to be STT_NOBITS. The LLVM linker will fail with a "section type mismatch" error. Note this also changes the name of the variable from .brk.##name to __brk_##name. The variable names aren't actually used anywhere, so it's harmless. Fixes: a1e2c031ec39 ("x86/mm: Simplify RESERVE_BRK()") Reported-by: Joe Damato Reported-by: Byungchul Park Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Tested-by: Joe Damato Link: https://lore.kernel.org/r/22d07a44c80d8e8e1e82b9a806ddc8c6bbb2606e.1654759036.git.jpoimboe@kernel.org commit 6872fcac7158c3b3728a2ec1ea771ade0e61ddd5 Merge: f2906aa863381 6fac824f40987 Author: Thomas Gleixner Date: Mon Jun 13 09:10:49 2022 +0200 Merge tag 'irqchip-fixes-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip/genirq fixes from Marc Zyngier: - Invoke runtime PM for chained interrupts, aligning the behaviour with that of 'normal' interrupts - A flurry of of_node refcounting fixes - A fix for the recently merged loongarch that broke UP MIPS - A configuration fix for the Xilinx interrupt controller - Yet another new compat string for the Uniphier interrupt controller Link: https://lore.kernel.org/lkml/20220610083628.1205136-1-maz@kernel.org commit 3ddbe35d9a2ebd4924d458e0246b4ba6c13bb456 Author: Daniil Dementev Date: Fri Jun 10 19:57:32 2022 +0300 ALSA: usb-audio: US16x08: Move overflow check before array access Buffer overflow could occur in the loop "while", due to accessing an array element before checking the index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Daniil Dementev Reviewed-by: Alexey Khoroshilov Link: https://lore.kernel.org/r/20220610165732.2904-1-d.dementev@ispras.ru Signed-off-by: Takashi Iwai commit b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3 Author: Linus Torvalds Date: Sun Jun 12 16:11:37 2022 -0700 Linux 5.19-rc2 commit 44dbdf3bb3f44bf08897ed5f22eb262edcf3d926 Author: Ludvig Pärsson Date: Fri Jun 10 16:00:55 2022 +0200 firmware: arm_scmi: Fix incorrect error propagation in scmi_voltage_descriptors_get scmi_voltage_descriptors_get() will incorrecly return an error code if the last iteration of the for loop that retrieves the descriptors is skipped due to an error. Skipping an iteration in the loop is not an error, but the `ret` value from the last iteration will be propagated when the function returns. Fix by not saving return values that should not be propagated. This solution also minimizes the risk of future patches accidentally re-introducing this bug. Link: https://lore.kernel.org/r/20220610140055.31491-1-ludvig.parsson@axis.com Reviewed-by: Cristian Marussi Signed-off-by: Ludvig Pärsson [sudeep.holla: Removed unneeded reset_rx_to_maxsz and check for return value from scmi_voltage_levels_get as suggested by Cristian] Signed-off-by: Sudeep Holla commit 5e757deddd918edb8cb2fdb56eb79656ffc6dade Author: Conor Dooley Date: Fri Jun 3 09:38:26 2022 +0100 riscv: dts: microchip: re-add pdma to mpfs device tree PolarFire SoC /does/ have a SiFive pdma, despite what I suggested as a conflict resolution to Zong. Somehow the entry fell through the cracks between versions of my dt patches, so re-add it with Zong's updated compatible & dma-channels property. Fixes: c5094f371008 ("riscv: dts: microchip: refactor icicle kit device tree") Signed-off-by: Conor Dooley commit 997952851843935024962b51fc36c61b3c2d1ed4 Merge: b0cb8db39636f d4fe9cc4ff865 Author: Linus Torvalds Date: Sun Jun 12 11:33:42 2022 -0700 Merge tag 'platform-drivers-x86-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Highlights: - Fix hp-wmi regression on HP Omen laptops introduced in 5.18 - Several hardware-id additions - A couple of other tiny fixes" * tag 'platform-drivers-x86-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel: hid: Add Surface Go to VGBS allow list platform/x86: hp-wmi: Use zero insize parameter only when supported platform/x86: hp-wmi: Resolve WMI query failures on some devices platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support platform/x86: barco-p50-gpio: Add check for platform_driver_register platform/x86/intel: pmc: Support Intel Raptorlake P platform/x86/intel: Fix pmt_crashlog array reference platform/mellanox: Add static in struct declaration. platform/mellanox: Spelling s/platfom/platform/ commit b0cb8db39636f7d79caadf98a90e9367b4d9aabc Merge: e3b8e2de19e18 8bee9dd953b69 Author: Linus Torvalds Date: Sun Jun 12 11:16:00 2022 -0700 Merge tag 'wq-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: "Tetsuo's patch to trigger build warnings if system-wide wq's are flushed along with a TP type update and trivial comment update" * tag 'wq-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Switch to new kerneldoc syntax for named variable macro argument workqueue: Fix type of cpu in trace event workqueue: Wrap flush_workqueue() using a macro commit e3b8e2de19e18e4297c0dd747d56ecdc4ff96928 Merge: 2275c6babfa53 1f7a6cf6b07c7 Author: Linus Torvalds Date: Sun Jun 12 11:10:07 2022 -0700 Merge tag 'kbuild-fixes-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Make the *.mod build rule portable for POSIX awk - Fix regression of 'make nsdeps' - Make scripts/check-local-export working for older bash versions - Fix scripts/gdb to extract the .config data from vmlinux * tag 'kbuild-fixes-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: scripts/gdb: change kernel config dumping method scripts/check-local-export: avoid 'wait $!' for process substitution scripts/nsdeps: adjust to the format change of *.mod files kbuild: avoid regex RS for POSIX awk commit 2275c6babfa53278c90b7915441c61392dd687cc Merge: 3cae0d84756ae 4c14d7043fede Author: Linus Torvalds Date: Sun Jun 12 11:05:44 2022 -0700 Merge tag '5.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Three reconnect fixes, all for stable as well. One of these three reconnect fixes does address a problem with multichannel reconnect, but this does not include the additional fix (still being tested) for dynamically detecting multichannel adapter changes which will improve those reconnect scenarios even more" * tag '5.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: populate empty hostnames for extra channels cifs: return errors during session setup during reconnects cifs: fix reconnect on smb3 mount types commit 3cae0d84756aea1c563f0cf9f668cf13e281e8a5 Merge: 7a68065eb9cd1 17b0128a136d4 Author: Linus Torvalds Date: Sun Jun 12 10:33:38 2022 -0700 Merge tag 'random-5.19-rc2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - A fix for a 5.19 regression for a case in which early device tree initializes the RNG, which flips a static branch. On most plaforms, jump labels aren't initialized until much later, so this caused splats. On a few mailing list threads, we cooked up easy fixes for arm64, arm32, and risc-v. But then things looked slightly more involved for xtensa, powerpc, arc, and mips. And at that point, when we're patching 7 architectures in a place before the console is even available, it seems like the cost/risk just wasn't worth it. So random.c works around it now by checking the already exported `static_key_initialized` boolean, as though somebody already ran into this issue in the past. I'm not super jazzed about that; it'd be prettier to not have to complicate downstream code. But I suppose it's practical. - A few small code nits and adding a missing __init annotation. - A change to the default config values to use the cpu and bootloader's seeds for initializing the RNG earlier. This brings them into line with what all the distros do (Fedora/RHEL, Debian, Ubuntu, Gentoo, Arch, NixOS, Alpine, SUSE, and Void... at least), and moreover will now give us test coverage in various test beds that might have caught the above device tree bug earlier. - A change to WireGuard CI's configuration to increase test coverage around the RNG. - A documentation comment fix to unrelated maintainerless CRC code that I was asked to take, I guess because it has to do with polynomials (which the RNG thankfully no longer uses). * tag 'random-5.19-rc2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: wireguard: selftests: use maximum cpu features and allow rng seeding random: remove rng_has_arch_random() random: credit cpu and bootloader seeds by default random: do not use jump labels before they are initialized random: account for arch randomness in bits random: mark bootloader randomness code as __init random: avoid checking crng_ready() twice in random_init() crc-itu-t: fix typo in CRC ITU-T polynomial comment commit d4fe9cc4ff8656704b58cfd9363d7c3c9d65e519 Author: Duke Lee Date: Tue Jun 7 14:36:54 2022 -0700 platform/x86/intel: hid: Add Surface Go to VGBS allow list The Surface Go reports Chassis Type 9 (Laptop,) so the device needs to be added to dmi_vgbs_allow_list to enable tablet mode when an attached Type Cover is folded back. BugLink: https://github.com/linux-surface/linux-surface/issues/837 Signed-off-by: Duke Lee Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220607213654.5567-1-krnhotwings@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 65f936f3535950d2643eac5bf34a735a0e428cdd Author: Bedant Patnaik Date: Thu Jun 9 00:58:43 2022 +0530 platform/x86: hp-wmi: Use zero insize parameter only when supported commit be9d73e64957 ("platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls") and commit 12b19f14a21a ("platform/x86: hp-wmi: Fix hp_wmi_read_int() reporting error (0x05)") cause ACPI BIOS Error (bug): Attempt to CreateField of length zero (20211217/dsopcode-133) because of the ACPI method HWMC, which unconditionally creates a Field of size (insize*8) bits: CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN) In cases where args->insize = 0, the Field size is 0, resulting in an error. Fix this by using zero insize only if 0x5 error code is returned Tested on Omen 15 AMD (2020) board ID: 8786. Fixes: be9d73e64957 ("platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls") Signed-off-by: Bedant Patnaik Tested-by: Jorge Lopez Link: https://lore.kernel.org/r/41be46743d21c78741232a47bbb5f1cdbcc3d21e.camel@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit dc6a6ab58379f25bf991d8e4a13b001ed806e881 Author: Jorge Lopez Date: Wed Jun 8 16:29:23 2022 -0500 platform/x86: hp-wmi: Resolve WMI query failures on some devices WMI queries fail on some devices where the ACPI method HWMC unconditionally attempts to create Fields beyond the buffer if the buffer is too small, this breaks essential features such as power profiles: CreateByteField (Arg1, 0x10, D008) CreateByteField (Arg1, 0x11, D009) CreateByteField (Arg1, 0x12, D010) CreateDWordField (Arg1, 0x10, D032) CreateField (Arg1, 0x80, 0x0400, D128) In cases where args->data had zero length, ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Field [D008] at bit offset/length 128/8 exceeds size of target Buffer (128 bits) (20211217/dsopcode-198) was obtained. ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Field [D009] at bit offset/length 136/8 exceeds size of target Buffer (136bits) (20211217/dsopcode-198) The original code created a buffer size of 128 bytes regardless if the WMI call required a smaller buffer or not. This particular behavior occurs in older BIOS and reproduced in OMEN laptops. Newer BIOS handles buffer sizes properly and meets the latest specification requirements. This is the reason why testing with a dynamically allocated buffer did not uncover any failures with the test systems at hand. This patch was tested on several OMEN, Elite, and Zbooks. It was confirmed the patch resolves HPWMI_FAN GET/SET calls in an OMEN Laptop 15-ek0xxx. No problems were reported when testing on several Elite and Zbooks notebooks. Fixes: 4b4967cbd268 ("platform/x86: hp-wmi: Changing bios_args.data to be dynamically allocated") Signed-off-by: Jorge Lopez Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220608212923.8585-2-jorge.lopez2@hp.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit abfed87e2a12bd246047d78c01d81eb9529f1d06 Author: Jason A. Donenfeld Date: Sat May 28 12:24:29 2022 +0200 crypto: memneq - move into lib/ This is used by code that doesn't need CONFIG_CRYPTO, so move this into lib/ with a Kconfig option so that it can be selected by whatever needs it. This fixes a linker error Zheng pointed out when CRYPTO_MANAGER_DISABLE_TESTS!=y and CRYPTO=m: lib/crypto/curve25519-selftest.o: In function `curve25519_selftest': curve25519-selftest.c:(.init.text+0x60): undefined reference to `__crypto_memneq' curve25519-selftest.c:(.init.text+0xec): undefined reference to `__crypto_memneq' curve25519-selftest.c:(.init.text+0x114): undefined reference to `__crypto_memneq' curve25519-selftest.c:(.init.text+0x154): undefined reference to `__crypto_memneq' Reported-by: Zheng Bin Cc: Eric Biggers Cc: stable@vger.kernel.org Fixes: aa127963f1ca ("crypto: lib/curve25519 - re-add selftests") Signed-off-by: Jason A. Donenfeld Reviewed-by: Eric Biggers Signed-off-by: Herbert Xu commit 8bee9dd953b69c634d1c9a3241a8b357469ad4aa Author: Jonathan Neuschäfer Date: Fri Jun 10 01:41:10 2022 +0200 workqueue: Switch to new kerneldoc syntax for named variable macro argument The syntax without dots is available since commit 43756e347f21 ("scripts/kernel-doc: Add support for named variable macro arguments"). The same HTML output is produced with and without this patch. Signed-off-by: Jonathan Neuschäfer Acked-by: Tejun Heo Signed-off-by: Tejun Heo commit 7a68065eb9cd194cf03f135c9211eeb2d5c4c0a0 Merge: cecb3540b89ef 77006f6edc0e0 Author: Linus Torvalds Date: Sat Jun 11 16:56:41 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "A set of fixes. Most address the new warning we emit at build time when irq chips are not immutable with some additional tweaks to gpio-crystalcove from Andy and a small tweak to gpio-dwapd. - make irq_chip structs immutable in several Diolan and intel drivers to get rid of the new warning we emit when fiddling with irq chips - don't print error messages on probe deferral in gpio-dwapb" * tag 'gpio-fixes-for-v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: dwapb: Don't print error on -EPROBE_DEFER gpio: dln2: make irq_chip immutable gpio: sch: make irq_chip immutable gpio: merrifield: make irq_chip immutable gpio: wcove: make irq_chip immutable gpio: crystalcove: Join function declarations and long lines gpio: crystalcove: Use specific type and API for IRQ number gpio: crystalcove: make irq_chip immutable commit cecb3540b89ef2b586d07c1bd69408e251791b76 Merge: abe71eb32f305 ec1e8adcbdf66 Author: Linus Torvalds Date: Sat Jun 11 16:50:39 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver fixes and and one core patch. Nine of the driver patches are minor fixes and reworks to lpfc and the rest are trivial and minor fixes elsewhere" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pmcraid: Fix missing resource cleanup in error case scsi: ipr: Fix missing/incorrect resource cleanup in error case scsi: mpt3sas: Fix out-of-bounds compiler warning scsi: lpfc: Update lpfc version to 14.2.0.4 scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion scsi: lpfc: Add more logging of cmd and cqe information for aborted NVMe cmds scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted scsi: lpfc: Address NULL pointer dereference after starget_to_rport() scsi: lpfc: Resolve some cleanup issues following SLI path refactoring scsi: lpfc: Resolve some cleanup issues following abort path refactoring scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event() scsi: vmw_pvscsi: Expand vcpuHint to 16 bits scsi: sd: Fix interpretation of VPD B9h length commit abe71eb32f3051f461d2975c674c0857549d0b93 Merge: 0678afa6055d1 eacea844594ff Author: Linus Torvalds Date: Sat Jun 11 16:32:47 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Fixes all over the place, most notably fixes for latent bugs in drivers that got exposed by suppressing interrupts before DRIVER_OK, which in turn has been done by 8b4ec69d7e09 ("virtio: harden vring IRQ")" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: um: virt-pci: set device ready in probe() vdpa: make get_vq_group and set_group_asid optional virtio: Fix all occurences of the "the the" typo vduse: Fix NULL pointer dereference on sysfs access vringh: Fix loop descriptors check in the indirect cases vdpa/mlx5: clean up indenting in handle_ctrl_vlan() vdpa/mlx5: fix error code for deleting vlan virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed vdpa/mlx5: Fix syntax errors in comments virtio-rng: make device ready before making request commit 0678afa6055d14799c1dc1eee47c8025eba56cab Merge: 1c27f1fc1549f 5c95fe8b02011 Author: Linus Torvalds Date: Sat Jun 11 12:37:39 2022 -0700 Merge tag 'loongarch-fixes-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen. "Fix build errors and a stale comment" * tag 'loongarch-fixes-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Remove MIPS comment about cycle counter LoongArch: Fix copy_thread() build errors LoongArch: Fix the !CONFIG_SMP build commit 1c27f1fc1549f0e470429f5497a76ad28a37f21a Author: Linus Torvalds Date: Sat Jun 11 10:30:20 2022 -0700 iov_iter: fix build issue due to possible type mis-match Commit 6c77676645ad ("iov_iter: Fix iter_xarray_get_pages{,_alloc}()") introduced a problem on some 32-bit architectures (at least arm, xtensa, csky,sparc and mips), that have a 'size_t' that is 'unsigned int'. The reason is that we now do min(nr * PAGE_SIZE - offset, maxsize); where 'nr' and 'offset' and both 'unsigned int', and PAGE_SIZE is 'unsigned long'. As a result, the normal C type rules means that the first argument to 'min()' ends up being 'unsigned long'. In contrast, 'maxsize' is of type 'size_t'. Now, 'size_t' and 'unsigned long' are always the same physical type in the kernel, so you'd think this doesn't matter, and from an actual arithmetic standpoint it doesn't. But on 32-bit architectures 'size_t' is commonly 'unsigned int', even if it could also be 'unsigned long'. In that situation, both are unsigned 32-bit types, but they are not the *same* type. And as a result 'min()' will complain about the distinct types (ignore the "pointer types" part of the error message: that's an artifact of the way we have made 'min()' check types for being the same): lib/iov_iter.c: In function 'iter_xarray_get_pages': include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast [-Werror] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ lib/iov_iter.c:1464:16: note: in expansion of macro 'min' 1464 | return min(nr * PAGE_SIZE - offset, maxsize); | ^~~ This was not visible on 64-bit architectures (where we always define 'size_t' to be 'unsigned long'). Force these cases to use 'min_t(size_t, x, y)' to make the type explicit and avoid the issue. [ Nit-picky note: technically 'size_t' doesn't have to match 'unsigned long' arithmetically. We've certainly historically seen environments with 16-bit address spaces and 32-bit 'unsigned long'. Similarly, even in 64-bit modern environments, 'size_t' could be its own type distinct from 'unsigned long', even if it were arithmetically identical. So the above type commentary is only really descriptive of the kernel environment, not some kind of universal truth for the kinds of wild and crazy situations that are allowed by the C standard ] Reported-by: Sudip Mukherjee Link: https://lore.kernel.org/all/YqRyL2sIqQNDfky2@debian/ Cc: Jeff Layton Cc: David Howells Cc: Al Viro Signed-off-by: Linus Torvalds commit 06ee1c0aebd5dfdf6bf237165b22415f64f38b7c Author: Christophe JAILLET Date: Sat Jun 11 10:32:44 2022 +0200 ksmbd: smbd: Remove useless license text when SPDX-License-Identifier is already used An SPDX-License-Identifier is already in place. There is no need to duplicate part of the corresponding license. Signed-off-by: Christophe JAILLET Acked-by: Namjae Jeon Signed-off-by: Steve French commit fe0fde09e1cb83effcf8fafa372533f438d93a1a Author: Namjae Jeon Date: Thu Jun 2 10:07:38 2022 +0900 ksmbd: use SOCK_NONBLOCK type for kernel_accept() I found that normally it is O_NONBLOCK but there are different value for some arch. /include/linux/net.h: #ifndef SOCK_NONBLOCK #define SOCK_NONBLOCK O_NONBLOCK #endif /arch/alpha/include/asm/socket.h: #define SOCK_NONBLOCK 0x40000000 Use SOCK_NONBLOCK instead of O_NONBLOCK for kernel_accept(). Suggested-by: David Howells Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 2d56af33d4df94d2b76446ffc3e3654c42232f4b Author: Brian Norris Date: Tue Jun 7 14:15:36 2022 -0700 arm64: dts: rockchip: Assign RK3399 VDU clock rate Before commit 9998943f6dfc ("media: rkvdec: Stop overclocking the decoder"), the rkvdec driver was forcing the VDU clock rate. After that commit, we rely on the default clock rate. That rate works OK on many boards, with the default PLL settings (CPLL is 800MHz, VDU dividers leave it at 400MHz); but some boards change PLL settings. Assign the expected default clock rate explicitly, so that the rate is consistent, regardless of PLL configuration. This was particularly broken on RK3399 Gru Scarlet systems, where the rk3399-gru-scarlet.dtsi assigns PLL_CPLL to 1.6 GHz, and so the VDU clock ends up at 800 MHz (twice the expected rate), and causes video artifacts and other issues. Note: I assign the clock rate in the clock controller instead of the vdec node, because there are multiple nodes that use this clock, and per the clock.yaml specification: Configuring a clock's parent and rate through the device node that consumes the clock can be done only for clocks that have a single user. Specifying conflicting parent or rate configuration in multiple consumer nodes for a shared clock is forbidden. Configuration of common clocks, which affect multiple consumer devices can be similarly specified in the clock provider node. Fixes: 9998943f6dfc ("media: rkvdec: Stop overclocking the decoder") Cc: Signed-off-by: Brian Norris Reviewed-by: Nicolas Dufresne Link: https://lore.kernel.org/r/20220607141535.1.Idafe043ffc94756a69426ec68872db0645c5d6e2@changeid Signed-off-by: Heiko Stuebner commit 2881a4ab319918e775ec9c084da3d6cc15ad77ab Author: Peter Geis Date: Fri Jun 10 09:25:42 2022 -0400 arm64: dts: rockchip: Fix Quartz64-A dwc3 otg port behavior The otg_id line on the Quartz64 Model A is not connected to anything. This prevents automatic selection of the dual role usb port. In otg mode it defaults to device mode. Force it to host mode to retain previous behavior. Fixes: bc405bb3eeee ("arm64: dts: rockchip: enable otg/drd operation of usb_host0_xhci in rk356x") Signed-off-by: Peter Geis Link: https://lore.kernel.org/r/20220610132542.159978-1-pgwipeout@gmail.com Signed-off-by: Heiko Stuebner commit 17b0128a136d43e5f8f268631f48bc267373ebff Author: Jason A. Donenfeld Date: Fri Jun 10 16:32:02 2022 +0200 wireguard: selftests: use maximum cpu features and allow rng seeding By forcing the maximum CPU that QEMU has available, we expose additional capabilities, such as the RNDR instruction, which increases test coverage. This then allows the CI to skip the fake seeding step in some cases. Also enable STRICT_KERNEL_RWX to catch issues related to early jump labels when the RNG is initialized at boot. Signed-off-by: Jason A. Donenfeld commit 1f7a6cf6b07c74a17343c2559cd5f5018a245961 Author: Kuan-Ying Lee Date: Fri Jun 10 15:14:57 2022 +0800 scripts/gdb: change kernel config dumping method MAGIC_START("IKCFG_ST") and MAGIC_END("IKCFG_ED") are moved out from the kernel_config_data variable. Thus, we parse kernel_config_data directly instead of considering offset of MAGIC_START and MAGIC_END. Fixes: 13610aa908dc ("kernel/configs: use .incbin directive to embed config_data.gz") Signed-off-by: Kuan-Ying Lee Signed-off-by: Masahiro Yamada commit 6f0e1efc880ae979df45aa85e3336aac5e58d97a Merge: 145684d9f9d36 249eddaf651fd Author: Jakub Kicinski Date: Fri Jun 10 22:18:22 2022 -0700 Merge branch 'documentation-add-description-for-a-couple-of-sctp-sysctl-options' Xin Long says: ==================== Documentation: add description for a couple of sctp sysctl options These are a couple of sysctl options I recently added, but missed adding documents for them. Especially for net.sctp.intl_enable, it's hard for users to setup stream interleaving, as it also needs to call some socket options. This patchset is to add documents for them. ==================== Link: https://lore.kernel.org/r/cover.1654787716.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 249eddaf651fda7cb32e9ebae4c6d5904b390d81 Author: Xin Long Date: Thu Jun 9 11:17:15 2022 -0400 Documentation: add description for net.sctp.ecn_enable Describe it in networking/ip-sysctl.rst like other SCTP options. Fixes: 2f5268a9249b ("sctp: allow users to set netns ecn flag with sysctl") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit e65775fdd389e4f47eb1972ef6372e20c6c2cc05 Author: Xin Long Date: Thu Jun 9 11:17:14 2022 -0400 Documentation: add description for net.sctp.intl_enable Describe it in networking/ip-sysctl.rst like other SCTP options. We need to document this especially as when using the feature of User Message Interleaving, some socket options also needs to be set. Fixes: 463118c34a35 ("sctp: support sysctl to allow users to use stream interleave") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit c349ae5f831cb9817a45e4e36705d2f7d47c7bc3 Author: Xin Long Date: Thu Jun 9 11:17:13 2022 -0400 Documentation: add description for net.sctp.reconf_enable Describe it in networking/ip-sysctl.rst like other SCTP options. Fixes: c0d8bab6ae51 ("sctp: add get and set sockopt for reconf_enable") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 145684d9f9d363dce08b1f02cb2ccf9ecb8b2851 Merge: aa3398fb4b3f6 645603844270b Author: Jakub Kicinski Date: Fri Jun 10 22:10:30 2022 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-06-09 Grzegorz prevents addition of TC flower filters to TC0 and fixes queue iteration for VF ADQ to number of actual queues for i40e. Aleksandr prevents running of ethtool tests when device is being reset for i40e. Michal resolves an issue where iavf does not report its MAC address properly. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: Fix issue with MAC address of VF shown as zero i40e: Fix call trace in setup_tx_descriptors i40e: Fix calculating the number of queue pairs i40e: Fix adding ADQ filter to TC0 ==================== Link: https://lore.kernel.org/r/20220609162620.2619258-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit eacea844594ff338db06437806707313210d4865 Author: Vincent Whitchurch Date: Fri Jun 10 17:12:03 2022 +0200 um: virt-pci: set device ready in probe() Call virtio_device_ready() to make this driver work after commit b4ec69d7e09 ("virtio: harden vring IRQ"), since the driver uses the virtqueues in the probe function. (The virtio core sets the device ready when probe returns.) Fixes: 8b4ec69d7e09 ("virtio: harden vring IRQ") Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Vincent Whitchurch Message-Id: <20220610151203.3492541-1-vincent.whitchurch@axis.com> Signed-off-by: Michael S. Tsirkin Tested-by: Johannes Berg commit 0885eacdc81f920c3e0554d5615e69a66504a28d Merge: 90add6d418d02 da9e94fe000e1 Author: Linus Torvalds Date: Fri Jun 10 17:28:43 2022 -0700 Merge tag 'nfsd-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Notable changes: - There is now a backup maintainer for NFSD Notable fixes: - Prevent array overruns in svc_rdma_build_writes() - Prevent buffer overruns when encoding NFSv3 READDIR results - Fix a potential UAF in nfsd_file_put()" * tag 'nfsd-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Remove pointer type casts from xdr_get_next_encode_buffer() SUNRPC: Clean up xdr_get_next_encode_buffer() SUNRPC: Clean up xdr_commit_encode() SUNRPC: Optimize xdr_reserve_space() SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() SUNRPC: Trap RDMA segment overflows NFSD: Fix potential use-after-free in nfsd_file_put() MAINTAINERS: reciprocal co-maintainership for file locking and nfsd commit 4c14d7043fede258957d7b01da0cad2d9fe3a205 Author: Shyam Prasad N Date: Mon Jun 6 09:52:46 2022 +0000 cifs: populate empty hostnames for extra channels Currently, the secondary channels of a multichannel session also get hostname populated based on the info in primary channel. However, this will end up with a wrong resolution of hostname to IP address during reconnect. This change fixes this by not populating hostname info for all secondary channels. Fixes: 5112d80c162f ("cifs: populate server_hostname for extra channels") Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 90add6d418d02991380595bdbc307e05410af638 Merge: 045fb9c2f5f42 dddf305640547 Author: Linus Torvalds Date: Fri Jun 10 16:32:49 2022 -0700 Merge tag 'for-5.19/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM core's bioset initialization so that blk integrity pool is properly setup. Remove now unused bioset_init_from_src. - Fix DM zoned hang from locking imbalance due to needless check in clone_endio(). * tag 'for-5.19/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: fix zoned locking imbalance due to needless check in clone_endio block: remove bioset_init_from_src dm: fix bio_set allocation commit 045fb9c2f5f42ea922053e9c7bfc4d882fade436 Merge: b09891598557a 40a8110120230 Author: Linus Torvalds Date: Fri Jun 10 16:15:19 2022 -0700 Merge branch 'fscache-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache cleanups from David Howells: - fix checker complaint in afs - two netfs cleanups: - netfs_inode calling convention cleanup plus the requisite documentation changes - replace the ->cleanup op with a ->free_request op. This is possible as the I/O request is now always available at the cleanup point as the stuff to be cleaned up is no longer passed into the API functions, but rather obtained by ->init_request. * 'fscache-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: netfs: Rename the netfs_io_request cleanup op and give it an op pointer netfs: Further cleanups after struct netfs_inode wrapper introduced afs: Fix some checker issues commit b09891598557a0ef408d9a7605e72ed3c67c8c15 Merge: a32e7ea362356 6c77676645ad4 Author: Linus Torvalds Date: Fri Jun 10 15:53:09 2022 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull iov_iter fix from Al Viro: "ITER_XARRAY get_pages fix; now the return value is a lot saner (and more similar to logics for other flavours)" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: iov_iter: Fix iter_xarray_get_pages{,_alloc}() commit c6bc7e8ee90845556a90faf8b043cbefd77b8903 Author: August Wikerfors Date: Wed Jun 8 23:20:28 2022 +0200 platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF Tested and works on my system. Signed-off-by: August Wikerfors Link: https://lore.kernel.org/r/20220608212028.28307-1-git@augustwikerfors.se Signed-off-by: Hans de Goede commit 8a041afe3e774bedd3e0a9b96f65e48a1299a595 Author: Piotr Chmura Date: Mon Jun 6 19:15:13 2022 +0200 platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support Add dmi_system_id of Gigabyte Z690M AORUS ELITE AX DDR4 board. Tested on my PC. Signed-off-by: Piotr Chmura Link: https://lore.kernel.org/r/bd83567e-ebf5-0b31-074b-5f6dc7f7c147@gmail.com Signed-off-by: Hans de Goede commit 011881b80ebe773914b59905bce0f5e0ef93e7ba Author: Jiasheng Jiang Date: Thu May 26 17:03:45 2022 +0800 platform/x86: barco-p50-gpio: Add check for platform_driver_register As platform_driver_register() could fail, it should be better to deal with the return value in order to maintain the code consisitency. Fixes: 86af1d02d458 ("platform/x86: Support for EC-connected GPIOs for identify LED/button on Barco P50 board") Signed-off-by: Jiasheng Jiang Acked-by: Peter Korsgaard Link: https://lore.kernel.org/r/20220526090345.1444172-1-jiasheng@iscas.ac.cn Signed-off-by: Hans de Goede commit 552f3b801de6eb062b225a76e140995483a0609c Author: George D Sworo Date: Wed Jun 1 18:26:17 2022 -0700 platform/x86/intel: pmc: Support Intel Raptorlake P Add Raptorlake P to the list of the platforms that intel_pmc_core driver supports for pmc_core device. Raptorlake P PCH is based on Alderlake P PCH. Signed-off-by: George D Sworo Reviewed-by: David E. Box Link: https://lore.kernel.org/r/20220602012617.20100-1-george.d.sworo@intel.com Signed-off-by: Hans de Goede commit 66cb3a2d7ad0d0e9af4d3430a4f2a32ffb9ac098 Author: David Arcari Date: Thu May 26 16:31:40 2022 -0400 platform/x86/intel: Fix pmt_crashlog array reference The probe function pmt_crashlog_probe() may incorrectly reference the 'priv->entry array' as it uses 'i' to reference the array instead of 'priv->num_entries' as it should. This is similar to the problem that was addressed in pmt_telemetry_probe via commit 2cdfa0c20d58 ("platform/x86/intel: Fix 'rmmod pmt_telemetry' panic"). Cc: "David E. Box" Cc: Hans de Goede Cc: Mark Gross Cc: linux-kernel@vger.kernel.org Signed-off-by: David Arcari Reviewed-by: David E. Box Link: https://lore.kernel.org/r/20220526203140.339120-1-darcari@redhat.com Signed-off-by: Hans de Goede commit b9c29f391f4195a778620f3d2efd0d9746a414fe Author: Michael Shych Date: Thu Jun 2 17:51:03 2022 +0300 platform/mellanox: Add static in struct declaration. Fix problem of missing static in struct declaration. Fixes: 662f24826f954 ("platform/mellanox: Add support for new SN2201 system") Reported-by: kernel test robot Signed-off-by: Michael Shych Link: https://lore.kernel.org/r/20220602145103.11859-1-michaelsh@nvidia.com Signed-off-by: Hans de Goede commit 6c77676645ad42993e0a8bdb8dafa517851a352a Author: David Howells Date: Thu Jun 9 09:07:01 2022 +0100 iov_iter: Fix iter_xarray_get_pages{,_alloc}() The maths at the end of iter_xarray_get_pages() to calculate the actual size doesn't work under some circumstances, such as when it's been asked to extract a partial single page. Various terms of the equation cancel out and you end up with actual == offset. The same issue exists in iter_xarray_get_pages_alloc(). Fix these to just use min() to select the lesser amount from between the amount of page content transcribed into the buffer, minus the offset, and the size limit specified. This doesn't appear to have caused a problem yet upstream because network filesystems aren't getting the pages from an xarray iterator, but rather passing it directly to the socket, which just iterates over it. Cachefiles *does* do DIO from one to/from ext4/xfs/btrfs/etc. but it always asks for whole pages to be written or read. Fixes: 7ff5062079ef ("iov_iter: Add ITER_XARRAY") Reported-by: Jeff Layton Signed-off-by: David Howells cc: Alexander Viro cc: Dominique Martinet cc: Mike Marshall cc: Gao Xiang cc: linux-afs@lists.infradead.org cc: v9fs-developer@lists.sourceforge.net cc: devel@lists.orangefs.org cc: linux-erofs@lists.ozlabs.org cc: linux-cachefs@redhat.com cc: linux-fsdevel@vger.kernel.org Signed-off-by: Al Viro commit 40a81101202300df7db273f77dda9fbe6271b1d2 Author: David Howells Date: Fri Feb 25 11:19:14 2022 +0000 netfs: Rename the netfs_io_request cleanup op and give it an op pointer The netfs_io_request cleanup op is now always in a position to be given a pointer to a netfs_io_request struct, so this can be passed in instead of the mapping and private data arguments (both of which are included in the struct). So rename the ->cleanup op to ->free_request (to match ->init_request) and pass in the I/O pointer. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com commit e81fb4198e27925b151aad1450e0fd607d6733f8 Author: Linus Torvalds Date: Thu Jun 9 15:04:01 2022 -0700 netfs: Further cleanups after struct netfs_inode wrapper introduced Change the signature of netfs helper functions to take a struct netfs_inode pointer rather than a struct inode pointer where appropriate, thereby relieving the need for the network filesystem to convert its internal inode format down to the VFS inode only for netfslib to bounce it back up. For type safety, it's better not to do that (and it's less typing too). Give netfs_write_begin() an extra argument to pass in a pointer to the netfs_inode struct rather than deriving it internally from the file pointer. Note that the ->write_begin() and ->write_end() ops are intended to be replaced in the future by netfslib code that manages this without the need to call in twice for each page. netfs_readpage() and similar are intended to be pointed at directly by the address_space_operations table, so must stick to the signature dictated by the function pointers there. Changes ======= - Updated the kerneldoc comments and documentation [DH]. Signed-off-by: David Howells cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/CAHk-=wgkwKyNmNdKpQkqZ6DnmUL-x9hp0YBnUGjaPFEAdxDTbw@mail.gmail.com/ commit 102d841055be8e6e4e24d58917ffc04958262c4d Author: David Howells Date: Thu May 19 08:40:12 2022 +0100 afs: Fix some checker issues Remove an unused global variable and make another static as reported by make C=1. Signed-off-by: David Howells cc: linux-afs@lists.infradead.org commit a32e7ea362356af8e89e67600432bad83d2325da Merge: aa3398fb4b3f6 334f6f53abcf5 Author: Linus Torvalds Date: Fri Jun 10 12:41:48 2022 -0700 Merge tag 'folio-5.19a' of git://git.infradead.org/users/willy/pagecache Pull folio fixes from Matthew Wilcox: "Four folio-related fixes: - Don't release a folio while it's still locked - Fix a use-after-free after dropping the mmap_lock - Fix a memory leak when splitting a page - Fix a kernel-doc warning for struct folio" * tag 'folio-5.19a' of git://git.infradead.org/users/willy/pagecache: mm: Add kernel-doc for folio->mlock_count mm/huge_memory: Fix xarray node memory leak filemap: Cache the value of vm_flags filemap: Don't release a locked folio commit dddf30564054796696bcd4c462b232a5beacf72c Author: Mike Snitzer Date: Fri Jun 10 15:07:48 2022 -0400 dm: fix zoned locking imbalance due to needless check in clone_endio After the commit ca522482e3ea ("dm: pass NULL bdev to bio_alloc_clone"), clone_endio() only calls dm_zone_endio() when DM targets remap the clone bio's bdev to something other than the md->disk->part0 default. However, if a DM target (e.g. dm-crypt) stacked ontop of a dm-zoned does not remap the clone bio using bio_set_dev() then dm_zone_endio() is not called at completion of the bios and zone locks are not properly unlocked. This triggers a hang, in dm_zone_map_bio(), when blktests block/004 is run for dm-crypt on zoned block devices. To avoid the hang, simply remove the clone_endio() check that verifies the target remapped the clone bio to a device other than the default. Fixes: ca522482e3ea ("dm: pass NULL bdev to bio_alloc_clone") Reported-by: Shin'ichiro Kawasaki Signed-off-by: Mike Snitzer commit a4c934d74e408cb5ea5209b5fdf6184e3e250b1b Author: Geert Uytterhoeven Date: Tue May 24 09:15:44 2022 +0200 platform/mellanox: Spelling s/platfom/platform/ Fix a misspelling of the word "platform". Signed-off-by: Geert Uytterhoeven Acked-by: Michael Shych Link: https://lore.kernel.org/r/9c8edde31e271311b7832d7677fe84aba917da8d.1653376503.git.geert@linux-m68k.org Signed-off-by: Hans de Goede commit aa3398fb4b3f67d89688976098ad93721b6d7852 Merge: 1bc27dec7ea5a 0b9431c8221cf Author: Linus Torvalds Date: Fri Jun 10 11:57:36 2022 -0700 Merge tag 'devicetree-fixes-for-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull more devicetree fixes from Rob Herring: - More DT meta-schema check fixes from new bindings in merge window - Fix stale DT binding references from Mauro - Update various binding maintainers - Fix in arm,malidp properties to match reality - Add deprecated 'atheros' vendor prefix * tag 'devicetree-fixes-for-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: display: arm,malidp: remove bogus RQOS property dt-bindings: pinctrl: ralink: Fix 'enum' lists with duplicate entries dt-bindings: Drop more redundant 'maxItems/minItems' in if/then schemas dt-bindings: nvme: apple,nvme-ans: Drop 'maxItems' from 'apple,sart' MAINTAINERS: rectify entries for ARM DRM DRIVERS after dt conversion MAINTAINERS: update snps,axs10x-reset.yaml reference MAINTAINERS: update dongwoon,dw9807-vcm.yaml reference MAINTAINERS: update cortina,gemini-ethernet.yaml reference dt-bindings: mfd: rk808: update rockchip,rk808.yaml reference dt-bindings: reset: update st,stih407-powerdown.yaml references dt-bindings: arm: update vexpress-config.yaml references dt-bindings: interrupt-controller: update brcm,l2-intc.yaml reference dt-bindings: mfd: bd9571mwv: update rohm,bd9571mwv.yaml reference dt-bindings: update Luca Ceresoli's e-mail address dt-bindings: msm: update maintainers list with proper id dt-bindings: vendor-prefixes: document deprecated Atheros dt-bindings: Update QCOM USB subsystem maintainer information commit 1bc27dec7ea5ac01f126734b723acc5f3cbe5713 Merge: d56fd98612aef 67e59f8d019fb Author: Linus Torvalds Date: Fri Jun 10 11:49:27 2022 -0700 Merge tag 'pm-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an intel_idle issue introduced during the 5.16 development cycle and two recent regressions in the system reboot/poweroff code. Specifics: - Fix CPUIDLE_FLAG_IRQ_ENABLE handling in intel_idle (Peter Zijlstra) - Allow all platforms to use the global poweroff handler and make non-syscall poweroff code paths work again (Dmitry Osipenko)" * tag 'pm-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE kernel/reboot: Fix powering off using a non-syscall code paths kernel/reboot: Use static handler for register_platform_power_off() commit d56fd98612aef73f85ec0c44e86fe04a9d3325ee Author: David Howells Date: Fri Jun 10 19:35:55 2022 +0100 certs: Convert spaces in certs/Makefile to a tab There's a rule in certs/Makefile for which the command begins with eight spaces. This results in: ../certs/Makefile:21: FORCE prerequisite is missing ../certs/Makefile:21: *** missing separator. Stop. Fix this by turning the spaces into a tab. Fixes: addf466389d9 ("certs: Check that builtin blacklist hashes are valid") Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen Reviewed-by: Mickaël Salaün cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/486b1b80-9932-aab6-138d-434c541c934a@digikod.net/ # v1 Signed-off-by: Linus Torvalds commit 0b9431c8221cfe73d06f6b9cd37b813fa52be8ce Author: Andre Przywara Date: Thu Jun 9 17:27:29 2022 +0100 dt-bindings: display: arm,malidp: remove bogus RQOS property As Liviu pointed out, the arm,malidp-arqos-high-level property mentioned in the original .txt binding was a mistake, and arm,malidp-arqos-value needs to take its place. The binding commit ce6eb0253cba ("dt/bindings: display: Add optional property node define for Mali DP500") mentions the right name in the commit message, but has the wrong name in the diff. Commit d298e6a27a81 ("drm/arm/mali-dp: Add display QoS interface configuration for Mali DP500") uses the property in the driver, but uses the shorter name. Remove the wrong property from the binding, and use the proper name in the example. The actual property was already documented properly. Fixes: 2c8b082a3ab1 ("dt-bindings: display: convert Arm Mali-DP to DT schema") Link: https://lore.kernel.org/linux-arm-kernel/YnumGEilUblhBx8E@e110455-lin.cambridge.arm.com/ Signed-off-by: Andre Przywara Reported-by: Liviu Dudau Reviewed-by: Liviu Dudau Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220609162729.1441760-1-andre.przywara@arm.com commit 67e59f8d019fb097f35c82533cc9b27bb392e5b1 Merge: 32d4fd5751ead 2b8c612c6102f Author: Rafael J. Wysocki Date: Fri Jun 10 20:24:10 2022 +0200 Merge branch 'pm-sysoff' Merge fixes for regressions introduced by the recent rework of the system reboot/poweroff code. * pm-sysoff: kernel/reboot: Fix powering off using a non-syscall code paths kernel/reboot: Use static handler for register_platform_power_off() commit 01aa6cbf3dafadd955d6e55eaa001861e8d356ab Author: Rob Herring Date: Mon Jun 6 16:22:39 2022 -0500 dt-bindings: pinctrl: ralink: Fix 'enum' lists with duplicate entries There's no reason to list the same value twice in an 'enum'. This was fixed treewide in commit c3b006819426 ("dt-bindings: Fix 'enum' lists with duplicate entries"), but this one got added in the merge window. A meta-schema change will catch future cases. Signed-off-by: Rob Herring Acked-by: Sergio Paracuellos Link: https://lore.kernel.org/r/20220606212239.1360877-1-robh@kernel.org commit fe43c0188911885a70d0dd405f89ca4f1300e7db Merge: 36a2366379719 387c67afccbb2 Author: Linus Torvalds Date: Fri Jun 10 11:14:47 2022 -0700 Merge tag 'docs-5.19-3' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A few documentation fixes for 5.19, including moving the new HTE docs to a more suitable location, adding loongarch to the features lists, and a couple of typo fixes" * tag 'docs-5.19-3' of git://git.lwn.net/linux: docs: arm: tcm: Fix typo in description of TCM and MMU usage docs: Move the HTE documentation to driver-api/ docs: usb: fix literal block marker in usbmon verification example Documentation/features: Update the arch support status files commit 36a236637971923c85dae45cb8638eb47ae62954 Merge: ad6e0764988a3 78cdaf3f4257a Author: Linus Torvalds Date: Fri Jun 10 11:03:51 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - SME save/restore for EFI fix - incorrect logic for detecting the need for saving/restoring the FFR state. - SME fix for a CPU ID field value. - Sysreg generation awk script fix (comparison operator). - Some typos in documentation or comments and silence a sparse warning (missing prototype). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Add kasan_hw_tags_enable() prototype to silence sparse arm64/sme: Fix EFI save/restore arm64/fpsimd: Fix typo in comment arm64/sysreg: Fix typo in Enum element regex arm64/sme: Fix SVE/SME typo in ABI documentation arm64/sme: Fix tests for 0b1111 value ID registers commit ad6e0764988a388a25323337c8d559fe14b2e6b2 Merge: f7a1d00e749f1 c1c1204c0d0c1 Author: Linus Torvalds Date: Fri Jun 10 10:56:28 2022 -0700 Merge tag 'zonefs-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fixes from Damien Le Moal: - Fix handling of the explicit-open mount option, and in particular the conditions under which this option can be ignored. - Fix a problem with zonefs iomap_begin method, causing a hang in iomap_readahead() when a readahead request reaches the end of a file. * tag 'zonefs-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: fix zonefs_iomap_begin() for reads zonefs: Do not ignore explicit_open with active zone limit zonefs: fix handling of explicit_open option on mount commit f7a1d00e749f1357b48c1e50abf605819c1e8404 Merge: 8f7ac50c97d30 481f7017c37a8 Author: Linus Torvalds Date: Fri Jun 10 10:30:43 2022 -0700 Merge tag 'ata-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fixes from Damien Le Moal: "Several small fixes for rc2: - Remove unused field in struct ata_port (Hannes) - Fix a potential (very unlikely) NULL pointer dereference in ata_host_alloc_pinfo() (Sergey) - Fix a device reference leak in the pata_octeon_cf driver (Miaoqian) - Fixes for handling access to the concurrent positioning ranges log page used with multi-actuator HDDs (Tyler) - Fix the values shown by the pio_mode and dma_mode sysfs device attributes (Sergey) - Update the MAINTAINERS file to add libata sysfs ABI documentation file (Sergey)" * tag 'ata-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: MAINTAINERS: add ATA sysfs file documentation to libata entry ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files libata: fix translation of concurrent positioning ranges libata: fix reading concurrent positioning ranges log ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() ata: libata: drop 'sas_last_tag' commit 8f7ac50c97d30ae5ae48da3b516510d05a67b9e5 Merge: 8dd77d44795d7 5f3d696eea916 Author: Linus Torvalds Date: Fri Jun 10 10:20:57 2022 -0700 Merge tag 'sound-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of fixes; almost all changes are device-specific small fixes over ASoC, HD-audio and USB-audio. No sign of serious breakage, so far" * tag 'sound-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits) ALSA: hda/realtek: Add quirk for HP Dev One ALSA: hda/realtek - Add HW8326 support ALSA: hda/conexant - Fix loopback issue with CX20632 ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID ALSA: usb-audio: Set up (implicit) sync for Saffire 6 ALSA: usb-audio: Skip generic sync EP parse for secondary EP ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() ASoC: es8328: Fix event generation for deemphasis control ASoC: wm8962: Fix suspend while playing music ASoC: SOF: ipc-msg-injector: Fix reversed if statement ASoC: SOF: ipc-msg-injector: Propagate write errors correctly ASoC: fsl_sai: Add support for i.MX8MN ASoC: SOF: Fix potential NULL pointer dereference ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 ASoC: cs42l51: Correct minimum value for SX volume control ASoC: cs42l56: Correct typo in minimum level for SX volume controls ASoC: cs42l52: Correct TLV for Bypass Volume ASoC: cs53l30: Correct number of volume levels on SX controls ASoC: cs35l36: Update digital volume TLV ASoC: cs42l52: Fix TLV scales for mixer controls ... commit 8dd77d44795d708f5f4f783b81c5197c5b994d74 Merge: 68171bbd1a9ad 1f192b9e8d8a5 Author: Linus Torvalds Date: Fri Jun 10 10:13:24 2022 -0700 Merge tag 'drm-fixes-2022-06-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Not a huge amount here, mainly a bunch of scattered amdgpu fixes, and then some misc panfrost, bridge/panel ones, and one ast fix for multi-monitors. Probably pick up a bit more next week like rc3 often does. amdgpu: - DCN 3.1 golden settings fix - eDP fixes - DMCUB fixes - GFX11 fixes and cleanups - VCN fix for yellow carp - GMC11 fixes - RAS fixes - GPUVM TLB flush fixes - SMU13 fixes - VCN3 AV1 regression fix - VCN2 JPEG fix - Other misc fixes amdkfd: - MMU notifier fix - Support for more GC 10.3.x families - Pinned BO handling fix - Partial migration bug fix panfrost: - fix a use after free ti-sn65dsi83: - fix invalid DT configuration panel: - two self refresh fixes ast: - multiple output fix" * tag 'drm-fixes-2022-06-10' of git://anongit.freedesktop.org/drm/drm: (37 commits) drm/ast: Support multiple outputs drm/amdgpu/mes: only invalid/prime icache when finish loading both pipe MES FWs. drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit drm/amdgpu: always flush the TLB on gfx8 drm/amdgpu: fix limiting AV1 to the first instance on VCN3 drm/amdkfd:Fix fw version for 10.3.6 drm/amdgpu: Add MODE register to wave debug info in gfx11 Revert "drm/amd/display: Pass the new context into disable OTG WA" Revert "drm/amdgpu: Ensure the DMA engine is deactivated during set ups" drm/atomic: Force bridge self-refresh-exit on CRTC switch drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/amdgpu: suppress the compile warning about 64 bit type drm/amd/pm: suppress compile warnings about possible unaligned accesses drm/amdkfd: Fix partial migration bugs drm/amdkfd: add pinned BOs to kfd_bo_list drm/amdgpu: Update PDEs flush TLB if PTB/PDB moved drm/amdgpu: enable tmz by default for GC 10.3.7 drm/amdkfd: Add GC 10.3.6 and 10.3.7 KFD definitions drm/amdkfd: Use mmget_not_zero in MMU notifier drm/amdgpu: Resolve RAS GFX error count issue after cold boot on Arcturus ... commit 68171bbd1a9adaadac0c6a85c8558eaf0b718387 Merge: f2ecc964b9414 bf56a0917fd32 Author: Linus Torvalds Date: Fri Jun 10 10:07:06 2022 -0700 Merge tag 'net-5.19-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Quick follow up, to cleanly fast-forward net again. Current release - new code bugs: - Revert "net/mlx5e: Allow relaxed ordering over VFs" Previous releases - regressions: - seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev Misc: - rename TLS_INFO_ZC_SENDFILE to better express the meaning" * tag 'net-5.19-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev nfp: flower: restructure flow-key for gre+vlan combination nfp: avoid unnecessary check warnings in nfp_app_get_vf_config tls: Rename TLS_INFO_ZC_SENDFILE to TLS_INFO_ZC_TX net/mlx5: fs, fail conflicting actions net/mlx5: Rearm the FW tracer after each tracer event net/mlx5: E-Switch, pair only capable devices net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules Revert "net/mlx5e: Allow relaxed ordering over VFs" MAINTAINERS: adjust MELLANOX ETHERNET INNOVA DRIVERS to TLS support removal commit 78cdaf3f4257ab10a6cec308ed774e7c7f7e5f72 Author: Catalin Marinas Date: Fri Jun 10 18:01:31 2022 +0100 arm64: Add kasan_hw_tags_enable() prototype to silence sparse This function is only called from assembly, no need for a prototype declaration in a header file. In addition, add #ifdef around the function since it is only used when CONFIG_KASAN_HW_TAGS. Signed-off-by: Catalin Marinas Reported-by: kernel test robot commit f2ecc964b9414a407828f9bef242b77483e95a6d Merge: 7d78b7ebdf7da dbac14a5a05ff Author: Linus Torvalds Date: Fri Jun 10 09:57:11 2022 -0700 Merge tag 'for-linus-5.19a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - a small cleanup removing "export" of an __init function - a small series adding a new infrastructure for platform flags - a series adding generic virtio support for Xen guests (frontend side) * tag 'for-linus-5.19a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: unexport __init-annotated xen_xlate_map_ballooned_pages() arm/xen: Assign xen-grant DMA ops for xen-grant DMA devices xen/grant-dma-ops: Retrieve the ID of backend's domain for DT devices xen/grant-dma-iommu: Introduce stub IOMMU driver dt-bindings: Add xen,grant-dma IOMMU description for xen-grant DMA ops xen/virtio: Enable restricted memory access using Xen grant mappings xen/grant-dma-ops: Add option to restrict memory access under Xen xen/grants: support allocating consecutive grants arm/xen: Introduce xen_setup_dma_ops() virtio: replace arch_has_restricted_virtio_memory_access() kernel: add platform_has() infrastructure commit 4314f9f4f85832b5082f4e38b07b63b11baa538c Author: Cristian Marussi Date: Wed Jun 8 10:55:28 2022 +0100 firmware: arm_scmi: Avoid using extended string-buffers sizes if not necessary Commit b260fccaebdc2 ("firmware: arm_scmi: Add SCMI v3.1 protocol extended names support") moved all the name string buffers to use the extended buffer size of 64 instead of the required 16 bytes. While that should be fine if the firmware terminates the string before 16 bytes, there is possibility of copying random data if the name is not NULL terminated by the firmware. SCMI base protocol agent_name/vendor_id/sub_vendor_id are defined by the specification as NULL-terminated ASCII strings up to 16-bytes in length. The underlying buffers and message descriptors are currently bigger than needed; resize them to fit only the strictly needed 16 bytes to avoid any possible leaks when reading data from the firmware. Change the size argument of strlcpy to use SCMI_SHORT_NAME_MAX_SIZE always when dealing with short domain names, so as to limit the possibility that an ill-formed non-NULL terminated short reply from the SCMI platform firmware can leak stale content laying in the underlying transport shared memory area. While at that, convert all strings handling routines to use the preferred strscpy. Link: https://lore.kernel.org/r/20220608095530.497879-1-cristian.marussi@arm.com Fixes: b260fccaebdc2 ("firmware: arm_scmi: Add SCMI v3.1 protocol extended names support") Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 7d78b7ebdf7dac762c3807274182b7c582be7937 Merge: 874c8ca1e60b2 41e4564002128 Author: Linus Torvalds Date: Fri Jun 10 09:52:11 2022 -0700 Merge tag 'mips-fixes_5.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Build fix for Loongson-3" * tag 'mips-fixes_5.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. commit 8e60294c8012fe4c66c3590376670998902fd822 Author: Cristian Marussi Date: Wed Jun 8 17:40:51 2022 +0100 firmware: arm_scmi: Fix SENSOR_AXIS_NAME_GET behaviour when unsupported Avoid to invoke SENSOR_AXIS_NAME_GET on sensors that have not declared at least one of their axes as supporting extended names. Since the returned list of axes supporting extended names is not necessarily comprising all the existing axes of the specified sensor, take care also to properly pick the axis descriptor from the ID embedded in the response. Link: https://lore.kernel.org/r/20220608164051.2326087-1-cristian.marussi@arm.com Fixes: 802b0bed011e ("firmware: arm_scmi: Add SCMI v3.1 SENSOR_AXIS_NAME_GET support") Cc: Peter Hilber Cc: Sudeep Holla Reviewed-by: Peter Hilber Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 566d3c57eb526f32951af15866086e236ce1fc8a Author: Damien Le Moal Date: Wed Jun 8 10:13:02 2022 +0900 scsi: scsi_debug: Fix zone transition to full condition When a write command to a sequential write required or sequential write preferred zone result in the zone write pointer reaching the end of the zone, the zone condition must be set to full AND the number of implicitly or explicitly open zones updated to have a correct accounting for zone resources. However, the function zbc_inc_wp() only sets the zone condition to full without updating the open zone counters, resulting in a zone state machine breakage. Introduce the helper function zbc_set_zone_full() and use it in zbc_inc_wp() to correctly transition zones to the full condition. Link: https://lore.kernel.org/r/20220608011302.92061-1-damien.lemoal@opensource.wdc.com Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands") Reviewed-by: Niklas Cassel Acked-by: Douglas Gilbert Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 2e990e63220bb01e2755b55b93878ce7c8cbe747 Author: Mark Brown Date: Thu Jun 2 14:41:32 2022 +0200 arm64/sme: Fix EFI save/restore The EFI save/restore code is confused. When saving the check for saving FFR is inverted due to confusion with the streaming mode check, and when restoring we check if we need to restore FFR by checking the percpu efi_sm_state without the required wrapper rather than based on the combination of FA64 support and streaming mode. Fixes: e0838f6373e5 ("arm64/sme: Save and restore streaming mode over EFI runtime calls") Reported-by: kernel test robot Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220602124132.3528951-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit bb314511b6dc0f863d6fb31ebae912ee96af7805 Author: Xiang wangx Date: Fri Jun 10 15:05:43 2022 +0800 arm64/fpsimd: Fix typo in comment Delete the redundant word 'in'. Signed-off-by: Xiang wangx Link: https://lore.kernel.org/r/20220610070543.59338-1-wangxiang@cdjrlc.com Signed-off-by: Catalin Marinas commit ce253b8573ce3de1278513395f07118650a49e39 Author: Alejandro Tafalla Date: Thu Jun 9 22:42:18 2022 +0200 arm64/sysreg: Fix typo in Enum element regex In the awk script, there was a typo with the comparison operator when checking if the matched pattern is inside an Enum block. This prevented the generation of the whole sysreg-defs.h header. Fixes: 66847e0618d7 ("arm64: Add sysreg header generation scripting") Signed-off-by: Alejandro Tafalla Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20220609204220.12112-1-atafalla@dnyon.com Signed-off-by: Catalin Marinas commit 0a35780c755ccec097d15c6b4ff8b246a89f1689 Author: Brad Bishop Date: Tue May 24 16:51:42 2022 -0500 eeprom: at25: Split reads into chunks and cap write size Make use of spi_max_transfer_size to avoid requesting transfers that are too large for some spi controllers. Signed-off-by: Brad Bishop Signed-off-by: Eddie James Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20220524215142.60047-1-eajames@linux.ibm.com Signed-off-by: Greg Kroah-Hartman commit 928ea98252ad75118950941683893cf904541da9 Author: Shin'ichiro Kawasaki Date: Wed Jun 1 19:51:59 2022 +0900 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman commit 3ed8c7d39cfef831fe508fc1308f146912fa72e6 Author: Alexander Usyskin Date: Mon Jun 6 17:42:25 2022 +0300 mei: me: add raptor lake point S DID Add Raptor (Point) Lake S device id. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220606144225.282375-3-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 68553650bc9c57c7e530c84e5b2945e9dfe1a560 Author: Alexander Usyskin Date: Mon Jun 6 17:42:24 2022 +0300 mei: hbm: drop capability response on early shutdown Drop HBM responses also in the early shutdown phase where the usual traffic is allowed. Extend the rule that drop HBM responses received during the shutdown phase by also in MEI_DEV_POWERING_DOWN state. This resolves the stall if the driver is stopping in the middle of the link initialization or link reset. Drop the capabilities response on early shutdown. Fixes: 6d7163f2c49f ("mei: hbm: drop hbm responses on early shutdown") Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220606144225.282375-2-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 9f4639373e6756e1ccf0029f861f1061db3c3616 Author: Alexander Usyskin Date: Mon Jun 6 17:42:23 2022 +0300 mei: me: set internal pg flag to off on hardware reset Link reset flow is always performed in the runtime resumed state. The internal PG state may be left as ON after the suspend and will not be updated upon the resume if the D0i3 is not supported. Ensure that the internal PG state is set to the right value on the flow entrance in case the firmware does not support D0i3. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220606144225.282375-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit cd756dafd86ee3a4969906086f3c2537e0c6d9d0 Author: Peter Robinson Date: Mon Jun 6 14:22:00 2022 +0100 staging: Also remove the Unisys visorbus.h The commit that removed the Unisys s-Par and visorbus drivers left around the include/linux/visorbus.h file mentioned in the MAINTAINERS entry, we can also remove that too. Fixes: e5f45b011e4a ("staging: Remove the drivers for the Unisys s-Par") Reviewed-by: Fabio M. De Francesco Signed-off-by: Peter Robinson Link: https://lore.kernel.org/r/20220606132200.2873243-1-pbrobinson@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1c245358ce0b13669f6d1625f7a4e05c41f28980 Author: Miaoqian Lin Date: Wed Jun 1 16:30:26 2022 +0400 misc: atmel-ssc: Fix IRQ check in ssc_probe platform_get_irq() returns negative error number instead 0 on failure. And the doc of platform_get_irq() provides a usage example: int irq = platform_get_irq(pdev, 0); if (irq < 0) return irq; Fix the check of return value to catch errors correctly. Fixes: eb1f2930609b ("Driver for the Atmel on-chip SSC on AT32AP and AT91") Reviewed-by: Claudiu Beznea Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220601123026.7119-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6497e7776441e0567c02b9c12b133d2ba51918df Author: Shreenidhi Shedi Date: Fri Jun 3 18:30:40 2022 +0530 char: lp: remove redundant initialization of err err is getting assigned with an appropriate value before returning, hence this initialization is unnecessary. Signed-off-by: Shreenidhi Shedi Link: https://lore.kernel.org/r/20220603130040.601673-2-sshedi@vmware.com Signed-off-by: Greg Kroah-Hartman commit bd476c1306ea989d6d9eb65295572e98d93edeb6 Author: Nathan Chancellor Date: Mon May 23 08:05:22 2022 -0700 misc: rtsx: Fix clang -Wsometimes-uninitialized in rts5261_init_from_hw() Clang warns: drivers/misc/cardreader/rts5261.c:406:13: error: variable 'setting_reg2' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] } else if (efuse_valid == 0) { ^~~~~~~~~~~~~~~~ drivers/misc/cardreader/rts5261.c:412:30: note: uninitialized use occurs here pci_read_config_dword(pdev, setting_reg2, &lval2); ^~~~~~~~~~~~ efuse_valid == 1 is not a valid value so just return early from the function to avoid using setting_reg2 uninitialized. Fixes: b1c5f3085149 ("misc: rtsx: add rts5261 efuse function") Reported-by: Dan Carpenter Reported-by: kernel test robot Reported-by: Tom Rix Suggested-by: Ricky WU Acked-by: Arnd Bergmann Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20220523150521.2947108-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 242439f7e279d86b3f73b5de724bc67b2f8aeb07 Author: Ian Abbott Date: Tue Jun 7 18:18:19 2022 +0100 comedi: vmk80xx: fix expression for tx buffer size The expression for setting the size of the allocated bulk TX buffer (`devpriv->usb_tx_buf`) is calling `usb_endpoint_maxp(devpriv->ep_rx)`, which is using the wrong endpoint (should be `devpriv->ep_tx`). Fix it. Fixes: a23461c47482 ("comedi: vmk80xx: fix transfer-buffer overflow") Cc: Johan Hovold Cc: stable@vger.kernel.org # 4.9+ Reviewed-by: Johan Hovold Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20220607171819.4121-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 0698f0209d8032e8869525aeb68f65ee7fde12ad Author: Linyu Yuan Date: Fri Jun 10 20:17:58 2022 +0800 usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io() In ffs_epfile_io(), when read/write data in blocking mode, it will wait the completion in interruptible mode, if task receive a signal, it will terminate the wait, at same time, if function unbind occurs, ffs_func_unbind() will kfree all eps, ffs_epfile_io() still try to dequeue request by dereferencing ep which may become invalid. Fix it by add ep spinlock and will not dereference ep if it is not valid. Cc: # 5.15 Reported-by: Michael Wu Tested-by: Michael Wu Reviewed-by: John Keeping Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1654863478-26228-3-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman commit fb1f16d74e263baa4ad11e31e28b68f144aa55ed Author: Linyu Yuan Date: Fri Jun 10 20:17:57 2022 +0800 usb: gadget: f_fs: change ep->status safe in ffs_epfile_io() If a task read/write data in blocking mode, it will wait the completion in ffs_epfile_io(), if function unbind occurs, ffs_func_unbind() will kfree ffs ep, once the task wake up, it still dereference the ffs ep to obtain the request status. Fix it by moving the request status to io_data which is stack-safe. Cc: # 5.15 Reported-by: Michael Wu Tested-by: Michael Wu Reviewed-by: John Keeping Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1654863478-26228-2-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 77006f6edc0e0f58617eb25e53731f78641e820d Author: Serge Semin Date: Fri Jun 10 13:45:00 2022 +0300 gpio: dwapb: Don't print error on -EPROBE_DEFER Currently if the APB or Debounce clocks aren't yet ready to be requested the DW GPIO driver will correctly handle that by deferring the probe procedure, but the error is still printed to the system log. It needlessly pollutes the log since there was no real error but a request to postpone the clock request procedure since the clocks subsystem hasn't been fully initialized yet. Let's fix that by using the dev_err_probe method to print the APB/clock request error status. It will correctly handle the deferred probe situation and print the error if it actually happens. Signed-off-by: Serge Semin Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 802dcafc420af536fcde1b44ac51ca211f4ec673 Author: Mathias Nyman Date: Fri Jun 10 14:53:38 2022 +0300 xhci: Fix null pointer dereference in resume if xhci has only one roothub In the re-init path xhci_resume() passes 'hcd->primary_hcd' to hci_init(), however this field isn't initialized by __usb_create_hcd() for a HCD without secondary controller. xhci_resume() is called once per xHC device, not per hcd, so the extra checking for primary hcd can be removed. Fixes: e0fe986972f5 ("usb: host: xhci-plat: prepare operation w/o shared hcd") Reported-by: Matthias Kaehlcke Tested-by: Matthias Kaehlcke Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220610115338.863152-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit be03b0651ffd8bab69dfd574c6818b446c0753ce Author: Ilpo Järvinen Date: Fri May 20 13:35:41 2022 +0300 serial: 8250: Store to lsr_save_flags after lsr read Not all LSR register flags are preserved across reads. Therefore, LSR readers must store the non-preserved bits into lsr_save_flags. This fix was initially mixed into feature commit f6f586102add ("serial: 8250: Handle UART without interrupt on TEMT using em485"). However, that feature change had a flaw and it was reverted to make room for simpler approach providing the same feature. The embedded fix got reverted with the feature change. Re-add the lsr_save_flags fix and properly mark it's a fix. Link: https://lore.kernel.org/all/1d6c31d-d194-9e6a-ddf9-5f29af829f3@linux.intel.com/T/#m1737eef986bd20cf19593e344cebd7b0244945fc Fixes: e490c9144cfa ("tty: Add software emulated RS485 support for 8250") Cc: stable Acked-by: Uwe Kleine-König Signed-off-by: Uwe Kleine-König Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/f4d774be-1437-a550-8334-19d8722ab98c@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 499e13aac6c762e1e828172b0f0f5275651d6512 Author: Vincent Whitchurch Date: Thu Jun 9 16:17:04 2022 +0200 tty: goldfish: Fix free_irq() on remove Pass the correct dev_id to free_irq() to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq Trying to free already-free IRQ 65 Call Trace: warn_slowpath_fmt free_irq goldfish_tty_remove platform_remove device_remove device_release_driver_internal device_driver_detach unbind_store drv_attr_store ... Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1") Signed-off-by: Vincent Whitchurch Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.com Signed-off-by: Greg Kroah-Hartman commit 654a8d6c93e77ecff2256ca3ab2cd98967821f0a Author: Vijaya Krishna Nivarthi Date: Wed Jun 8 00:22:45 2022 +0530 tty: serial: qcom-geni-serial: Implement start_rx callback In suspend sequence stop_rx will be performed only if implementation for start_rx callback is present. Set qcom_geni_serial_start_rx as callback for start_rx so that stop_rx is performed. Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled") Reviewed-by: Douglas Anderson Signed-off-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/1654627965-1461-3-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Greg Kroah-Hartman commit cfab87c2c2715763dc7e43d9968bdaa01cde4bc3 Author: Vijaya Krishna Nivarthi Date: Wed Jun 8 00:22:44 2022 +0530 serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present. In suspend sequence there is a need to perform stop_rx during suspend sequence to prevent any asynchronous data over rx line. However this can cause problem to drivers which dont do re-start_rx during set_termios. Add new callback start_rx and perform stop_rx only when implementation of start_rx is present. Also add call to start_rx in resume sequence so that drivers who come across this problem can make use of this framework. Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled") Reviewed-by: Douglas Anderson Signed-off-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/1654627965-1461-2-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Greg Kroah-Hartman commit e74024b2eccbb784824a0f9feaeaaa3b47514b79 Author: Tony Lindgren Date: Mon May 23 18:50:52 2022 +0300 tty: n_gsm: Debug output allocation must use GFP_ATOMIC Dan Carpenter reported the following Smatch warning: drivers/tty/n_gsm.c:720 gsm_data_kick() warn: sleeping in atomic context This is because gsm_control_message() is holding a spin lock so gsm_hex_dump_bytes() needs to use GFP_ATOMIC instead of GFP_KERNEL. Fixes: 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") Cc: stable Reported-by: Dan Carpenter Reviewed-by: Gregory CLEMENT Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220523155052.57129-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 81b0d0e4f811553cbe2d58c8a495c124fb626432 Author: Christian König Date: Fri Jun 3 12:43:50 2022 +0200 drm/ttm: fix missing NULL check in ttm_device_swapout Resources about to be destructed are not tied to BOs any more. Signed-off-by: Christian König Reviewed-by: Felix Kuehling Fixes: 6a9b02899402 ("drm/ttm: move the LRU into resource handling v4") Link: https://patchwork.freedesktop.org/patch/msgid/20220603104604.456991-1-christian.koenig@amd.com commit e052a478a7daeca67664f7addd308ff51dd40654 Author: Jason A. Donenfeld Date: Wed Jun 8 10:31:25 2022 +0200 random: remove rng_has_arch_random() With arch randomness being used by every distro and enabled in defconfigs, the distinction between rng_has_arch_random() and rng_is_initialized() is now rather small. In fact, the places where they differ are now places where paranoid users and system builders really don't want arch randomness to be used, in which case we should respect that choice, or places where arch randomness is known to be broken, in which case that choice is all the more important. So this commit just removes the function and its one user. Reviewed-by: Petr Mladek # for vsprintf.c Signed-off-by: Jason A. Donenfeld commit 846bb97e131d7938847963cca00657c995b1fce1 Author: Jason A. Donenfeld Date: Sun Jun 5 18:30:46 2022 +0200 random: credit cpu and bootloader seeds by default This commit changes the default Kconfig values of RANDOM_TRUST_CPU and RANDOM_TRUST_BOOTLOADER to be Y by default. It does not change any existing configs or change any kernel behavior. The reason for this is several fold. As background, I recently had an email thread with the kernel maintainers of Fedora/RHEL, Debian, Ubuntu, Gentoo, Arch, NixOS, Alpine, SUSE, and Void as recipients. I noted that some distros trust RDRAND, some trust EFI, and some trust both, and I asked why or why not. There wasn't really much of a "debate" but rather an interesting discussion of what the historical reasons have been for this, and it came up that some distros just missed the introduction of the bootloader Kconfig knob, while another didn't want to enable it until there was a boot time switch to turn it off for more concerned users (which has since been added). The result of the rather uneventful discussion is that every major Linux distro enables these two options by default. While I didn't have really too strong of an opinion going into this thread -- and I mostly wanted to learn what the distros' thinking was one way or another -- ultimately I think their choice was a decent enough one for a default option (which can be disabled at boot time). I'll try to summarize the pros and cons: Pros: - The RNG machinery gets initialized super quickly, and there's no messing around with subsequent blocking behavior. - The bootloader mechanism is used by kexec in order for the prior kernel to initialize the RNG of the next kernel, which increases the entropy available to early boot daemons of the next kernel. - Previous objections related to backdoors centered around Dual_EC_DRBG-like kleptographic systems, in which observing some amount of the output stream enables an adversary holding the right key to determine the entire output stream. This used to be a partially justified concern, because RDRAND output was mixed into the output stream in varying ways, some of which may have lacked pre-image resistance (e.g. XOR or an LFSR). But this is no longer the case. Now, all usage of RDRAND and bootloader seeds go through a cryptographic hash function. This means that the CPU would have to compute a hash pre-image, which is not considered to be feasible (otherwise the hash function would be terribly broken). - More generally, if the CPU is backdoored, the RNG is probably not the realistic vector of choice for an attacker. - These CPU or bootloader seeds are far from being the only source of entropy. Rather, there is generally a pretty huge amount of entropy, not all of which is credited, especially on CPUs that support instructions like RDRAND. In other words, assuming RDRAND outputs all zeros, an attacker would *still* have to accurately model every single other entropy source also in use. - The RNG now reseeds itself quite rapidly during boot, starting at 2 seconds, then 4, then 8, then 16, and so forth, so that other sources of entropy get used without much delay. - Paranoid users can set random.trust_{cpu,bootloader}=no in the kernel command line, and paranoid system builders can set the Kconfig options to N, so there's no reduction or restriction of optionality. - It's a practical default. - All the distros have it set this way. Microsoft and Apple trust it too. Bandwagon. Cons: - RDRAND *could* still be backdoored with something like a fixed key or limited space serial number seed or another indexable scheme like that. (However, it's hard to imagine threat models where the CPU is backdoored like this, yet people are still okay making *any* computations with it or connecting it to networks, etc.) - RDRAND *could* be defective, rather than backdoored, and produce garbage that is in one way or another insufficient for crypto. - Suggesting a *reduction* in paranoia, as this commit effectively does, may cause some to question my personal integrity as a "security person". - Bootloader seeds and RDRAND are generally very difficult if not all together impossible to audit. Keep in mind that this doesn't actually change any behavior. This is just a change in the default Kconfig value. The distros already are shipping kernels that set things this way. Ard made an additional argument in [1]: We're at the mercy of firmware and micro-architecture anyway, given that we are also relying on it to ensure that every instruction in the kernel's executable image has been faithfully copied to memory, and that the CPU implements those instructions as documented. So I don't think firmware or ISA bugs related to RNGs deserve special treatment - if they are broken, we should quirk around them like we usually do. So enabling these by default is a step in the right direction IMHO. In [2], Phil pointed out that having this disabled masked a bug that CI otherwise would have caught: A clean 5.15.45 boots cleanly, whereas a downstream kernel shows the static key warning (but it does go on to boot). The significant difference is that our defconfigs set CONFIG_RANDOM_TRUST_BOOTLOADER=y defining that on top of multi_v7_defconfig demonstrates the issue on a clean 5.15.45. Conversely, not setting that option in a downstream kernel build avoids the warning [1] https://lore.kernel.org/lkml/CAMj1kXGi+ieviFjXv9zQBSaGyyzeGW_VpMpTLJK8PJb2QHEQ-w@mail.gmail.com/ [2] https://lore.kernel.org/lkml/c47c42e3-1d56-5859-a6ad-976a1a3381c6@raspberrypi.com/ Cc: Theodore Ts'o Reviewed-by: Ard Biesheuvel Signed-off-by: Jason A. Donenfeld commit 60e5b2886b92afa9e7af56bba7f5fa5f057e1e97 Author: Jason A. Donenfeld Date: Tue Jun 7 17:28:06 2022 +0200 random: do not use jump labels before they are initialized Stephen reported that a static key warning splat appears during early boot on systems that credit randomness from device trees that contain an "rng-seed" property, because because setup_machine_fdt() is called before jump_label_init() during setup_arch(): static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init() WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : static_key_enable_cpuslocked+0xb0/0xb8 lr : static_key_enable_cpuslocked+0xb0/0xb8 sp : ffffffe51c393cf0 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 Call trace: static_key_enable_cpuslocked+0xb0/0xb8 static_key_enable+0x2c/0x40 crng_set_ready+0x24/0x30 execute_in_process_context+0x80/0x90 _credit_init_bits+0x100/0x154 add_bootloader_randomness+0x64/0x78 early_init_dt_scan_chosen+0x140/0x184 early_init_dt_scan_nodes+0x28/0x4c early_init_dt_scan+0x40/0x44 setup_machine_fdt+0x7c/0x120 setup_arch+0x74/0x1d8 start_kernel+0x84/0x44c __primary_switched+0xc0/0xc8 ---[ end trace 0000000000000000 ]--- random: crng init done Machine model: Google Lazor (rev1 - 2) with LTE A trivial fix went in to address this on arm64, 73e2d827a501 ("arm64: Initialize jump labels before setup_machine_fdt()"). I wrote patches as well for arm32 and risc-v. But still patches are needed on xtensa, powerpc, arc, and mips. So that's 7 platforms where things aren't quite right. This sort of points to larger issues that might need a larger solution. Instead, this commit just defers setting the static branch until later in the boot process. random_init() is called after jump_label_init() has been called, and so is always a safe place from which to adjust the static branch. Fixes: f5bda35fba61 ("random: use static branch for crng_ready()") Reported-by: Stephen Boyd Reported-by: Phil Elwell Tested-by: Phil Elwell Reviewed-by: Ard Biesheuvel Cc: Catalin Marinas Cc: Russell King Cc: Arnd Bergmann Signed-off-by: Jason A. Donenfeld commit 77fc95f8c0dc9e1f8e620ec14d2fb65028fb7adc Author: Jason A. Donenfeld Date: Tue Jun 7 17:04:38 2022 +0200 random: account for arch randomness in bits Rather than accounting in bytes and multiplying (shifting), we can just account in bits and avoid the shift. The main motivation for this is there are other patches in flux that expand this code a bit, and avoiding the duplication of "* 8" everywhere makes things a bit clearer. Cc: stable@vger.kernel.org Fixes: 12e45a2a6308 ("random: credit architectural init the exact amount") Signed-off-by: Jason A. Donenfeld commit 39e0f991a62ed5efabd20711a7b6e7da92603170 Author: Jason A. Donenfeld Date: Tue Jun 7 17:00:16 2022 +0200 random: mark bootloader randomness code as __init add_bootloader_randomness() and the variables it touches are only used during __init and not after, so mark these as __init. At the same time, unexport this, since it's only called by other __init code that's built-in. Cc: stable@vger.kernel.org Fixes: 428826f5358c ("fdt: add support for rng-seed") Signed-off-by: Jason A. Donenfeld commit 8bd6b8c4b1009d7d2662138d6bdc6fe58a9274c5 Author: Stephen Rothwell Date: Tue Apr 26 15:27:39 2022 +1000 USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present" Today's linux-next merge of the extcon tree got a conflict in: drivers/usb/dwc3/drd.c between commit: 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") from the usb tree and commit: 88490c7f43c4 ("extcon: Fix extcon_get_extcon_dev() error handling") from the extcon tree. I fixed it up (the former moved the code modified by the latter, so I used the former version of this files and added the following merge fix patch) and can carry the fix as necessary. Signed-off-by: Stephen Rothwell Link: https://lore.kernel.org/r/20220426152739.62f6836e@canb.auug.org.au Signed-off-by: Greg Kroah-Hartman commit 5c7578c39c3fffe85b7d15ca1cf8cf7ac38ec0c1 Author: Jing Leng Date: Thu Jun 9 10:11:34 2022 +0800 usb: cdnsp: Fixed setting last_trb incorrectly When ZLP occurs in bulk transmission, currently cdnsp will set last_trb for the last two TRBs, it will trigger an error "ERROR Transfer event TRB DMA ptr not part of current TD ...". Fixes: e913aada0683 ("usb: cdnsp: Fixed issue with ZLP") Cc: stable Acked-by: Pawel Laszczak Signed-off-by: Jing Leng Link: https://lore.kernel.org/r/20220609021134.1606-1-3090101217@zju.edu.cn Signed-off-by: Greg Kroah-Hartman commit b337af3a4d6147000b7ca6b3438bf5c820849b37 Author: Marian Postevca Date: Fri Jun 3 18:34:59 2022 +0300 usb: gadget: u_ether: fix regression in setting fixed MAC address In systemd systems setting a fixed MAC address through the "dev_addr" module argument fails systematically. When checking the MAC address after the interface is created it always has the same but different MAC address to the one supplied as argument. This is partially caused by systemd which by default will set an internally generated permanent MAC address for interfaces that are marked as having a randomly generated address. Commit 890d5b40908bfd1a ("usb: gadget: u_ether: fix race in setting MAC address in setup phase") didn't take into account the fact that the interface must be marked as having a set MAC address when it's set as module argument. Fixed by marking the interface with NET_ADDR_SET when the "dev_addr" module argument is supplied. Fixes: 890d5b40908bfd1a ("usb: gadget: u_ether: fix race in setting MAC address in setup phase") Cc: stable@vger.kernel.org Signed-off-by: Marian Postevca Link: https://lore.kernel.org/r/20220603153459.32722-1-posteuca@mutex.one Signed-off-by: Greg Kroah-Hartman commit 4757c9ade34178b351580133771f510b5ffcf9c8 Author: Miaoqian Lin Date: Fri Jun 3 18:02:44 2022 +0400 usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() will check NULL pointer. Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx") Cc: stable Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220603140246.64529-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3755278f078460b021cd0384562977bf2039a57a Author: Miaoqian Lin Date: Mon May 30 12:54:12 2022 +0400 usb: dwc2: Fix memory leak in dwc2_hcd_init usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when platform_get_resource() fails to prevent memory leak. goto error2 label instead error1 to fix this. Fixes: 856e6e8e0f93 ("usb: dwc2: check return value after calling platform_get_resource()") Cc: stable Acked-by: Minas Harutyunyan Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220530085413.44068-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7ddda2614d62ef7fdef7fd85f5151cdf665b22d8 Author: Stephan Gerhold Date: Sat May 28 19:09:13 2022 +0200 usb: dwc3: pci: Restore line lost in merge conflict resolution Commit 582ab24e096f ("usb: dwc3: pci: Set "linux,phy_charger_detect" property on some Bay Trail boards") added a new swnode similar to the existing ones for boards where the PHY handles charger detection. Unfortunately, the "linux,sysdev_is_parent" property got lost in the merge conflict resolution of commit ca9400ef7f67 ("Merge 5.17-rc6 into usb-next"). Now dwc3_pci_intel_phy_charger_detect_properties is the only swnode in dwc3-pci that is missing "linux,sysdev_is_parent". It does not seem to cause any obvious functional issues, but it's certainly unintended so restore the line to make the properties consistent again. Fixes: ca9400ef7f67 ("Merge 5.17-rc6 into usb-next") Cc: stable@vger.kernel.org Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20220528170913.9240-1-stephan@gerhold.net Signed-off-by: Greg Kroah-Hartman commit 9c1e916960c1192e746bf615e4dae25423473a64 Author: Wesley Cheng Date: Mon May 23 14:39:48 2022 -0700 usb: dwc3: gadget: Fix IN endpoint max packet size allocation The current logic to assign the max packet limit for IN endpoints attempts to take the default HW value and apply the optimal endpoint settings based on it. However, if the default value reports a TxFIFO size large enough for only one max packet, it will divide the value and assign a smaller ep max packet limit. For example, if the default TxFIFO size fits 1024B, current logic will assign 1024/3 = 341B to ep max packet size. If function drivers attempt to request for an endpoint with a wMaxPacketSize of 1024B (SS BULK max packet size) then it will fail, as the gadget is unable to find an endpoint which can fit the requested size. Functionally, if the TxFIFO has enough space to fit one max packet, it will be sufficient, at least when initializing the endpoints. Fixes: d94ea5319813 ("usb: dwc3: gadget: Properly set maxpacket limit") Cc: stable Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20220523213948.22142-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 9b29b6b20376ab64e1b043df6301d8a92378e631 Author: Jason A. Donenfeld Date: Tue Jun 7 09:44:07 2022 +0200 random: avoid checking crng_ready() twice in random_init() The current flow expands to: if (crng_ready()) ... else if (...) if (!crng_ready()) ... The second crng_ready() call is redundant, but can't so easily be optimized out by the compiler. This commit simplifies that to: if (crng_ready() ... else if (...) ... Fixes: 560181c27b58 ("random: move initialization functions out of hot pages") Cc: stable@vger.kernel.org Cc: Dominik Brodowski Signed-off-by: Jason A. Donenfeld commit 656c5ba50b7172a0ea25dc1b37606bd51d01fe8d Author: Saurabh Sengar Date: Thu Jun 9 10:16:36 2022 -0700 Drivers: hv: vmbus: Release cpu lock in error case In case of invalid sub channel, release cpu lock before returning. Fixes: a949e86c0d780 ("Drivers: hv: vmbus: Resolve race between init_vp_index() and CPU hotplug") Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1654794996-13244-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu commit 552ca27929ab28b341ae9b2629f0de3a84c98ee8 Author: Alexander Stein Date: Tue May 10 07:46:12 2022 +0200 ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node Move the power domain to its actual user. This keeps the power domain enabled even when the USB host is runtime suspended. This is necessary to detect any downstream events, like device attach. Fixes: 02f8eb40ef7b ("ARM: dts: imx7s: Add power domain for imx7d HSIC") Suggested-by: Jun Li Signed-off-by: Alexander Stein Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 1d9e615f1ab34c690d25b8742abe423219e5d3af Merge: f2906aa863381 158f7585bfcea Author: Greg Kroah-Hartman Date: Fri Jun 10 10:27:30 2022 +0200 Merge tag 'usb-serial-5.19-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.19-rc2 Here are some new device ids for a modem and an Edgeport device. All have been in linux-next with no reported issues. * tag 'usb-serial-5.19-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add support for Cinterion MV31 with new baseline USB: serial: io_ti: add Agilent E5805A support commit b2e6b3d9bbb0a59ba7c710cc06e44cc548301f5f Author: Soham Sen Date: Thu Jun 9 23:49:20 2022 +0530 ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop The HP Omen 15 laptop needs a quirk to toggle the mute LED. It already is implemented for a different variant of the HP Omen laptop so a fixup entry is needed for this variant. Signed-off-by: Soham Sen Cc: Link: https://lore.kernel.org/r/20220609181919.45535-1-contact@sohamsen.me Signed-off-by: Takashi Iwai commit 6fac824f40987a54a08dfbcc36145869d02e45b1 Author: Jiaxun Yang Date: Thu Jun 9 18:52:41 2022 +0100 irqchip/loongson-liointc: Use architecture register to get coreid fa84f89395e0 ("irqchip/loongson-liointc: Fix build error for LoongArch") replaced get_ebase_cpunum with physical processor id from SMP facilities. However that breaks MIPS non-SMP build and makes booting from other cores inpossible on non-SMP kernel. Thus we revert get_ebase_cpunum back and use get_csr_cpuid for LoongArch. Fixes: fa84f89395e0 ("irqchip/loongson-liointc: Fix build error for LoongArch") Signed-off-by: Jiaxun Yang Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609175242.977-1-jiaxun.yang@flygoat.com commit 90f4b5499cdd94be3c1e856375ecd7d5f9c4cecc Author: Ping-Ke Shih Date: Wed Jun 8 10:03:12 2022 +0800 rtw88: 8821c: fix access const table of channel parameters We would like to make chip_info table const, but 8821c uses one field as a variable, and causes core dump. To fix this, move the field to another struct that can be read and written. BUG: unable to handle page fault for address: ffffffffc09f52f4 PGD 5b5215067 P4D 5b5215067 PUD 5b5217067 PMD 111f61067 PTE 8000000111e07161 Oops: 0003 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 436 Comm: NetworkManager Not tainted 5.18.0-rc7-debug-01822-g89d8f53ff6e7 #1 5cac31ca93432e53341863abfb3332fd98b144da Hardware name: HP HP Desktop M01-F1xxx/87D6, BIOS F.12 12/17/2020 RIP: 0010:rtw8821c_phy_set_param+0x262/0x380 [rtw88_8821c] Code: e8 53 f3 c0 d6 48 8b 43 10 4c 8b 63 38 be 24 0a 00 00 48 89 df 48 8b 40 68 e8 3a f3 c0 d6 89 e9 be 28 0a 00 00 48 89 df d3 e8 <41> 89 84 24 54 01 00 00 48 8b 43 10 4c 8b 63 38 48 8b 40 68 e8 15 RSP: 0018:ffffb08c417cb6f0 EFLAGS: 00010286 RAX: 0000000064b80c1c RBX: ffff93d15a0120e0 RCX: 0000000000000000 RDX: 0000000034028211 RSI: 0000000000000a28 RDI: ffff93d15a0120e0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000006 R12: ffffffffc09f51a0 R13: ffff93d15a0156d0 R14: 0000000000000000 R15: 0000000000000001 FS: 00007f4e9b73d1c0(0000) GS:ffff93d83ab80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc09f52f4 CR3: 0000000103b9e000 CR4: 0000000000350ee0 Call Trace: rtw_core_start+0xbd/0x190 [rtw88_core de79d6bdfd083d102030858972032e5706726279] rtw_ops_start+0x26/0x40 [rtw88_core de79d6bdfd083d102030858972032e5706726279] drv_start+0x42/0x100 [mac80211 21e803d0ad10691f64c6c81ecc24c0c6c36e5d58] ieee80211_do_open+0x2fb/0x900 [mac80211 21e803d0ad10691f64c6c81ecc24c0c6c36e5d58] ieee80211_open+0x67/0x80 [mac80211 21e803d0ad10691f64c6c81ecc24c0c6c36e5d58] __dev_open+0xdd/0x180 [...] Fixes: 89d8f53ff6e7 ("wifi: rtw88: Fix Sparse warning for rtw8821c_hw_spec") Reported-by: Nathan Chancellor Cc: Larry Finger Signed-off-by: Ping-Ke Shih Tested-by: Nathan Chancellor Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220608020312.9663-1-pkshih@realtek.com commit 67ea0a2adbf667cd6da4965fbcfd0da741035084 Author: Kees Cook Date: Wed Jun 8 14:55:12 2022 -0700 staging: rtl8723bs: Allocate full pwep structure The pwep allocation was always being allocated smaller than the true structure size. Avoid this by always allocating the full structure. Found with GCC 12 and -Warray-bounds: ../drivers/staging/rtl8723bs/os_dep/ioctl_linux.c: In function 'rtw_set_encryption': ../drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:591:29: warning: array subscript 'struct ndis_802_11_wep[0]' is partly outside array bounds of 'void[25]' [-Warray-bounds] 591 | pwep->length = wep_total_len; | ^~ Cc: Greg Kroah-Hartman Cc: Fabio Aiuto Cc: Hans de Goede Cc: linux-staging@lists.linux.dev Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220608215512.1070847-1-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman commit de0952f267ffe9d4ecbfeab7c476f7e29e028b3e Author: Javier Martinez Canillas Date: Fri Jun 10 00:34:24 2022 +0200 staging: olpc_dcon: mark driver as broken The commit eecb3e4e5d9d ("staging: olpc_dcon: add OLPC display controller (DCON) support") added this driver in 2010, and has been in staging since then. It was marked as broken at some point because it didn't even build but that got removed once the build issues were addressed. But it seems that the work to move this driver out of staging has stalled, the last non-trivial change to fix one of the items mentioned in its todo file was commit e40219d5e4b2 ("staging: olpc_dcon: allow simultaneous XO-1 and XO-1.5 support") in 2019. And even if work to destage the driver is resumed, the fbdev subsystem has been deprecated for a long time and instead it should be ported to DRM. Now this driver is preventing to land a kernel wide change, that makes the num_registered_fb symbol to be private to the fbmem.c file. So let's just mark the driver as broken. Someone can then work on making it not depend on the num_registered_fb symbol, allowing to drop the broken dependency again. Suggested-by: Sam Ravnborg Acked-by: Thomas Zimmermann Signed-off-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20220609223424.907174-1-javierm@redhat.com Signed-off-by: Greg Kroah-Hartman commit 34d2cd3fccced12b958b8848e3eff0ee4296764c Author: Miaoqian Lin Date: Thu May 12 06:16:10 2022 +0400 ARM: meson: Fix refcount leak in meson_smp_prepare_cpus of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: d850f3e5d296 ("ARM: meson: Add SMP bringup code for Meson8 and Meson8b") Signed-off-by: Miaoqian Lin Reviewed-by: Martin Blumenstingl Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20220512021611.47921-1-linmq006@gmail.com commit bf56a0917fd329d5adecfd405e681ff7ba1abb52 Merge: a3bd2102e4642 8fa5e7b20e010 Author: Jakub Kicinski Date: Thu Jun 9 22:05:36 2022 -0700 Merge tag 'mlx5-fixes-2022-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2022-06-08 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2022-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: fs, fail conflicting actions net/mlx5: Rearm the FW tracer after each tracer event net/mlx5: E-Switch, pair only capable devices net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules Revert "net/mlx5e: Allow relaxed ordering over VFs" MAINTAINERS: adjust MELLANOX ETHERNET INNOVA DRIVERS to TLS support removal ==================== Link: https://lore.kernel.org/r/20220608185855.19818-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit a3bd2102e464202b58d57390a538d96f57ffc361 Author: Andrea Mayer Date: Wed Jun 8 11:19:17 2022 +0200 net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev Commit 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices") adds a new entry (flowi_l3mdev) in the common flow struct used for indicating the l3mdev index for later rule and table matching. The l3mdev_update_flow() has been adapted to properly set the flowi_l3mdev based on the flowi_oif/flowi_iif. In fact, when a valid flowi_iif is supplied to the l3mdev_update_flow(), this function can update the flowi_l3mdev entry only if it has not yet been set (i.e., the flowi_l3mdev entry is equal to 0). The SRv6 End.DT6 behavior in VRF mode leverages a VRF device in order to force the routing lookup into the associated routing table. This routing operation is performed by seg6_lookup_any_nextop() preparing a flowi6 data structure used by ip6_route_input_lookup() which, in turn, (indirectly) invokes l3mdev_update_flow(). However, seg6_lookup_any_nexthop() does not initialize the new flowi_l3mdev entry which is filled with random garbage data. This prevents l3mdev_update_flow() from properly updating the flowi_l3mdev with the VRF index, and thus SRv6 End.DT6 (VRF mode)/DT46 behaviors are broken. This patch correctly initializes the flowi6 instance allocated and used by seg6_lookup_any_nexhtop(). Specifically, the entire flowi6 instance is wiped out: in case new entries are added to flowi/flowi6 (as happened with the flowi_l3mdev entry), we should no longer have incorrectly initialized values. As a result of this operation, the value of flowi_l3mdev is also set to 0. The proposed fix can be tested easily. Starting from the commit referenced in the Fixes, selftests [1],[2] indicate that the SRv6 End.DT6 (VRF mode)/DT46 behaviors no longer work correctly. By applying this patch, those behaviors are back to work properly again. [1] - tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh [2] - tools/testing/selftests/net/srv6_end_dt6_l3vpn_test.sh Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices") Reported-by: Anton Makarov Signed-off-by: Andrea Mayer Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220608091917.20345-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit cd3ff99b93f777ec9fd2844fbcd67ebc3350bb64 Merge: b489a6e587169 a0b843340dae7 Author: Jakub Kicinski Date: Thu Jun 9 22:02:42 2022 -0700 Merge branch 'nfp-fixes-for-v5-19' Simon Horman says: ==================== nfp: fixes for v5.19 this short series includes two fixes for the NFP driver. 1. Restructure GRE+VLAN flower offload to address a miss match between the NIC firmware and driver implementation which prevented these features from working in combination. 2. Prevent unnecessary warnings regarding rate limiting support.- It is expected that this feature to not _always_ be present but this was not taken into account when the code to check for this feature was added. ==================== Link: https://lore.kernel.org/r/20220608092901.124780-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit a0b843340dae704e17c1ddfad0f85c583c36757f Author: Etienne van der Linde Date: Wed Jun 8 11:29:01 2022 +0200 nfp: flower: restructure flow-key for gre+vlan combination Swap around the GRE and VLAN parts in the flow-key offloaded by the driver to fit in with other tunnel types and the firmware. Without this change used cases with GRE+VLAN on the outer header does not get offloaded as the flow-key mismatches what the firmware expect. Fixes: 0d630f58989a ("nfp: flower: add support to offload QinQ match") Fixes: 5a2b93041646 ("nfp: flower-ct: compile match sections of flow_payload") Signed-off-by: Etienne van der Linde Signed-off-by: Louis Peens Signed-off-by: Yinjun Zhang Signed-off-by: Simon Horman Signed-off-by: Jakub Kicinski commit 03d5005ff7356a9952a21da20a3d7828fd559fee Author: Fei Qin Date: Wed Jun 8 11:29:00 2022 +0200 nfp: avoid unnecessary check warnings in nfp_app_get_vf_config nfp_net_sriov_check is added in nfp_app_get_vf_config which intends to ensure ivi->vlan_proto and ivi->max_tx_rate/min_tx_rate can be read from VF config table only when firmware supports corresponding capability. However, "nfp_app_get_vf_config" can be called by commands like "ip a", "ip link set $DEV up" and "ip link set $DEV vf $NUM vlan $param" (with VF). When using commands above, many warnings "ndo_set_vf_ not supported" would appear if firmware doesn't support VF rate limit and 802.1ad VLAN assingment. If more VFs are created, things could get worse. Thus, this patch add an extra bool parameter for nfp_net_sriov_check to enable/disable the cap check warning report. Unnecessary warnings in nfp_app_get_vf_config can be avoided. Valid warnings in kinds of vf setting function can be reserved. Fixes: e0d0e1fdf1ed ("nfp: VF rate limit support") Fixes: 59359597b010 ("nfp: support 802.1ad VLAN assingment to VF") Signed-off-by: Fei Qin Signed-off-by: Yinjun Zhang Signed-off-by: Louis Peens Signed-off-by: Simon Horman Signed-off-by: Jakub Kicinski commit b489a6e5871690735752f8875f411e4d0cd8e5df Author: Maxim Mikityanskiy Date: Wed Jun 8 18:34:25 2022 +0300 tls: Rename TLS_INFO_ZC_SENDFILE to TLS_INFO_ZC_TX To embrace possible future optimizations of TLS, rename zerocopy sendfile definitions to more generic ones: * setsockopt: TLS_TX_ZEROCOPY_SENDFILE- > TLS_TX_ZEROCOPY_RO * sock_diag: TLS_INFO_ZC_SENDFILE -> TLS_INFO_ZC_RO_TX RO stands for readonly and emphasizes that the application shouldn't modify the data being transmitted with zerocopy to avoid potential disconnection. Fixes: c1318b39c7d3 ("tls: Add opt-in zerocopy mode of sendfile()") Signed-off-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20220608153425.3151146-1-maximmi@nvidia.com Signed-off-by: Jakub Kicinski commit 1f192b9e8d8a5c619b33a868fb1af063af65ce5d Merge: 88bfb6dbb61c5 477277c7fd43d Author: Dave Airlie Date: Fri Jun 10 13:29:15 2022 +1000 Merge tag 'drm-misc-fixes-2022-06-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes two fixes for panel self-refresh handling, and one to fix multiple output support on AST. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220609100754.kvrkjy67gqabjuee@houat commit 88bfb6dbb61c54008600c3cc6276610393a00d2b Merge: 0a178750647e4 6e516faf04317 Author: Dave Airlie Date: Fri Jun 10 13:09:19 2022 +1000 Merge tag 'drm-misc-fixes-2022-05-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A use-after-free fix for panfrost, and a DT invalid configuration fix for ti-sn65dsi83 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220526090532.nvhlmwev5qgln3nb@houat commit a1ea0857b59757733d58908dd55bf4b722ee574f Author: Wei Yongjun Date: Wed Jun 8 02:11:54 2022 +0000 clk: stm32: rcc_reset: Fix missing spin_lock_init() The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. Fixes: 637cee5ffc71 ("clk: stm32: Introduce STM32MP13 RCC drivers (Reset Clock Controller)") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20220608021154.990347-1-weiyongjun1@huawei.com Tested-by: Gabriel Fernandez Reviewed-by: Gabriel Fernandez Signed-off-by: Stephen Boyd commit 874c8ca1e60b2c564a48f7e7acc40d328d5c8733 Author: David Howells Date: Thu Jun 9 21:46:04 2022 +0100 netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context While randstruct was satisfied with using an open-coded "void *" offset cast for the netfs_i_context <-> inode casting, __builtin_object_size() as used by FORTIFY_SOURCE was not as easily fooled. This was causing the following complaint[1] from gcc v12: In file included from include/linux/string.h:253, from include/linux/ceph/ceph_debug.h:7, from fs/ceph/inode.c:2: In function 'fortify_memset_chk', inlined from 'netfs_i_context_init' at include/linux/netfs.h:326:2, inlined from 'ceph_alloc_inode' at fs/ceph/inode.c:463:2: include/linux/fortify-string.h:242:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 242 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by embedding a struct inode into struct netfs_i_context (which should perhaps be renamed to struct netfs_inode). The struct inode vfs_inode fields are then removed from the 9p, afs, ceph and cifs inode structs and vfs_inode is then simply changed to "netfs.inode" in those filesystems. Further, rename netfs_i_context to netfs_inode, get rid of the netfs_inode() function that converted a netfs_i_context pointer to an inode pointer (that can now be done with &ctx->inode) and rename the netfs_i_context() function to netfs_inode() (which is now a wrapper around container_of()). Most of the changes were done with: perl -p -i -e 's/vfs_inode/netfs.inode/'g \ `git grep -l 'vfs_inode' -- fs/{9p,afs,ceph,cifs}/*.[ch]` Kees suggested doing it with a pair structure[2] and a special declarator to insert that into the network filesystem's inode wrapper[3], but I think it's cleaner to embed it - and then it doesn't matter if struct randomisation reorders things. Dave Chinner suggested using a filesystem-specific VFS_I() function in each filesystem to convert that filesystem's own inode wrapper struct into the VFS inode struct[4]. Version #2: - Fix a couple of missed name changes due to a disabled cifs option. - Rename nfs_i_context to nfs_inode - Use "netfs" instead of "nic" as the member name in per-fs inode wrapper structs. [ This also undoes commit 507160f46c55 ("netfs: gcc-12: temporarily disable '-Wattribute-warning' for now") that is no longer needed ] Fixes: bc899ee1c898 ("netfs: Add a netfs inode context") Reported-by: Jeff Layton Signed-off-by: David Howells Reviewed-by: Jeff Layton Reviewed-by: Kees Cook Reviewed-by: Xiubo Li cc: Jonathan Corbet cc: Eric Van Hensbergen cc: Latchesar Ionkov cc: Dominique Martinet cc: Christian Schoenebeck cc: Marc Dionne cc: Ilya Dryomov cc: Steve French cc: William Kucharski cc: "Matthew Wilcox (Oracle)" cc: Dave Chinner cc: linux-doc@vger.kernel.org cc: v9fs-developer@lists.sourceforge.net cc: linux-afs@lists.infradead.org cc: ceph-devel@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: samba-technical@lists.samba.org cc: linux-fsdevel@vger.kernel.org cc: linux-hardening@vger.kernel.org Link: https://lore.kernel.org/r/d2ad3a3d7bdd794c6efb562d2f2b655fb67756b9.camel@kernel.org/ [1] Link: https://lore.kernel.org/r/20220517210230.864239-1-keescook@chromium.org/ [2] Link: https://lore.kernel.org/r/20220518202212.2322058-1-keescook@chromium.org/ [3] Link: https://lore.kernel.org/r/20220524101205.GI2306852@dread.disaster.area/ [4] Link: https://lore.kernel.org/r/165296786831.3591209.12111293034669289733.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165305805651.4094995.7763502506786714216.stgit@warthog.procyon.org.uk # v2 Signed-off-by: Linus Torvalds commit 334f6f53abcf57782bd2fe81da1cbd893e4ef05c Author: Matthew Wilcox (Oracle) Date: Thu Jun 9 09:13:57 2022 -0400 mm: Add kernel-doc for folio->mlock_count Fix "./include/linux/mm_types.h:279: warning: Function parameter or member 'mlock_count' not described in 'folio'". Also neaten the html by hiding the anon struct. Signed-off-by: Matthew Wilcox (Oracle) commit 69a37a8ba1b408a1c7616494aa7018e4b3844cbe Author: Matthew Wilcox (Oracle) Date: Wed Jun 8 15:18:34 2022 -0400 mm/huge_memory: Fix xarray node memory leak If xas_split_alloc() fails to allocate the necessary nodes to complete the xarray entry split, it sets the xa_state to -ENOMEM, which xas_nomem() then interprets as "Please allocate more memory", not as "Please free any unnecessary memory" (which was the intended outcome). It's confusing to use xas_nomem() to free memory in this context, so call xas_destroy() instead. Reported-by: syzbot+9e27a75a8c24f3fe75c1@syzkaller.appspotmail.com Fixes: 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache") Cc: stable@vger.kernel.org Signed-off-by: Matthew Wilcox (Oracle) commit dcfa24ba68991ab69a48254a18377b45180ae664 Author: Matthew Wilcox (Oracle) Date: Wed May 25 14:23:45 2022 -0400 filemap: Cache the value of vm_flags After we have unlocked the mmap_lock for I/O, the file is pinned, but the VMA is not. Checking this flag after that can be a use-after-free. It's not a terribly interesting use-after-free as it can only read one bit, and it's used to decide whether to read 2MB or 4MB. But it upsets the automated tools and it's generally bad practice anyway, so let's fix it. Reported-by: syzbot+5b96d55e5b54924c77ad@syzkaller.appspotmail.com Fixes: 4687fdbb805a ("mm/filemap: Support VM_HUGEPAGE for file mappings") Cc: stable@vger.kernel.org Signed-off-by: Matthew Wilcox (Oracle) commit 6bf74cddcffac0bc5ee0fad724aac778d2e53f75 Author: Matthew Wilcox (Oracle) Date: Tue Jun 7 15:45:53 2022 -0400 filemap: Don't release a locked folio We must hold a reference over the call to filemap_release_folio(), otherwise the page cache will put the last reference to the folio before we unlock it, leading to splats like this: BUG: Bad page state in process u8:5 pfn:1ab1f4 page:ffffea0006ac7d00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x28b1de pfn:0x1ab1f4 flags: 0x17ff80000040001(locked|reclaim|node=0|zone=2|lastcpupid=0xfff) raw: 017ff80000040001 dead000000000100 dead000000000122 0000000000000000 raw: 000000000028b1de 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set It's an error path, so it doesn't see much testing. Reported-by: Darrick J. Wong Fixes: a42634a6c07d ("readahead: Use a folio in read_pages()") Signed-off-by: Matthew Wilcox (Oracle) commit 41e456400212803704e82691716e1d7b0865114a Author: Yupeng Li Date: Wed Jun 8 09:12:29 2022 +0800 MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. set cpu_hwmon as a module build with loongson_sysconf, loongson_chiptemp undefined error,fix cpu_hwmon compile options to be bool.Some kernel compilation error information is as follows: Checking missing-syscalls for N32 CALL scripts/checksyscalls.sh Checking missing-syscalls for O32 CALL scripts/checksyscalls.sh CALL scripts/checksyscalls.sh CHK include/generated/compile.h CC [M] drivers/platform/mips/cpu_hwmon.o Building modules, stage 2. MODPOST 200 modules ERROR: "loongson_sysconf" [drivers/platform/mips/cpu_hwmon.ko] undefined! ERROR: "loongson_chiptemp" [drivers/platform/mips/cpu_hwmon.ko] undefined! make[1]: *** [scripts/Makefile.modpost:92：__modpost] 错误 1 make: *** [Makefile:1261：modules] 错误 2 Signed-off-by: Yupeng Li Reviewed-by: Guenter Roeck Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer commit 3d9f55c57bc3659f986acc421eac431ff6edcc83 Merge: 95fc76c81b927 537e11cdc7a6b Author: Linus Torvalds Date: Thu Jun 9 12:26:05 2022 -0700 Merge tag 'fs_for_v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, writeback, and quota fixes and cleanups from Jan Kara: "A fix for race in writeback code and two cleanups in quota and ext2" * tag 'fs_for_v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: quota: Prevent memory allocation recursion while holding dq_lock writeback: Fix inode->i_io_list not be protected by inode->i_lock error fs: Fix syntax errors in comments commit 95fc76c81b9270a9ab38f4947fe5cb786c8c79cc Merge: 825464e79db4a 8e1278444446f Author: Linus Torvalds Date: Thu Jun 9 12:17:43 2022 -0700 Merge tag 'powerpc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - On 32-bit fix overread/overwrite of thread_struct via ptrace PEEK/POKE. - Fix softirqs not switching to the softirq stack since we moved irq_exit(). - Force thread size increase when KASAN is enabled to avoid stack overflows. - On Book3s 64 mark more code as not to be instrumented by KASAN to avoid crashes. - Exempt __get_wchan() from KASAN checking, as it's inherently racy. - Fix a recently introduced crash in the papr_scm driver in some configurations. - Remove include of which is forbidden. Thanks to Ariel Miculas, Chen Jingwen, Christophe Leroy, Erhard Furtner, He Ying, Kees Cook, Masahiro Yamada, Nageswara R Sastry, Paul Mackerras, Sachin Sant, Vaibhav Jain, and Wanming Hu. * tag 'powerpc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/32: Fix overread/overwrite of thread_struct via ptrace powerpc/book3e: get rid of #include powerpc/kasan: Force thread size increase with KASAN powerpc/papr_scm: don't requests stats with '0' sized stats buffer powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK powerpc/kasan: Silence KASAN warnings in __get_wchan() powerpc/kasan: Mark more real-mode code as not to be instrumented commit 093d27bb6f2d1963f927ef59c9a2d37059175426 Author: Dorian Rudolph Date: Sat May 14 17:23:40 2022 +0200 power: supply: core: Fix boundary conditions in interpolation The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple handle boundary conditions incorrectly. The change was introduced in a4585ba2050f460f749bbaf2b67bd56c41e30283 ("power: supply: core: Use library interpolation"). There are two issues: First, the lines "high = i - 1" and "high = i" in ocv2cap have the wrong order compared to temp2resist. As a consequence, ocv2cap sets high=-1 if ocv>table[0].ocv, which causes an out-of-bounds read. Second, the logic of temp2resist is also not correct. Consider the case table[] = {{20, 100}, {10, 80}, {0, 60}}. For temp=5, we expect a resistance of 70% by interpolation. However, temp2resist sets high=low=2 and returns 60. Cc: stable@vger.kernel.org Signed-off-by: Dorian Rudolph Reviewed-by: Linus Walleij Fixes: a4585ba2050f ("power: supply: core: Use library interpolation") Signed-off-by: Sebastian Reichel commit 80192eff64eee9b3bc0594a47381937b94b9d65a Author: Miaoqian Lin Date: Mon May 23 18:10:09 2022 +0400 power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 0e545f57b708 ("power: reset: driver for the Versatile syscon reboot") Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Signed-off-by: Sebastian Reichel commit 0f5de2f0532229752d923c769a5b202ae437523b Author: Gao Chao Date: Wed Jun 8 10:42:49 2022 +0800 power: supply: ab8500_fg: add missing destroy_workqueue in ab8500_fg_probe In ab8500_fg_probe, misses destroy_workqueue in error path, this patch fixes that. Fixes: 010ddb813f35 ("power: supply: ab8500_fg: Allocate wq in probe") Signed-off-by: Gao Chao Reviewed-by: Linus Walleij Signed-off-by: Sebastian Reichel commit 825464e79db4aac936e0fdae62cdfb7546d0028f Merge: 507160f46c559 647df0d41b6bd Author: Linus Torvalds Date: Thu Jun 9 12:06:52 2022 -0700 Merge tag 'net-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bpf and netfilter. Current release - regressions: - eth: amt: fix possible null-ptr-deref in amt_rcv() Previous releases - regressions: - tcp: use alloc_large_system_hash() to allocate table_perturb - af_unix: fix a data-race in unix_dgram_peer_wake_me() - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling - eth: ixgbe: fix unexpected VLAN rx in promisc mode on VF Previous releases - always broken: - ipv6: fix signed integer overflow in __ip6_append_data - netfilter: - nat: really support inet nat without l3 address - nf_tables: memleak flow rule from commit path - bpf: fix calling global functions from BPF_PROG_TYPE_EXT programs - openvswitch: fix misuse of the cached connection on tuple changes - nfc: nfcmrvl: fix memory leak in nfcmrvl_play_deferred - eth: altera: fix refcount leak in altera_tse_mdio_create Misc: - add Quentin Monnet to bpftool maintainers" * tag 'net-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (45 commits) net: amd-xgbe: fix clang -Wformat warning tcp: use alloc_large_system_hash() to allocate table_perturb net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY net: dsa: mv88e6xxx: correctly report serdes link failure net: dsa: mv88e6xxx: fix BMSR error to be consistent with others net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete net: altera: Fix refcount leak in altera_tse_mdio_create net: openvswitch: fix misuse of the cached connection on tuple changes net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag ip_gre: test csum_start instead of transport header au1000_eth: stop using virt_to_bus() ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg ipv6: Fix signed integer overflow in __ip6_append_data nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION net: ipv6: unexport __init-annotated seg6_hmac_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: mdio: unexport __init-annotated mdio_bus_init() ... commit 387c67afccbb271707cbe6de2817f4e4c76287ad Author: Simon Horman Date: Thu Jun 9 20:42:30 2022 +0200 docs: arm: tcm: Fix typo in description of TCM and MMU usage Correct a typo in the description of interaction between the TCM and MMU. Found by inspection. Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220609184230.627958-1-simon.horman@corigine.com Signed-off-by: Jonathan Corbet commit da4288b95baa1c7c9aa8a476f58b37eb238745b0 Author: Masahiro Yamada Date: Wed Jun 8 10:11:00 2022 +0900 scripts/check-local-export: avoid 'wait $!' for process substitution Bash 4.4, released in 2016, supports 'wait $!' to check the exit status of a process substitution, but it seems too new. Some people using older bash versions (on CentOS 7, Ubuntu 16.04, etc.) reported an error like this: ./scripts/check-local-export: line 54: wait: pid 17328 is not a child of this shell I used the process substitution to avoid a pipeline, which executes each command in a subshell. If the while-loop is executed in the subshell context, variable changes within are lost after the subshell terminates. Fortunately, Bash 4.2, released in 2011, supports the 'lastpipe' option, which makes the last element of a pipeline run in the current shell process. Switch to the pipeline with 'lastpipe' solution, and also set 'pipefail' to catch errors from ${NM}. Add the bash requirement to Documentation/process/changes.rst. Fixes: 31cb50b5590f ("kbuild: check static EXPORT_SYMBOL* by script instead of modpost") Reported-by: Tetsuo Handa Reported-by: Michael Ellerman Reported-by: Wang Yugui Tested-by: Tetsuo Handa Tested-by: Jon Hunter Acked-by: Nick Desaulniers Tested-by: Sedat Dilek # LLVM-14 (x86-64) Signed-off-by: Masahiro Yamada commit 507160f46c55913955d272ebf559d63809a8e560 Author: Linus Torvalds Date: Thu Jun 9 11:29:36 2022 -0700 netfs: gcc-12: temporarily disable '-Wattribute-warning' for now This is a pure band-aid so that I can continue merging stuff from people while some of the gcc-12 fallout gets sorted out. In particular, gcc-12 is very unhappy about the kinds of pointer arithmetic tricks that netfs does, and that makes the fortify checks trigger in afs and ceph: In function ‘fortify_memset_chk’, inlined from ‘netfs_i_context_init’ at include/linux/netfs.h:327:2, inlined from ‘afs_set_netfs_context’ at fs/afs/inode.c:61:2, inlined from ‘afs_root_iget’ at fs/afs/inode.c:543:2: include/linux/fortify-string.h:258:25: warning: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 258 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and the reason is that netfs_i_context_init() is passed a 'struct inode' pointer, and then it does struct netfs_i_context *ctx = netfs_i_context(inode); memset(ctx, 0, sizeof(*ctx)); where that netfs_i_context() function just does pointer arithmetic on the inode pointer, knowing that the netfs_i_context is laid out immediately after it in memory. This is all truly disgusting, since the whole "netfs_i_context is laid out immediately after it in memory" is not actually remotely true in general, but is just made to be that way for afs and ceph. See for example fs/cifs/cifsglob.h: struct cifsInodeInfo { struct { /* These must be contiguous */ struct inode vfs_inode; /* the VFS's inode record */ struct netfs_i_context netfs_ctx; /* Netfslib context */ }; [...] and realize that this is all entirely wrong, and the pointer arithmetic that netfs_i_context() is doing is also very very wrong and wouldn't give the right answer if netfs_ctx had different alignment rules from a 'struct inode', for example). Anyway, that's just a long-winded way to say "the gcc-12 warning is actually quite reasonable, and our code happens to work but is pretty disgusting". This is getting fixed properly, but for now I made the mistake of thinking "the week right after the merge window tends to be calm for me as people take a breather" and I did a sustem upgrade. And I got gcc-12 as a result, so to continue merging fixes from people and not have the end result drown in warnings, I am fixing all these gcc-12 issues I hit. Including with these kinds of temporary fixes. Cc: Kees Cook Cc: David Howells Link: https://lore.kernel.org/all/AEEBCF5D-8402-441D-940B-105AA718C71F@chromium.org/ Signed-off-by: Linus Torvalds commit f0be87c42cbd341d436d06da4792e6b0c83c3aeb Author: Linus Torvalds Date: Thu Jun 9 10:11:12 2022 -0700 gcc-12: disable '-Warray-bounds' universally for now In commit 8b202ee21839 ("s390: disable -Warray-bounds") the s390 people disabled the '-Warray-bounds' warning for gcc-12, because the new logic in gcc would cause warnings for their use of the S390_lowcore macro, which accesses absolute pointers. It turns out gcc-12 has many other issues in this area, so this takes that s390 warning disable logic, and turns it into a kernel build config entry instead. Part of the intent is that we can make this all much more targeted, and use this conflig flag to disable it in only particular configurations that cause problems, with the s390 case as an example: select GCC12_NO_ARRAY_BOUNDS and we could do that for other configuration cases that cause issues. Or we could possibly use the CONFIG_CC_NO_ARRAY_BOUNDS thing in a more targeted way, and disable the warning only for particular uses: again the s390 case as an example: KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds) but this ends up just doing it globally in the top-level Makefile, since the current issues are spread fairly widely all over: KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds We'll try to limit this later, since the gcc-12 problems are rare enough that *much* of the kernel can be built with it without disabling this warning. Cc: Kees Cook Cc: Nathan Chancellor Signed-off-by: Linus Torvalds commit 842c3b3ddc5f4d17275edbaa09e23d712bf8b915 Author: Linus Torvalds Date: Thu Jun 9 10:03:28 2022 -0700 mellanox: mlx5: avoid uninitialized variable warning with gcc-12 gcc-12 started warning about 'tracker' being used uninitialized: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c: In function ‘mlx5_do_bond’: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:786:28: warning: ‘tracker’ is used uninitialized [-Wuninitialized] 786 | struct lag_tracker tracker; | ^~~~~~~ which seems to be because it doesn't track how the use (and initialization) is bound by the 'do_bond' flag. But admittedly that 'do_bond' usage is fairly complicated, and involves passing it around as an argument to helper functions, so it's somewhat understandable that gcc doesn't see how that all works. This function could be rewritten to make the use of that tracker variable more obviously safe, but for now I'm just adding the forced initialization of it. Signed-off-by: Linus Torvalds commit e3f056a7aafabe4ac3ad4b7465ba821b44a7e639 Author: Kunihiko Hayashi Date: Fri May 20 14:17:02 2022 +0900 irqchip/uniphier-aidet: Add compatible string for NX1 SoC Add the compatible string to support UniPhier NX1 SoC, which has the same kinds of controls as the other UniPhier SoCs. Signed-off-by: Kunihiko Hayashi Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/1653023822-19229-3-git-send-email-hayashi.kunihiko@socionext.com commit df089e6f07e3c94cb7a330dc74f5041db800009c Author: Kunihiko Hayashi Date: Fri May 20 14:17:01 2022 +0900 dt-bindings: interrupt-controller/uniphier-aidet: Add bindings for NX1 SoC Update uniphier-aidet binding document for UniPhier NX1 SoC. Signed-off-by: Kunihiko Hayashi Acked-by: Rob Herring Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/1653023822-19229-2-git-send-email-hayashi.kunihiko@socionext.com commit 49beadbd47c270a00754c107a837b4f29df4c822 Author: Linus Torvalds Date: Thu Jun 9 09:41:42 2022 -0700 gcc-12: disable '-Wdangling-pointer' warning for now While the concept of checking for dangling pointers to local variables at function exit is really interesting, the gcc-12 implementation is not compatible with reality, and results in false positives. For example, gcc sees us putting things on a local list head allocated on the stack, which involves exactly those kinds of pointers to the local stack entry: In function ‘__list_add’, inlined from ‘list_add_tail’ at include/linux/list.h:102:2, inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2: include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=] 74 | new->prev = prev; | ~~~~~~~~~~^~~~~~ But then gcc - understandably - doesn't really understand the big picture how the doubly linked list works, so doesn't see how we then end up emptying said list head in a loop and the pointer we added has been removed. Gcc also complains about us (intentionally) using this as a way to store a kind of fake stack trace, eg drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=] 40 | acpi_gbl_entry_stack_pointer = ¤t_sp; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ which is entirely reasonable from a compiler standpoint, and we may want to change those kinds of patterns, but not not. So this is one of those "it would be lovely if the compiler were to complain about us leaving dangling pointers to the stack", but not this way. Signed-off-by: Linus Torvalds commit 7aefd8b53815274f3ef398d370a3c9b27dd9f00c Author: Linus Torvalds Date: Wed Jun 8 16:59:29 2022 -0700 drm: imx: fix compiler warning with gcc-12 Gcc-12 correctly warned about this code using a non-NULL pointer as a truth value: drivers/gpu/drm/imx/ipuv3-crtc.c: In function ‘ipu_crtc_disable_planes’: drivers/gpu/drm/imx/ipuv3-crtc.c:72:21: error: the comparison will always evaluate as ‘true’ for the address of ‘plane’ will never be NULL [-Werror=address] 72 | if (&ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base) | ^ due to the extraneous '&' address-of operator. Philipp Zabel points out that The mistake had no adverse effect since the following condition doesn't actually dereference the NULL pointer, but the intent of the code was obviously to check for it, not to take the address of the member. Fixes: eb8c88808c83 ("drm/imx: add deferred plane disabling") Acked-by: Philipp Zabel Signed-off-by: Linus Torvalds commit eff4780f83d0ae3e5b6c02ff5d999dc4c1c5c8ce Author: Miaoqian Lin Date: Wed Jun 1 12:09:30 2022 +0400 irqchip/realtek-rtl: Fix refcount leak in map_interrupts of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function doesn't call of_node_put() in error path. Call of_node_put() directly after of_property_read_u32() to cover both normal path and error path. Fixes: 9f3a0f34b84a ("irqchip: Add support for Realtek RTL838x/RTL839x interrupt controller") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-7-linmq006@gmail.com commit fa1ad9d4cc47ca2470cd904ad4519f05d7e43a2b Author: Miaoqian Lin Date: Wed Jun 1 12:09:29 2022 +0400 irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: e3825ba1af3a ("irqchip/gic-v3: Add support for partitioned PPIs") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-6-linmq006@gmail.com commit ec8401a429ffee34ccf38cebf3443f8d5ae6cb0d Author: Miaoqian Lin Date: Wed Jun 1 12:09:28 2022 +0400 irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. When kcalloc fails, it missing of_node_put() and results in refcount leak. Fix this by goto out_put_node label. Fixes: 52085d3f2028 ("irqchip/gic-v3: Dynamically allocate PPI partition descriptors") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-5-linmq006@gmail.com commit 3d45670fab3c25a7452721e4588cc95c51cda134 Author: Miaoqian Lin Date: Wed Jun 1 12:09:27 2022 +0400 irqchip/apple-aic: Fix refcount leak in aic_of_ic_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: a5e8801202b3 ("irqchip/apple-aic: Parse FIQ affinities from device-tree") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-4-linmq006@gmail.com commit b1ac803f47cb1615468f35cf1ccb553c52087301 Author: Miaoqian Lin Date: Wed Jun 1 12:09:26 2022 +0400 irqchip/apple-aic: Fix refcount leak in build_fiq_affinity of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: a5e8801202b3 ("irqchip/apple-aic: Parse FIQ affinities from device-tree") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-3-linmq006@gmail.com commit f4b98e314888cc51486421bcf6d52852452ea48b Author: Miaoqian Lin Date: Wed Jun 1 12:09:25 2022 +0400 irqchip/gic/realview: Fix refcount leak in realview_gic_of_init of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 82b0a434b436 ("irqchip/gic/realview: Support more RealView DCC variants") Signed-off-by: Miaoqian Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220601080930.31005-2-linmq006@gmail.com commit b84dc7f0e3646d480b6972c5f25586215c5f33e2 Author: Jamie Iles Date: Mon Jun 6 22:39:52 2022 +0100 irqchip/xilinx: Remove microblaze+zynq dependency The Xilinx IRQ controller doesn't really have any architecture dependencies - it's a generic AXI component that can be used for any FPGA core from Zynq hard processor systems to microblaze+riscv soft cores and more. Signed-off-by: Jamie Iles Acked-by: Michal Simek Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220606213952.298686-1-jamie@jamieiles.com commit 9c73e1e06e0d6d72c445a1b1f50493da260b0c4e Author: Jonathan Corbet Date: Mon Jun 6 08:40:55 2022 -0600 docs: Move the HTE documentation to driver-api/ The hardware timestamp engine documentation is driver API material, and really belongs in the driver-API book; move it there. Cc: Thierry Reding Acked-by: Dipen Patel Signed-off-by: Jonathan Corbet commit 645603844270b69175899268be68b871295764fe Author: Michal Wilczynski Date: Fri May 20 13:19:27 2022 +0200 iavf: Fix issue with MAC address of VF shown as zero After reinitialization of iavf, ice driver gets VIRTCHNL_OP_ADD_ETH_ADDR message with incorrectly set type of MAC address. Hardware address should have is_primary flag set as true. This way ice driver knows what it has to set as a MAC address. Check if the address is primary in iavf_add_filter function and set flag accordingly. To test set all-zero MAC on a VF. This triggers iavf re-initialization and VIRTCHNL_OP_ADD_ETH_ADDR message gets sent to PF. For example: ip link set dev ens785 vf 0 mac 00:00:00:00:00:00 This triggers re-initialization of iavf. New MAC should be assigned. Now check if MAC is non-zero: ip link show dev ens785 Fixes: a3e839d539e0 ("iavf: Add usage of new virtchnl format to set default MAC") Signed-off-by: Michal Wilczynski Reviewed-by: Maciej Fijalkowski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit fd5855e6b1358e816710afee68a1d2bc685176ca Author: Aleksandr Loktionov Date: Thu May 19 16:01:45 2022 +0200 i40e: Fix call trace in setup_tx_descriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset and test there were no errors. Problem was that pf reset calls i40e_vsi_close in prep_for_reset and ethtool -t calls i40e_vsi_close in diag_test. If there was not enough time between those commands the second i40e_vsi_close starts before previous i40e_vsi_close was done which leads to crash. Add check to diag_test if pf is in reset and don't start offline tests if it is true. Add netif_info("testing failed") into unhappy path of i40e_diag_test() Fixes: e17bc411aea8 ("i40e: Disable offline diagnostics if VFs are enabled") Fixes: 510efb2682b3 ("i40e: Fix ethtool offline diagnostic with netqueues") Signed-off-by: Michal Jaron Signed-off-by: Aleksandr Loktionov Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0bb050670ac90a167ecfa3f9590f92966c9a3677 Author: Grzegorz Szczurek Date: Fri Apr 29 14:40:23 2022 +0200 i40e: Fix calculating the number of queue pairs If ADQ is enabled for a VF, then actual number of queue pair is a number of currently available traffic classes for this VF. Without this change the configuration of the Rx/Tx queues fails with error. Fixes: d29e0d233e0d ("i40e: missing input validation on VF message handling by the PF") Signed-off-by: Grzegorz Szczurek Signed-off-by: Jedrzej Jagielski Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit c3238d36c3a2be0a29a9d848d6c51e1b14be6692 Author: Grzegorz Szczurek Date: Fri Apr 29 14:27:08 2022 +0200 i40e: Fix adding ADQ filter to TC0 Procedure of configure tc flower filters erroneously allows to create filters on TC0 where unfiltered packets are also directed by default. Issue was caused by insufficient checks of hw_tc parameter specifying the hardware traffic class to pass matching packets to. Fix checking hw_tc parameter which blocks creation of filters on TC0. Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") Signed-off-by: Grzegorz Szczurek Signed-off-by: Jedrzej Jagielski Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit 788183a6e8b098b90e15214e800ae5194591018a Author: Justin Swartz Date: Sat Jun 4 17:54:31 2022 +0200 docs: usb: fix literal block marker in usbmon verification example The "Verify that bus sockets are present" example was not properly formatted due to a typo in the literal block marker. Signed-off-by: Justin Swartz Link: https://lore.kernel.org/r/20220604155431.23246-1-justin.swartz@risingedge.co.za Signed-off-by: Jonathan Corbet commit 5860800e8696d2cbbd1a0dd60b433549d176e668 Author: Zheng Zengkai Date: Thu Jun 9 10:56:56 2022 +0800 Documentation/features: Update the arch support status files The arch support status files don't match reality as of v5.19-rc1, use the features-refresh.sh to refresh all the arch-support.txt files in place. The main effect is to add entries for the new loong architecture. Signed-off-by: Zheng Zengkai Link: https://lore.kernel.org/r/20220609025656.143460-1-zhengzengkai@huawei.com Signed-off-by: Jonathan Corbet commit 668a9fe5c6a1bcac6b65d5e9b91a9eca86f782a3 Author: Marc Zyngier Date: Wed Jun 8 14:45:35 2022 +0100 genirq: PM: Use runtime PM for chained interrupts When requesting an interrupt, we correctly call into the runtime PM framework to guarantee that the underlying interrupt controller is up and running. However, we fail to do so for chained interrupt controllers, as the mux interrupt is not requested along the same path. Augment __irq_do_set_handler() to call into the runtime PM code in this case, making sure the PM flow is the same for all interrupts. Reported-by: Lucas Stach Tested-by: Liu Ying Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/26973cddee5f527ea17184c0f3fccb70bc8969a0.camel@pengutronix.de commit e0f3f46e42064a51573914766897b4ab95d943e3 Author: David Matlack Date: Fri May 20 23:32:49 2022 +0000 KVM: selftests: Restrict test region to 48-bit physical addresses when using nested The selftests nested code only supports 4-level paging at the moment. This means it cannot map nested guest physical addresses with more than 48 bits. Allow perf_test_util nested mode to work on hosts with more than 48 physical addresses by restricting the guest test region to 48-bits. While here, opportunistically fix an off-by-one error when dealing with vm_get_max_gfn(). perf_test_util.c was treating this as the maximum number of GFNs, rather than the maximum allowed GFN. This didn't result in any correctness issues, but it did end up shifting the test region down slightly when using huge pages. Suggested-by: Sean Christopherson Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-12-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 71d489661904fcc3ec31b343acd5c0dac84b5410 Author: David Matlack Date: Fri May 20 23:32:48 2022 +0000 KVM: selftests: Add option to run dirty_log_perf_test vCPUs in L2 Add an option to dirty_log_perf_test that configures the vCPUs to run in L2 instead of L1. This makes it possible to benchmark the dirty logging performance of nested virtualization, which is particularly interesting because KVM must shadow L1's EPT/NPT tables. For now this support only works on x86_64 CPUs with VMX. Otherwise passing -n results in the test being skipped. Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-11-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit cf97d5e99f69f876dc310ea21b5f97c3a493a18a Author: David Matlack Date: Fri May 20 23:32:47 2022 +0000 KVM: selftests: Clean up LIBKVM files in Makefile Break up the long lines for LIBKVM and alphabetize each architecture. This makes reading the Makefile easier, and will make reading diffs to LIBKVM easier. No functional change intended. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-10-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit cdc979dae265cc77a035b736f78f58e4c7309bb2 Author: David Matlack Date: Fri May 20 23:32:46 2022 +0000 KVM: selftests: Link selftests directly with lib object files The linker does obey strong/weak symbols when linking static libraries, it simply resolves an undefined symbol to the first-encountered symbol. This means that defining __weak arch-generic functions and then defining arch-specific strong functions to override them in libkvm will not always work. More specifically, if we have: lib/generic.c: void __weak foo(void) { pr_info("weak\n"); } void bar(void) { foo(); } lib/x86_64/arch.c: void foo(void) { pr_info("strong\n"); } And a selftest that calls bar(), it will print "weak". Now if you make generic.o explicitly depend on arch.o (e.g. add function to arch.c that is called directly from generic.c) it will print "strong". In other words, it seems that the linker is free to throw out arch.o when linking because generic.o does not explicitly depend on it, which causes the linker to lose the strong symbol. One solution is to link libkvm.a with --whole-archive so that the linker doesn't throw away object files it thinks are unnecessary. However that is a bit difficult to plumb since we are using the common selftests makefile rules. An easier solution is to drop libkvm.a just link selftests with all the .o files that were originally in libkvm.a. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-9-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit acf57736e755ba5c467fc6fa85e4a0750cc36150 Author: David Matlack Date: Fri May 20 23:32:45 2022 +0000 KVM: selftests: Drop unnecessary rule for STATIC_LIBS Drop the "all: $(STATIC_LIBS)" rule. The KVM selftests already depend on $(STATIC_LIBS), so there is no reason to have an extra "all" rule. Suggested-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-8-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit c363d95986b1b930947305e2372665141721d15f Author: David Matlack Date: Fri May 20 23:32:44 2022 +0000 KVM: selftests: Add a helper to check EPT/VPID capabilities Create a small helper function to check if a given EPT/VPID capability is supported. This will be re-used in a follow-up commit to check for 1G page support. No functional change intended. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-7-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit b6c086d04c0a1ba356145cdba5b46bd6cea2b9bd Author: David Matlack Date: Fri May 20 23:32:43 2022 +0000 KVM: selftests: Move VMX_EPT_VPID_CAP_AD_BITS to vmx.h This is a VMX-related macro so move it to vmx.h. While here, open code the mask like the rest of the VMX bitmask macros. No functional change intended. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-6-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit ce690e9c17d27486af879defc506679cbbb14777 Author: David Matlack Date: Fri May 20 23:32:42 2022 +0000 KVM: selftests: Refactor nested_map() to specify target level Refactor nested_map() to specify that it explicityl wants 4K mappings (the existing behavior) and push the implementation down into __nested_map(), which can be used in subsequent commits to create huge page mappings. No function change intended. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-5-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit b8ca01ea19068b54938ebb4ebc06814a89dee8ea Author: David Matlack Date: Fri May 20 23:32:41 2022 +0000 KVM: selftests: Drop stale function parameter comment for nested_map() nested_map() does not take a parameter named eptp_memslot. Drop the comment referring to it. Reviewed-by: Peter Xu Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-4-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit c5a0ccec4cb4edde8e5b7e369dbe4d169b111e42 Author: David Matlack Date: Fri May 20 23:32:40 2022 +0000 KVM: selftests: Add option to create 2M and 1G EPT mappings The current EPT mapping code in the selftests only supports mapping 4K pages. This commit extends that support with an option to map at 2M or 1G. This will be used in a future commit to create large page mappings to test eager page splitting. No functional change intended. Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-3-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 4ee602e78d706e740a48be9b6ddb239df4a113b5 Author: David Matlack Date: Fri May 20 23:32:39 2022 +0000 KVM: selftests: Replace x86_page_size with PG_LEVEL_XX x86_page_size is an enum used to communicate the desired page size with which to map a range of memory. Under the hood they just encode the desired level at which to map the page. This ends up being clunky in a few ways: - The name suggests it encodes the size of the page rather than the level. - In other places in x86_64/processor.c we just use a raw int to encode the level. Simplify this by adopting the kernel style of PG_LEVEL_XX enums and pass around raw ints when referring to the level. This makes the code easier to understand since these macros are very common in KVM MMU code. Signed-off-by: David Matlack Message-Id: <20220520233249.3776001-2-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit e3cdaab5ff022874e65df80ae8b8382ccc0a4fe0 Author: Paolo Bonzini Date: Tue May 31 13:57:32 2022 -0400 KVM: x86: SVM: fix nested PAUSE filtering when L0 intercepts PAUSE Commit 74fd41ed16fd ("KVM: x86: nSVM: support PAUSE filtering when L0 doesn't intercept PAUSE") introduced passthrough support for nested pause filtering, (when the host doesn't intercept PAUSE) (either disabled with kvm module param, or disabled with '-overcommit cpu-pm=on') Before this commit, L1 KVM didn't intercept PAUSE at all; afterwards, the feature was exposed as supported by KVM cpuid unconditionally, thus if L1 could try to use it even when the L0 KVM can't really support it. In this case the fallback caused KVM to intercept each PAUSE instruction; in some cases, such intercept can slow down the nested guest so much that it can fail to boot. Instead, before the problematic commit KVM was already setting both thresholds to 0 in vmcb02, but after the first userspace VM exit shrink_ple_window was called and would reset the pause_filter_count to the default value. To fix this, change the fallback strategy - ignore the guest threshold values, but use/update the host threshold values unless the guest specifically requests disabling PAUSE filtering (either simple or advanced). Also fix a minor bug: on nested VM exit, when PAUSE filter counter were copied back to vmcb01, a dirty bit was not set. Thanks a lot to Suravee Suthikulpanit for debugging this! Fixes: 74fd41ed16fd ("KVM: x86: nSVM: support PAUSE filtering when L0 doesn't intercept PAUSE") Reported-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Co-developed-by: Maxim Levitsky Message-Id: <20220518072709.730031-1-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit ba8ec273240a7a67819b5957c8d06a267ec54db7 Author: Maxim Levitsky Date: Mon Jun 6 21:08:29 2022 +0300 KVM: x86: SVM: drop preempt-safe wrappers for avic_vcpu_load/put Now that these functions are always called with preemption disabled, remove the preempt_disable()/preempt_enable() pair inside them. No functional change intended. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-8-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 18869f26df1a11ed11031dfb7392bc7d774062e8 Author: Maxim Levitsky Date: Mon Jun 6 21:08:28 2022 +0300 KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un|}blocking On SVM, if preemption happens right after the call to finish_rcuwait but before call to kvm_arch_vcpu_unblocking on SVM/AVIC, it itself will re-enable AVIC, and then we will try to re-enable it again in kvm_arch_vcpu_unblocking which will lead to a warning in __avic_vcpu_load. The same problem can happen if the vCPU is preempted right after the call to kvm_arch_vcpu_blocking but before the call to prepare_to_rcuwait and in this case, we will end up with AVIC enabled during sleep - Ooops. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-7-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 66c768d30e64e1280520f34dbef83419f55f3459 Author: Maxim Levitsky Date: Mon Jun 6 21:08:27 2022 +0300 KVM: x86: disable preemption while updating apicv inhibition Currently nothing prevents preemption in kvm_vcpu_update_apicv. On SVM, If the preemption happens after we update the vcpu->arch.apicv_active, the preemption itself will 'update' the inhibition since the AVIC will be first disabled on vCPU unload and then enabled, when the current task is loaded again. Then we will try to update it again, which will lead to a warning in __avic_vcpu_load, that the AVIC is already enabled. Fix this by disabling preemption in this code. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-6-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 603ccef42ce9f07840cf4c0448f3261413460b07 Author: Maxim Levitsky Date: Mon Jun 6 21:08:26 2022 +0300 KVM: x86: SVM: fix avic_kick_target_vcpus_fast There are two issues in avic_kick_target_vcpus_fast 1. It is legal to issue an IPI request with APIC_DEST_NOSHORT and a physical destination of 0xFF (or 0xFFFFFFFF in case of x2apic), which must be treated as a broadcast destination. Fix this by explicitly checking for it. Also don’t use ‘index’ in this case as it gives no new information. 2. It is legal to issue a logical IPI request to more than one target. Index field only provides index in physical id table of first such target and therefore can't be used before we are sure that only a single target was addressed. Instead, parse the ICRL/ICRH, double check that a unicast interrupt was requested, and use that info to figure out the physical id of the target vCPU. At that point there is no need to use the index field as well. In addition to fixing the above issues, also skip the call to kvm_apic_match_dest. It is possible to do this now, because now as long as AVIC is not inhibited, it is guaranteed that none of the vCPUs changed their apic id from its default value. This fixes boot of windows guest with AVIC enabled because it uses IPI with 0xFF destination and no destination shorthand. Fixes: 7223fd2d5338 ("KVM: SVM: Use target APIC ID to complete AVIC IRQs when possible") Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-5-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit f5f9089f76ddc882b915c5d78e4beeb48dcabd1b Author: Maxim Levitsky Date: Mon Jun 6 21:08:25 2022 +0300 KVM: x86: SVM: remove avic's broken code that updated APIC ID AVIC is now inhibited if the guest changes the apic id, and therefore this code is no longer needed. There are several ways this code was broken, including: 1. a vCPU was only allowed to change its apic id to an apic id of an existing vCPU. 2. After such change, the vCPU whose apic id entry was overwritten, could not correctly change its own apic id, because its own entry is already overwritten. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-4-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 3743c2f0251743b8ae968329708bbbeefff244cf Author: Maxim Levitsky Date: Mon Jun 6 21:08:24 2022 +0300 KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base Neither of these settings should be changed by the guest and it is a burden to support it in the acceleration code, so just inhibit this code instead. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-3-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit a9603ae0e4ee6e7de0184801d4abe5925f43b49c Author: Maxim Levitsky Date: Mon Jun 6 21:08:23 2022 +0300 KVM: x86: document AVIC/APICv inhibit reasons These days there are too many AVIC/APICv inhibit reasons, and it doesn't hurt to have some documentation for them. Signed-off-by: Maxim Levitsky Message-Id: <20220606180829.102503-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit d2263de1372a452cb64666990043b8be5c40b2a1 Author: Yuan Yao Date: Wed Jun 8 09:20:15 2022 +0800 KVM: x86/mmu: Set memory encryption "value", not "mask", in shadow PDPTRs Assign shadow_me_value, not shadow_me_mask, to PAE root entries, a.k.a. shadow PDPTRs, when host memory encryption is supported. The "mask" is the set of all possible memory encryption bits, e.g. MKTME KeyIDs, whereas "value" holds the actual value that needs to be stuffed into host page tables. Using shadow_me_mask results in a failed VM-Entry due to setting reserved PA bits in the PDPTRs, and ultimately causes an OOPS due to physical addresses with non-zero MKTME bits sending to_shadow_page() into the weeds: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. BUG: unable to handle page fault for address: ffd43f00063049e8 PGD 86dfd8067 P4D 0 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:mmu_free_root_page+0x3c/0x90 [kvm] kvm_mmu_free_roots+0xd1/0x200 [kvm] __kvm_mmu_unload+0x29/0x70 [kvm] kvm_mmu_unload+0x13/0x20 [kvm] kvm_arch_destroy_vm+0x8a/0x190 [kvm] kvm_put_kvm+0x197/0x2d0 [kvm] kvm_vm_release+0x21/0x30 [kvm] __fput+0x8e/0x260 ____fput+0xe/0x10 task_work_run+0x6f/0xb0 do_exit+0x327/0xa90 do_group_exit+0x35/0xa0 get_signal+0x911/0x930 arch_do_signal_or_restart+0x37/0x720 exit_to_user_mode_prepare+0xb2/0x140 syscall_exit_to_user_mode+0x16/0x30 do_syscall_64+0x4e/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: e54f1ff244ac ("KVM: x86/mmu: Add shadow_me_value and repurpose shadow_me_mask") Signed-off-by: Yuan Yao Reviewed-by: Kai Huang Message-Id: <20220608012015.19566-1-yuan.yao@intel.com> Signed-off-by: Paolo Bonzini commit 76599a4761432a9f0a39f7d64f851b2deb57bdab Merge: 66da65005aa81 bcbfb588cf323 Author: Paolo Bonzini Date: Thu Jun 9 10:32:17 2022 -0400 Merge tag 'kvmarm-fixes-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 5.19, take #1 - Properly reset the SVE/SME flags on vcpu load - Fix a vgic-v2 regression regarding accessing the pending state of a HW interrupt from userspace (and make the code common with vgic-v3) - Fix access to the idreg range for protected guests - Ignore 'kvm-arm.mode=protected' when using VHE - Return an error from kvm_arch_init_vm() on allocation failure - A bunch of small cleanups (comments, annotations, indentation) commit 4527d47bb63a134c4483a1a478d0ff5874b466c7 Author: GONG, Ruiqi Date: Tue Jun 7 19:08:48 2022 +0800 drm/atomic: fix warning of unused variable Fix the `unused-but-set-variable` warning as how other iteration wrappers do. Link: https://lore.kernel.org/all/202206071049.pofHsRih-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: GONG, Ruiqi Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220607110848.941486-1-gongruiqi1@huawei.com commit 66da65005aa819e0b8d3a08f5ec1491b7690cb67 Merge: 6cd88243c7e03 1a12b25274b9e Author: Paolo Bonzini Date: Thu Jun 9 09:45:00 2022 -0400 Merge tag 'kvm-riscv-fixes-5.19-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 5.19, take #1 - Typo fix in arch/riscv/kvm/vmid.c - Remove broken reference pattern from MAINTAINERS entry commit 8e1278444446fc97778a5e5c99bca1ce0bbc5ec9 Author: Michael Ellerman Date: Tue Jun 7 00:34:56 2022 +1000 powerpc/32: Fix overread/overwrite of thread_struct via ptrace The ptrace PEEKUSR/POKEUSR (aka PEEKUSER/POKEUSER) API allows a process to read/write registers of another process. To get/set a register, the API takes an index into an imaginary address space called the "USER area", where the registers of the process are laid out in some fashion. The kernel then maps that index to a particular register in its own data structures and gets/sets the value. The API only allows a single machine-word to be read/written at a time. So 4 bytes on 32-bit kernels and 8 bytes on 64-bit kernels. The way floating point registers (FPRs) are addressed is somewhat complicated, because double precision float values are 64-bit even on 32-bit CPUs. That means on 32-bit kernels each FPR occupies two word-sized locations in the USER area. On 64-bit kernels each FPR occupies one word-sized location in the USER area. Internally the kernel stores the FPRs in an array of u64s, or if VSX is enabled, an array of pairs of u64s where one half of each pair stores the FPR. Which half of the pair stores the FPR depends on the kernel's endianness. To handle the different layouts of the FPRs depending on VSX/no-VSX and big/little endian, the TS_FPR() macro was introduced. Unfortunately the TS_FPR() macro does not take into account the fact that the addressing of each FPR differs between 32-bit and 64-bit kernels. It just takes the index into the "USER area" passed from userspace and indexes into the fp_state.fpr array. On 32-bit there are 64 indexes that address FPRs, but only 32 entries in the fp_state.fpr array, meaning the user can read/write 256 bytes past the end of the array. Because the fp_state sits in the middle of the thread_struct there are various fields than can be overwritten, including some pointers. As such it may be exploitable. It has also been observed to cause systems to hang or otherwise misbehave when using gdbserver, and is probably the root cause of this report which could not be easily reproduced: https://lore.kernel.org/linuxppc-dev/dc38afe9-6b78-f3f5-666b-986939e40fc6@keymile.com/ Rather than trying to make the TS_FPR() macro even more complicated to fix the bug, or add more macros, instead add a special-case for 32-bit kernels. This is more obvious and hopefully avoids a similar bug happening again in future. Note that because 32-bit kernels never have VSX enabled the code doesn't need to consider TS_FPRWIDTH/OFFSET at all. Add a BUILD_BUG_ON() to ensure that 32-bit && VSX is never enabled. Fixes: 87fec0514f61 ("powerpc: PTRACE_PEEKUSR/PTRACE_POKEUSER of FPR registers in little endian builds") Cc: stable@vger.kernel.org # v3.13+ Reported-by: Ariel Miculas Tested-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220609133245.573565-1-mpe@ellerman.id.au commit 2c5947cffd81ac8181346efacdca3c777ab330ba Author: Christian Lamparter Date: Tue Jun 7 20:59:18 2022 +0200 Revert "mtd: rawnand: add support for Toshiba TC58NVG0S3HTA00 NAND flash" This reverts commit 3380557fc7e28d9bce7607e16d98f123d36da4ca. It turned out this "4-byte" ID might have been an honest mistake. Regrettably, the chip Andreas has might be a counterfeit or is damaged in some other way and shouldn't have ended up in a router. Andreas reported his chip is returning just four bytes: "98 f1 80 15 00 00 00 00". However, according to Kioxia/Toshiba's datasheet, there should have been at least another byte that would have contained the correct OOB size that Andreas needed. Miquel and Andreas are both favoring reverting the patch over further, possibly hacky modifications: "[Reverting] is the safest option here. Apart from this device, we do not know how many devices have these damaged/counterfeit chips. If it is just a couple and only on Fritzboxes, as suggested in the Github issue the patch could be carried through OpenWrt[...]" Thanks to several users on the openwrt forum and github issue, who stayed along for the ride: - Peter-vdL for reporting the issue and testing patches. - neg2led and Hannu Nyman who did all the datasheet digging and debugging. Cc: Andreas Boehler Suggested-by: Andreas Boehler Suggested-by: Miquel Raynal Link: https://github.com/openwrt/openwrt/issues/9962 Signed-off-by: Christian Lamparter Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220607185918.1048204-1-chunkeey@gmail.com commit 158f7585bfcea4aae0ad4128d032a80fec550df1 Author: Slark Xiao Date: Wed Jun 1 11:47:40 2022 +0800 USB: serial: option: add support for Cinterion MV31 with new baseline Adding support for Cinterion device MV31 with Qualcomm new baseline. Use different PIDs to separate it from previous base line products. All interfaces settings keep same as previous. Below is test evidence: T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00b8 Rev=04.14 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00B8 USB Mobile Broadband S: SerialNumber=90418e79 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00b9 Rev=04.14 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00B9 USB Mobile Broadband S: SerialNumber=90418e79 C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option For PID 00b8, interface 3 is GNSS port which don't use serial driver. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220601034740.5438-1-slark_xiao@163.com [ johan: rename defines using a "2" infix ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 204e6ceaa1035cb7b92b156517e88842ebb4c7ff Author: Sungjong Seo Date: Wed Jun 8 00:05:21 2022 +0900 exfat: use updated exfat_chain directly during renaming In order for a file to access its own directory entry set, exfat_inode_info(ei) has two copied values. One is ei->dir, which is a snapshot of exfat_chain of the parent directory, and the other is ei->entry, which is the offset of the start of the directory entry set in the parent directory. Since the parent directory can be updated after the snapshot point, it should be used only for accessing one's own directory entry set. However, as of now, during renaming, it could try to traverse or to allocate clusters via snapshot values, it does not make sense. This potential problem has been revealed when exfat_update_parent_info() was removed by commit d8dad2588add ("exfat: fix referencing wrong parent directory information after renaming"). However, I don't think it's good idea to bring exfat_update_parent_info() back. Instead, let's use the updated exfat_chain of parent directory diectly. Fixes: d8dad2588add ("exfat: fix referencing wrong parent directory information after renaming") Reported-by: Wang Yugui Signed-off-by: Sungjong Seo Tested-by: Wang Yugui Signed-off-by: Namjae Jeon commit bcbfb588cf323929ac46767dd14e392016bbce04 Author: Marc Zyngier Date: Thu Jun 9 13:12:23 2022 +0100 KVM: arm64: Drop stale comment The layout of 'struct kvm_vcpu_arch' has evolved significantly since the initial port of KVM/arm64, so remove the stale comment suggesting that a prefix of the structure is used exclusively from assembly code. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-7-will@kernel.org commit 5879c97f37022ff22a3f13174c24fcf2807fdbc0 Author: Will Deacon Date: Thu Jun 9 13:12:22 2022 +0100 KVM: arm64: Remove redundant hyp_assert_lock_held() assertions host_stage2_try() asserts that the KVM host lock is held, so there's no need to duplicate the assertion in its wrappers. Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-6-will@kernel.org commit 112f3bab41113dc53b4f35e9034b2208245bc002 Author: Will Deacon Date: Thu Jun 9 13:12:21 2022 +0100 KVM: arm64: Extend comment in has_vhe() has_vhe() expands to a compile-time constant when evaluated from the VHE or nVHE code, alternatively checking a static key when called from elsewhere in the kernel. On face value, this looks like a case of premature optimization, but in fact this allows symbol references on VHE-specific code paths to be dropped from the nVHE object. Expand the comment in has_vhe() to make this clearer, hopefully discouraging anybody from simplifying the code. Cc: David Brazdil Acked-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-5-will@kernel.org commit cde5042adf11b0a30a6ce0ec3d071afcf8d2efaf Author: Will Deacon Date: Thu Jun 9 13:12:20 2022 +0100 KVM: arm64: Ignore 'kvm-arm.mode=protected' when using VHE Ignore 'kvm-arm.mode=protected' when using VHE so that kvm_get_mode() only returns KVM_MODE_PROTECTED on systems where the feature is available. Cc: David Brazdil Acked-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-4-will@kernel.org commit fa7a17214488ef7df347dcd1a5594f69ea17f4dc Author: Marc Zyngier Date: Thu Jun 9 13:12:19 2022 +0100 KVM: arm64: Handle all ID registers trapped for a protected VM A protected VM accessing ID_AA64ISAR2_EL1 gets punished with an UNDEF, while it really should only get a zero back if the register is not handled by the hypervisor emulation (as mandated by the architecture). Introduce all the missing ID registers (including the unallocated ones), and have them to return 0. Reported-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-3-will@kernel.org commit ae187fec75aa670a551d9662f83e3947d3f02a69 Author: Will Deacon Date: Thu Jun 9 13:12:18 2022 +0100 KVM: arm64: Return error from kvm_arch_init_vm() on allocation failure If we fail to allocate the 'supported_cpus' cpumask in kvm_arch_init_vm() then be sure to return -ENOMEM instead of success (0) on the failure path. Reviewed-by: Alexandru Elisei Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220609121223.2551-2-will@kernel.org commit 908e698f2149c3d6a67d9ae15c75545a3f392559 Author: Robert Eckelmann Date: Sat May 21 23:08:08 2022 +0900 USB: serial: io_ti: add Agilent E5805A support Add support for Agilent E5805A (rebranded ION Edgeport/4) to io_ti. Signed-off-by: Robert Eckelmann Link: https://lore.kernel.org/r/20220521230808.30931eca@octoberrain Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit b6c8cd80ace30f308aeec0ecf946f55dec60cc68 Author: Guenter Roeck Date: Fri Jun 3 06:14:19 2022 -0700 watchdog: gxp: Add missing MODULE_LICENSE The build system says: ERROR: modpost: missing MODULE_LICENSE() in drivers/watchdog/gxp-wdt.o Add the missing MODULE_LICENSE. Signed-off-by: Nick Hawkins Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/all/20220603131419.2948578-1-linux@roeck-us.net/ Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7219b824e3bc56f9cf074c1929009c0c8690d899 Merge: f2906aa863381 b93a8b2c51616 Author: Bartosz Golaszewski Date: Thu Jun 9 11:07:54 2022 +0200 Merge tag 'intel-gpio-v5.19-2' of gitolite.kernel.org:pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio for v5.19-2 * Convert IRQ chips in Diolan and Intel GPIO drivers to be immutable commit 477277c7fd43d48ae68cbdcaa7c0f82024a87421 Author: Thomas Zimmermann Date: Tue Jun 7 11:20:04 2022 +0200 drm/ast: Support multiple outputs Systems with AST graphics can have multiple output; typically VGA plus some other port. Record detected output chips in a bitmask and initialize each output on its own. Assume a VGA output by default and use SIL164 and DP501 if available. For ASTDP assume that it can run in parallel with VGA. Tested on AST2100. v3: * define a macro for each BIT(ast_tx_chip) (Patrik) v2: * make VGA/SIL164/DP501 mutually exclusive Signed-off-by: Thomas Zimmermann Reviewed-by: Patrik Jakobsson Fixes: a59b026419f3 ("drm/ast: Initialize encoder and connector for VGA in helper function") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20220607092008.22123-2-tzimmermann@suse.de (cherry picked from commit 7f35680ada234ce00828b8ea841ba7ca1e00ff52) Signed-off-by: Thomas Zimmermann commit 0a178750647e47de1700edb2cbd9b0854122f4b9 Merge: f2906aa863381 431d071286524 Author: Dave Airlie Date: Thu Jun 9 17:22:48 2022 +1000 Merge tag 'amd-drm-fixes-5.19-2022-06-08' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.19-2022-06-08: amdgpu: - DCN 3.1 golden settings fix - eDP fixes - DMCUB fixes - GFX11 fixes and cleanups - VCN fix for yellow carp - GMC11 fixes - RAS fixes - GPUVM TLB flush fixes - SMU13 fixes - VCN3 AV1 regression fix - VCN2 JPEG fix - Other misc fixes amdkfd: - MMU notifier fix - Support for more GC 10.3.x families - Pinned BO handling fix - Partial migration bug fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220608203008.6187-1-alexander.deucher@amd.com commit a7cd3cf0b2e5aaacfe5e02c472bd28e98e640be7 Author: Peter Robinson Date: Mon Jun 6 17:10:34 2022 +0100 dmaengine: imx-sdma: Allow imx8m for imx7 FW revs The revision of the imx-sdma IP that is in the i.MX8M series is the same is that as that in the i.MX7 series but the imx7d MODULE_FIRMWARE directive is wrapped in a condiditional which means it's not defined when built for aarch64 SOC_IMX8M platforms and hence you get the following errors when the driver loads on imx8m devices: imx-sdma 302c0000.dma-controller: Direct firmware load for imx/sdma/sdma-imx7d.bin failed with error -2 imx-sdma 302c0000.dma-controller: external firmware not found, using ROM firmware Add the SOC_IMX8M into the check so the firmware can load on i.MX8. Fixes: 1474d48bd639 ("arm64: dts: imx8mq: Add SDMA nodes") Fixes: 941acd566b18 ("dmaengine: imx-sdma: Only check ratio on parts that support 1:1") Signed-off-by: Peter Robinson Cc: stable@vger.kernel.org # v5.2+ Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/20220606161034.3544803-1-pbrobinson@gmail.com Signed-off-by: Vinod Koul commit 646728dff254f8070da5d2f82494a065d4287e26 Author: Vinod Koul Date: Mon Jun 6 23:19:06 2022 +0530 dmaengine: Revert "dmaengine: add verification of DMA_INTERRUPT capability for dmatest" This reverts commit a8facc7b9885 ("dmaengine: add verification of DMA_INTERRUPT capability for dmatest") as it causes regression due to the fact that DMA_INTERRUPT in linked to dma_prep_interrupt() so checking that is incorrect here Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20220606174906.3979283-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 615a4bfc426e11dba05c2cf343f9ac752fb381d2 Author: Miaoqian Lin Date: Sun Jun 5 08:27:22 2022 +0400 dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate of_find_device_by_node() takes reference, we should use put_device() to release it when not need anymore. Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") Signed-off-by: Miaoqian Lin Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20220605042723.17668-1-linmq006@gmail.com Signed-off-by: Vinod Koul commit c132fe78ad7b4ce8b5d49a501a15c29d08eeb23a Author: Miaoqian Lin Date: Sun Jun 5 08:27:23 2022 +0400 dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() in to fix this. Fixes: ec9bfa1e1a79 ("dmaengine: ti-dma-crossbar: dra7: Use bitops instead of idr") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220605042723.17668-2-linmq006@gmail.com Signed-off-by: Vinod Koul commit 00d1f546470d89e072dd3cda12b5c794341e7268 Author: Jason Wang Date: Thu Jun 9 12:19:01 2022 +0800 vdpa: make get_vq_group and set_group_asid optional This patch makes get_vq_group and set_group_asid optional. This is needed to unbreak the vDPA parent that doesn't support multiple address spaces. Cc: Gautam Dawar Fixes: aaca8373c4b1 ("vhost-vdpa: support ASID based IOTLB API") Signed-off-by: Jason Wang Message-Id: <20220609041901.2029-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit acb0055e187334554398a381a16de72f1a3d47bb Author: Bo Liu Date: Wed Jun 8 23:11:06 2022 -0400 virtio: Fix all occurences of the "the the" typo There are double "the" in message in file virtio_mmio.c and virtio_pci_modern_dev.c, fix it. Signed-off-by: Bo Liu Message-Id: <20220609031106.2161-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin commit 647df0d41b6bd8f4987dde6e8d8d0aba5b082985 Author: Justin Stitt Date: Tue Jun 7 12:11:19 2022 -0700 net: amd-xgbe: fix clang -Wformat warning see warning: | drivers/net/ethernet/amd/xgbe/xgbe-drv.c:2787:43: warning: format specifies | type 'unsigned short' but the argument has type 'int' [-Wformat] | netdev_dbg(netdev, "Protocol: %#06hx\n", ntohs(eth->h_proto)); | ~~~~~~ ^~~~~~~~~~~~~~~~~~~ Variadic functions (printf-like) undergo default argument promotion. Documentation/core-api/printk-formats.rst specifically recommends using the promoted-to-type's format flag. Also, as per C11 6.3.1.1: (https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf) `If an int can represent all values of the original type ..., the value is converted to an int; otherwise, it is converted to an unsigned int. These are called the integer promotions.` Since the argument is a u16 it will get promoted to an int and thus it is most accurate to use the %x format specifier here. It should be noted that the `#06` formatting sugar does not alter the promotion rules. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Justin Stitt Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20220607191119.20686-1-jstitt007@gmail.com Signed-off-by: Jakub Kicinski commit e67b72b90b7e19a4be4d9c29f3feea6f58ab43f8 Author: Muchun Song Date: Tue Jun 7 15:02:14 2022 +0800 tcp: use alloc_large_system_hash() to allocate table_perturb In our server, there may be no high order (>= 6) memory since we reserve lots of HugeTLB pages when booting. Then the system panic. So use alloc_large_system_hash() to allocate table_perturb. Fixes: e9261476184b ("tcp: dynamically allocate the perturb table used by source ports") Signed-off-by: Muchun Song Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220607070214.94443-1-songmuchun@bytedance.com Signed-off-by: Jakub Kicinski commit 487994ff75880569d32504d7e70da8b3328e0693 Author: Alvin Šipraga Date: Tue Jun 7 20:46:24 2022 +0200 net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY Since commit a18e6521a7d9 ("net: phylink: handle NA interface mode in phylink_fwnode_phy_connect()"), phylib defaults to GMII when no phy-mode or phy-connection-type property is specified in a DSA port node of the device tree. The same commit caused a regression in rtl8365mb whereby phylink would fail to connect, because the driver did not advertise support for GMII for ports with internal PHY. It should be noted that the aforementioned regression is not because the blamed commit was incorrect: on the contrary, the blamed commit is correcting the previous behaviour whereby unspecified phy-mode would cause the internal interface mode to be PHY_INTERFACE_MODE_NA. The rtl8365mb driver only worked by accident before because it _did_ advertise support for PHY_INTERFACE_MODE_NA, despite NA being reserved for internal use by phylink. With one mistake fixed, the other was exposed. Commit a5dba0f207e5 ("net: dsa: rtl8365mb: add GMII as user port mode") then introduced implicit support for GMII mode on ports with internal PHY to allow a PHY connection for device trees where the phy-mode is not explicitly set to "internal". At this point everything was working OK again. Subsequently, commit 6ff6064605e9 ("net: dsa: realtek: convert to phylink_generic_validate()") broke this behaviour again by discarding the usage of rtl8365mb_phy_mode_supported() - where this GMII support was indicated - while switching to the new .phylink_get_caps API. With the new API, rtl8365mb_phy_mode_supported() is no longer needed. Remove it altogether and add back the GMII capability - this time to rtl8365mb_phylink_get_caps() - so that the above default behaviour works for ports with internal PHY again. Fixes: 6ff6064605e9 ("net: dsa: realtek: convert to phylink_generic_validate()") Signed-off-by: Alvin Šipraga Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20220607184624.417641-1-alvin@pqrs.dk Signed-off-by: Jakub Kicinski commit 568a32f5653d3131374057589c2627b330d3a177 Merge: 5d4af9c1f04ab 7bb0fb7c63df9 Author: Jakub Kicinski Date: Wed Jun 8 21:02:22 2022 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-06-07 This series contains updates to ixgbe driver only. Olivier Matz resolves an issue so that broadcast packets can still be received when VF removes promiscuous settings and removes setting of VLAN promiscuous, in promiscuous mode, to prevent a loop when VFs are bridged. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: fix unexpected VLAN Rx in promisc mode on VF ixgbe: fix bcast packets Rx on VF after promisc removal ==================== Link: https://lore.kernel.org/r/20220607181538.748786-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5d4af9c1f04ab0411ba5818baad9a68e87f33099 Merge: 11ec18b1d8d92 b4d78731b34bd Author: Jakub Kicinski Date: Wed Jun 8 20:58:32 2022 -0700 Merge branch 'mv88e6xxx-fixes-for-reading-serdes-state' Russell King says: ==================== mv88e6xxx: fixes for reading serdes state These are some low-priority fixes to the mv88e6xxx serdes code. Patch 1 fixes the reporting of an_complete, which is used in the emulation of a conventional C22 PHY. Patch from Marek. Patch 2 makes one of the error messages in patch 2 to be consistent with the other error messages in this function. Patch 3 ensures that we do not miss a link-failure event. ==================== Link: https://lore.kernel.org/r/Yp82TyoLon9jz6k3@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b4d78731b34bd6bfd1bfedce26a55e3582b0bc14 Author: Russell King (Oracle) Date: Tue Jun 7 12:28:52 2022 +0100 net: dsa: mv88e6xxx: correctly report serdes link failure Phylink wants to know if the link has dropped since the last time state was retrieved, and the BMSR gives us that. Read the BMSR and use it when deciding the link state. Fill in the an_complete member as well for the emulated PHY state. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 2b4bb9cd9bcdbe1f791fec18a7c8728cb6989bf8 Author: Russell King (Oracle) Date: Tue Jun 7 12:28:47 2022 +0100 net: dsa: mv88e6xxx: fix BMSR error to be consistent with others Other errors accessing the registers in mv88e6352_serdes_pcs_get_state() print "PHY " before the register name, except for the BMSR. Make this consistent with the other error messages. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 47e96930d6e6106d5252e85b868d3c7e29296de0 Author: Marek Behún Date: Tue Jun 7 12:28:42 2022 +0100 net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete Commit ede359d8843a ("net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed") added the ability to link if AN was bypassed, and added filling of state->an_complete field, but set it to true if AN was enabled in BMCR, not when AN was reported complete in BMSR. This was done because for some reason, when I wanted to use BMSR value to infer an_complete, I was looking at BMSR_ANEGCAPABLE bit (which was always 1), instead of BMSR_ANEGCOMPLETE bit. Use BMSR_ANEGCOMPLETE for filling state->an_complete. Fixes: ede359d8843a ("net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed") Signed-off-by: Marek Behún Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 11ec18b1d8d92b9df307d31950dcba0b3dd7283c Author: Miaoqian Lin Date: Tue Jun 7 08:11:43 2022 +0400 net: altera: Fix refcount leak in altera_tse_mdio_create Every iteration of for_each_child_of_node() decrements the reference count of the previous node. When break from a for_each_child_of_node() loop, we need to explicitly call of_node_put() on the child node when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220607041144.7553-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit 2061ecfdf2350994e5b61c43e50e98a7a70e95ee Author: Ilya Maximets Date: Tue Jun 7 00:11:40 2022 +0200 net: openvswitch: fix misuse of the cached connection on tuple changes If packet headers changed, the cached nfct is no longer relevant for the packet and attempt to re-use it leads to the incorrect packet classification. This issue is causing broken connectivity in OpenStack deployments with OVS/OVN due to hairpin traffic being unexpectedly dropped. The setup has datapath flows with several conntrack actions and tuple changes between them: actions:ct(commit,zone=8,mark=0/0x1,nat(src)), set(eth(src=00:00:00:00:00:01,dst=00:00:00:00:00:06)), set(ipv4(src=172.18.2.10,dst=192.168.100.6,ttl=62)), ct(zone=8),recirc(0x4) After the first ct() action the packet headers are almost fully re-written. The next ct() tries to re-use the existing nfct entry and marks the packet as invalid, so it gets dropped later in the pipeline. Clearing the cached conntrack entry whenever packet tuple is changed to avoid the issue. The flow key should not be cleared though, because we should still be able to match on the ct_state if the recirculation happens after the tuple change but before the next ct() action. Cc: stable@vger.kernel.org Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") Reported-by: Frode Nordahl Link: https://mail.openvswitch.org/pipermail/ovs-discuss/2022-May/051829.html Link: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1967856 Signed-off-by: Ilya Maximets Link: https://lore.kernel.org/r/20220606221140.488984-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 1a12b25274b9e54b0d2d59e21620f8cf13b268cb Author: Lukas Bulwahn Date: Thu Jun 9 09:18:22 2022 +0530 MAINTAINERS: Limit KVM RISC-V entry to existing selftests Commit fed9b26b2501 ("MAINTAINERS: Update KVM RISC-V entry to cover selftests support") optimistically adds a file entry for tools/testing/selftests/kvm/riscv/, but this directory does not exist. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. The script is very useful to keep MAINTAINERS up to date and MAINTAINERS can be kept in a state where the script emits no warning. So, just drop the non-matching file entry rather than starting to collect exceptions of entries that may match in some close or distant future. Fixes: fed9b26b2501 ("MAINTAINERS: Update KVM RISC-V entry to cover selftests support") Signed-off-by: Lukas Bulwahn Signed-off-by: Anup Patel commit ea6c1213217dec65a8f9f396752b4d8bbcf226ea Author: Julia Lawall Date: Thu Jun 9 09:18:15 2022 +0530 RISC-V: KVM: fix typos in comments Various spelling mistakes in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Anup Patel commit 2f2c0d2919a14002760f89f4e02960c735a316d2 Author: Chen Lin Date: Wed Jun 8 20:46:53 2022 +0800 net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag When rx_flag == MTK_RX_FLAGS_HWLRO, rx_data_len = MTK_MAX_LRO_RX_LENGTH(4096 * 3) > PAGE_SIZE. netdev_alloc_frag is for alloction of page fragment only. Reference to other drivers and Documentation/vm/page_frags.rst Branch to use __get_free_pages when ring->frag_size > PAGE_SIZE. Signed-off-by: Chen Lin Link: https://lore.kernel.org/r/1654692413-2598-1-git-send-email-chen45464546@163.com Signed-off-by: Jakub Kicinski commit 8d21e9963bec1aad2280cdd034c8993033ef2948 Author: Willem de Bruijn Date: Mon Jun 6 09:21:07 2022 -0400 ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL; This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward if (csum && skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) return -EINVAL; But was eventually revised more thoroughly: - restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull. - test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath. Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection. Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured. Link: https://lore.kernel.org/netdev/YS+h%2FtqCJJiQei+W@shredder/ Link: https://lore.kernel.org/all/20210902193447.94039-2-willemdebruijn.kernel@gmail.com/T/#u Fixes: 8a0ed250f911 ("ip_gre: validate csum_start only on pull") Reported-by: syzbot Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20220606132107.3582565-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit d5d4c36398ba66c033602b117b4be6174b7b8533 Merge: a6958951ebe7d 7c217aca85dd3 Author: Jakub Kicinski Date: Wed Jun 8 20:31:21 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2022-06-09 We've added 6 non-merge commits during the last 2 day(s) which contain a total of 8 files changed, 49 insertions(+), 15 deletions(-). The main changes are: 1) Fix an illegal copy_to_user() attempt seen by syzkaller through arm64 BPF JIT compiler, from Eric Dumazet. 2) Fix calling global functions from BPF_PROG_TYPE_EXT programs by using the correct program context type, from Toke Høiland-Jørgensen. 3) Fix XSK TX batching invalid descriptor handling, from Maciej Fijalkowski. 4) Fix potential integer overflows in multi-kprobe link code by using safer kvmalloc_array() allocation helpers, from Dan Carpenter. 5) Add Quentin as bpftool maintainer, from Quentin Monnet. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: MAINTAINERS: Add a maintainer for bpftool xsk: Fix handling of invalid descriptors in XSK TX batching API selftests/bpf: Add selftest for calling global functions from freplace bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs bpf: Use safer kvmalloc_array() where possible bpf, arm64: Clear prog->jited_len along prog->jited ==================== Link: https://lore.kernel.org/r/20220608234133.32265-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 481f7017c37a8c722a0b09985db1a35f15749d5d Author: Sergey Shtylyov Date: Wed Jun 8 23:37:09 2022 +0300 MAINTAINERS: add ATA sysfs file documentation to libata entry Add the (still missing!) ATA sysfs file documentation to the libata subsystem entry in the MAINTAINERS file. Signed-off-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit 72aad489f992871e908ff6d9055b26c6366fb864 Author: Sergey Shtylyov Date: Wed Jun 8 22:51:07 2022 +0300 ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files The {dma|pio}_mode sysfs files are incorrectly documented as having a list of the supported DMA/PIO transfer modes, while the corresponding fields of the *struct* ata_device hold the transfer mode IDs, not masks. To match these docs, the {dma|pio}_mode (and even xfer_mode!) sysfs files are handled by the ata_bitfield_name_match() macro which leads to reading such kind of nonsense from them: $ cat /sys/class/ata_device/dev3.0/pio_mode XFER_UDMA_7, XFER_UDMA_6, XFER_UDMA_5, XFER_UDMA_4, XFER_MW_DMA_4, XFER_PIO_6, XFER_PIO_5, XFER_PIO_4, XFER_PIO_3, XFER_PIO_2, XFER_PIO_1, XFER_PIO_0 Using the correct ata_bitfield_name_search() macro fixes that: $ cat /sys/class/ata_device/dev3.0/pio_mode XFER_PIO_4 While fixing the file documentation, somewhat reword the {dma|pio}_mode file doc and add a note about being mostly useful for PATA devices to the xfer_mode file doc... Fixes: d9027470b886 ("[libata] Add ATA transport class") Signed-off-by: Sergey Shtylyov Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal commit 6bfb56e93bcef41859c2d5ab234ffd80b691be35 Author: Linus Torvalds Date: Wed Jun 8 13:18:39 2022 -0700 cert host tools: Stop complaining about deprecated OpenSSL functions OpenSSL 3.0 deprecated the OpenSSL's ENGINE API. That is as may be, but the kernel build host tools still use it. Disable the warning about deprecated declarations until somebody who cares fixes it. Signed-off-by: Linus Torvalds commit 6ba12b56b9b844b83ed54fb7ed59fb0eb41e4045 Author: Jiasheng Jiang Date: Thu May 26 17:41:00 2022 +0800 i2c: npcm7xx: Add check for platform_driver_register As platform_driver_register() could fail, it should be better to deal with the return value in order to maintain the code consisitency. Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver") Signed-off-by: Jiasheng Jiang Acked-by: Tali Perry Signed-off-by: Wolfram Sang commit 8c4811e7a5a60443139369a623ca504bad9e3675 Author: Andy Shevchenko Date: Mon May 30 15:02:47 2022 +0300 MAINTAINERS: Update Synopsys DesignWare I2C to Supported The actual status of the code is Supported (from x86 perspective). Reported-by: dave.hansen@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Jarkko Nikula [wsa: fixed "DesignWare" spelling] Signed-off-by: Wolfram Sang commit 431d071286524bd4f9ba2e46b1be87b479220174 Author: Yifan Zhang Date: Fri Jun 3 10:24:31 2022 +0800 drm/amdgpu/mes: only invalid/prime icache when finish loading both pipe MES FWs. invalid/prime icahce operation takes effect both pipes cuconrrently, therefore CP_MES_IC_BASE_LO/HI and CP_MES_MDBASE_LO/HI both have to be set before prime icache. Otherwise MES hardware gets garbage data in above regsters and causes page fault [ 470.873200] amdgpu 0000:33:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:217 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 470.873222] amdgpu 0000:33:00.0: amdgpu: in page starting at address 0x000092cb89b00000 from client 10 [ 470.873234] amdgpu 0000:33:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00000BB3 [ 470.873242] amdgpu 0000:33:00.0: amdgpu: Faulty UTCL2 client ID: CPC (0x5) [ 470.873247] amdgpu 0000:33:00.0: amdgpu: MORE_FAULTS: 0x1 [ 470.873251] amdgpu 0000:33:00.0: amdgpu: WALKER_ERROR: 0x1 [ 470.873256] amdgpu 0000:33:00.0: amdgpu: PERMISSION_FAULTS: 0xb [ 470.873260] amdgpu 0000:33:00.0: amdgpu: MAPPING_ERROR: 0x1 [ 470.873264] amdgpu 0000:33:00.0: amdgpu: RW: 0x0 Signed-off-by: Yifan Zhang Acked-by: Alex Deucher Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 8fa5e7b20e01042b14f8cd684d2da9b638460c74 Author: Mark Bloch Date: Mon May 30 10:46:59 2022 +0300 net/mlx5: fs, fail conflicting actions When combining two steering rules into one check not only do they share the same actions but those actions are also the same. This resolves an issue where when creating two different rules with the same match the actions are overwritten and one of the rules is deleted a FW syndrome can be seen in dmesg. mlx5_core 0000:03:00.0: mlx5_cmd_check:819:(pid 2105): DEALLOC_MODIFY_HEADER_CONTEXT(0x941) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0x1ab444) Fixes: 0d235c3fabb7 ("net/mlx5: Add hash table to search FTEs in a flow-group") Signed-off-by: Mark Bloch Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 8bf94e6414c9481bfa28269022688ab445d0081d Author: Feras Daoud Date: Sat Mar 19 21:47:48 2022 +0200 net/mlx5: Rearm the FW tracer after each tracer event The current design does not arm the tracer if traces are available before the tracer string database is fully loaded, leading to an unfunctional tracer. This fix will rearm the tracer every time the FW triggers tracer event regardless of the tracer strings database status. Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling") Signed-off-by: Feras Daoud Signed-off-by: Roy Novich Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 3008e6a0049361e731b803c60fe8f3ab44e1d73f Author: Mark Bloch Date: Thu May 26 08:15:28 2022 +0300 net/mlx5: E-Switch, pair only capable devices OFFLOADS paring using devcom is possible only on devices that support LAG. Filter based on lag capabilities. This fixes an issue where mlx5_get_next_phys_dev() was called without holding the interface lock. This issue was found when commit bc4c2f2e0179 ("net/mlx5: Lag, filter non compatible devices") added an assert that verifies the interface lock is held. WARNING: CPU: 9 PID: 1706 at drivers/net/ethernet/mellanox/mlx5/core/dev.c:642 mlx5_get_next_phys_dev+0xd2/0x100 [mlx5_core] Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm ib_uverbs ib_core overlay fuse [last unloaded: mlx5_core] CPU: 9 PID: 1706 Comm: devlink Not tainted 5.18.0-rc7+ #11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_get_next_phys_dev+0xd2/0x100 [mlx5_core] Code: 02 00 75 48 48 8b 85 80 04 00 00 5d c3 31 c0 5d c3 be ff ff ff ff 48 c7 c7 08 41 5b a0 e8 36 87 28 e3 85 c0 0f 85 6f ff ff ff <0f> 0b e9 68 ff ff ff 48 c7 c7 0c 91 cc 84 e8 cb 36 6f e1 e9 4d ff RSP: 0018:ffff88811bf47458 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88811b398000 RCX: 0000000000000001 RDX: 0000000080000000 RSI: ffffffffa05b4108 RDI: ffff88812daaaa78 RBP: ffff88812d050380 R08: 0000000000000001 R09: ffff88811d6b3437 R10: 0000000000000001 R11: 00000000fddd3581 R12: ffff88815238c000 R13: ffff88812d050380 R14: ffff8881018aa7e0 R15: ffff88811d6b3428 FS: 00007fc82e18ae80(0000) GS:ffff88842e080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9630d1b421 CR3: 0000000149802004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_esw_offloads_devcom_event+0x99/0x3b0 [mlx5_core] mlx5_devcom_send_event+0x167/0x1d0 [mlx5_core] esw_offloads_enable+0x1153/0x1500 [mlx5_core] ? mlx5_esw_offloads_controller_valid+0x170/0x170 [mlx5_core] ? wait_for_completion_io_timeout+0x20/0x20 ? mlx5_rescan_drivers_locked+0x318/0x810 [mlx5_core] mlx5_eswitch_enable_locked+0x586/0xc50 [mlx5_core] ? mlx5_eswitch_disable_pf_vf_vports+0x1d0/0x1d0 [mlx5_core] ? mlx5_esw_try_lock+0x1b/0xb0 [mlx5_core] ? mlx5_eswitch_enable+0x270/0x270 [mlx5_core] ? __debugfs_create_file+0x260/0x3e0 mlx5_devlink_eswitch_mode_set+0x27e/0x870 [mlx5_core] ? mutex_lock_io_nested+0x12c0/0x12c0 ? esw_offloads_disable+0x250/0x250 [mlx5_core] ? devlink_nl_cmd_trap_get_dumpit+0x470/0x470 ? rcu_read_lock_sched_held+0x3f/0x70 devlink_nl_cmd_eswitch_set_doit+0x217/0x620 Fixes: dd3fddb82780 ("net/mlx5: E-Switch, handle devcom events only for ports on the same device") Signed-off-by: Mark Bloch Reviewed-by: Roi Dayan Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 15ef9efa855cf405fadd78272e1e5d04e09a1cf3 Author: Paul Blakey Date: Tue Mar 29 18:37:18 2022 +0300 net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules CT cleanup assumes that all tc rules were deleted first, and so is free to delete the CT shared resources (e.g the dr_action fwd_action which is shared for all tuples). But currently for uplink, this is happens in reverse, causing the below trace. CT cleanup is called from: mlx5e_cleanup_rep_tx()->mlx5e_cleanup_uplink_rep_tx()-> mlx5e_rep_tc_cleanup()->mlx5e_tc_esw_cleanup()-> mlx5_tc_ct_clean() Only afterwards, tc cleanup is called from: mlx5e_cleanup_rep_tx()->mlx5e_tc_ht_cleanup() which would have deleted all the tc ct rules, and so delete all the offloaded tuples. Fix this reversing the order of init and on cleanup, which will result in tc cleanup then ct cleanup. [ 9443.593347] WARNING: CPU: 2 PID: 206774 at drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c:1882 mlx5dr_action_destroy+0x188/0x1a0 [mlx5_core] [ 9443.593349] Modules linked in: act_ct nf_flow_table rdma_ucm(O) rdma_cm(O) iw_cm(O) ib_ipoib(O) ib_cm(O) ib_umad(O) mlx5_core(O-) mlxfw(O) mlxdevm(O) auxiliary(O) ib_uverbs(O) psample ib_core(O) mlx_compat(O) ip_gre gre ip_tunnel act_vlan bonding geneve esp6_offload esp6 esp4_offload esp4 act_tunnel_key vxlan ip6_udp_tunnel udp_tunnel act_mirred act_skbedit act_gact cls_flower sch_ingress nfnetlink_cttimeout nfnetlink xfrm_user xfrm_algo 8021q garp stp ipmi_devintf mrp ipmi_msghandler llc openvswitch nsh nf_conncount nf_nat mst_pciconf(O) dm_multipath sbsa_gwdt uio_pdrv_genirq uio mlxbf_pmc mlxbf_pka mlx_trio mlx_bootctl(O) bluefield_edac sch_fq_codel ip_tables ipv6 crc_ccitt btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq raid1 raid0 crct10dif_ce i2c_mlxbf gpio_mlxbf2 mlxbf_gige aes_neon_bs aes_neon_blk [last unloaded: mlx5_ib] [ 9443.593419] CPU: 2 PID: 206774 Comm: modprobe Tainted: G O 5.4.0-1023.24.gc14613d-bluefield #1 [ 9443.593422] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:143ebaf Jan 11 2022 [ 9443.593424] pstate: 20000005 (nzCv daif -PAN -UAO) [ 9443.593489] pc : mlx5dr_action_destroy+0x188/0x1a0 [mlx5_core] [ 9443.593545] lr : mlx5_ct_fs_smfs_destroy+0x24/0x30 [mlx5_core] [ 9443.593546] sp : ffff8000135dbab0 [ 9443.593548] x29: ffff8000135dbab0 x28: ffff0003a6ab8e80 [ 9443.593550] x27: 0000000000000000 x26: ffff0003e07d7000 [ 9443.593552] x25: ffff800009609de0 x24: ffff000397fb2120 [ 9443.593554] x23: ffff0003975c0000 x22: 0000000000000000 [ 9443.593556] x21: ffff0003975f08c0 x20: ffff800009609de0 [ 9443.593558] x19: ffff0003c8a13380 x18: 0000000000000014 [ 9443.593560] x17: 0000000067f5f125 x16: 000000006529c620 [ 9443.593561] x15: 000000000000000b x14: 0000000000000000 [ 9443.593563] x13: 0000000000000002 x12: 0000000000000001 [ 9443.593565] x11: ffff800011108868 x10: 0000000000000000 [ 9443.593567] x9 : 0000000000000000 x8 : ffff8000117fb270 [ 9443.593569] x7 : ffff0003ebc01288 x6 : 0000000000000000 [ 9443.593571] x5 : ffff800009591ab8 x4 : fffffe000f6d9a20 [ 9443.593572] x3 : 0000000080040001 x2 : fffffe000f6d9a20 [ 9443.593574] x1 : ffff8000095901d8 x0 : 0000000000000025 [ 9443.593577] Call trace: [ 9443.593634] mlx5dr_action_destroy+0x188/0x1a0 [mlx5_core] [ 9443.593688] mlx5_ct_fs_smfs_destroy+0x24/0x30 [mlx5_core] [ 9443.593743] mlx5_tc_ct_clean+0x34/0xa8 [mlx5_core] [ 9443.593797] mlx5e_tc_esw_cleanup+0x58/0x88 [mlx5_core] [ 9443.593851] mlx5e_rep_tc_cleanup+0x24/0x30 [mlx5_core] [ 9443.593905] mlx5e_cleanup_rep_tx+0x6c/0x78 [mlx5_core] [ 9443.593959] mlx5e_detach_netdev+0x74/0x98 [mlx5_core] [ 9443.594013] mlx5e_netdev_change_profile+0x70/0x180 [mlx5_core] [ 9443.594067] mlx5e_netdev_attach_nic_profile+0x34/0x40 [mlx5_core] [ 9443.594122] mlx5e_vport_rep_unload+0x15c/0x1a8 [mlx5_core] [ 9443.594177] mlx5_eswitch_unregister_vport_reps+0x228/0x298 [mlx5_core] [ 9443.594231] mlx5e_rep_remove+0x2c/0x38 [mlx5_core] [ 9443.594236] auxiliary_bus_remove+0x30/0x50 [auxiliary] [ 9443.594246] device_release_driver_internal+0x108/0x1d0 [ 9443.594248] driver_detach+0x5c/0xe8 [ 9443.594250] bus_remove_driver+0x64/0xd8 [ 9443.594253] driver_unregister+0x38/0x60 [ 9443.594255] auxiliary_driver_unregister+0x24/0x38 [auxiliary] [ 9443.594311] mlx5e_rep_cleanup+0x20/0x38 [mlx5_core] [ 9443.594365] mlx5e_cleanup+0x18/0x30 [mlx5_core] [ 9443.594419] cleanup+0xc/0x20cc [mlx5_core] [ 9443.594424] __arm64_sys_delete_module+0x154/0x2b0 [ 9443.594429] el0_svc_common.constprop.0+0xf4/0x200 [ 9443.594432] el0_svc_handler+0x38/0xa8 [ 9443.594435] el0_svc+0x10/0x26c Fixes: d1a3138f7913 ("net/mlx5e: TC, Move flow hashtable to be per rep") Signed-off-by: Paul Blakey Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit 4d995c1b9d49ee657e879745aa5e445f031c0dba Author: Saeed Mahameed Date: Fri Jun 3 14:33:03 2022 -0700 Revert "net/mlx5e: Allow relaxed ordering over VFs" FW is not ready, fix was sent too soon. This reverts commit f05ec8d9d0d62367b6e1f2cb50d7d2a45e7747cf. Fixes: f05ec8d9d0d6 ("net/mlx5e: Allow relaxed ordering over VFs") Signed-off-by: Saeed Mahameed commit ed872f92fd0946ba30f2acd05fc57e29cac29cd2 Author: Lukas Bulwahn Date: Wed Jun 1 06:57:38 2022 +0200 MAINTAINERS: adjust MELLANOX ETHERNET INNOVA DRIVERS to TLS support removal Commit 40379a0084c2 ("net/mlx5_fpga: Drop INNOVA TLS support") removes all files in the directory drivers/net/ethernet/mellanox/mlx5/core/accel/, but misses to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Remove the file entry to the removed directory in MELLANOX ETHERNET INNOVA DRIVERS. Signed-off-by: Lukas Bulwahn Signed-off-by: Saeed Mahameed commit a6958951ebe7db60e84b2437ee53aa4843028726 Author: Arnd Bergmann Date: Tue Jun 7 11:01:46 2022 +0200 au1000_eth: stop using virt_to_bus() The conversion to the dma-mapping API in linux-2.6.11 was incomplete and left a virt_to_bus() call around. There have been a number of fixes for DMA mapping API abuse in this driver, but this one always slipped through. Change it to just use the existing dma_addr_t pointer, and make it use the correct types throughout the driver to make it easier to understand the virtual vs dma address spaces. Signed-off-by: Arnd Bergmann Tested-by: Manuel Lauss Link: https://lore.kernel.org/r/20220607090206.19830-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit d5a37b19983725d2045588cfa3a4699f5b39ae26 Author: Christoph Hellwig Date: Wed Jun 8 08:34:07 2022 +0200 block: remove bioset_init_from_src Unused now, and the interface never really made a whole lot of sense to start with. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer commit 29dec90a0f1d961b93f34f910e9319d8cb23edbd Author: Christoph Hellwig Date: Wed Jun 8 08:34:06 2022 +0200 dm: fix bio_set allocation The use of bioset_init_from_src mean that the pre-allocated pools weren't used for anything except parameter passing, and the integrity pool creation got completely lost for the actual live mapped_device. Fix that by assigning the actual preallocated dm_md_mempools to the mapped_device and using that for I/O instead of creating new mempools. Fixes: 2a2a4c510b76 ("dm: use bioset_init_from_src() to copy bio_set") Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer commit f638a84afef3dfe10554c51820c16e39a278c915 Author: Wang Yufen Date: Tue Jun 7 20:00:28 2022 +0800 ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max. Signed-off-by: Wang Yufen Link: https://lore.kernel.org/r/20220607120028.845916-2-wangyufen@huawei.com Signed-off-by: Jakub Kicinski commit f93431c86b631bbca5614c66f966bf3ddb3c2803 Author: Wang Yufen Date: Tue Jun 7 20:00:27 2022 +0800 ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested. Reported-by: Hulk Robot Signed-off-by: Wang Yufen Link: https://lore.kernel.org/r/20220607120028.845916-1-wangyufen@huawei.com Signed-off-by: Jakub Kicinski commit f539316fe8106b4f4b4e95c1e70a31b545523b03 Author: Mark Brown Date: Wed Jun 8 12:59:15 2022 +0100 arm64/sme: Fix SVE/SME typo in ABI documentation Fix a cut'n'paste error. Reported-by: Luis Machado Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220608115915.251870-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit a3d52ac7750025b5a1f99eb1ccea0e31b58bf7bb Author: Mark Brown Date: Tue Jun 7 17:51:28 2022 +0100 arm64/sme: Fix tests for 0b1111 value ID registers For both ID_AA64SMFR0_EL1.I16I64 and ID_AA64SMFR0_EL1.I8I32 we check for the presence of the feature by looking for a specific ID value of 0x4 but should instead be checking for the value 0xf defined by the architecture. This had no practical effect since we are looking for values >= our define and the only valid values in the architecture are 0b0000 and 0b1111 so we would detect things appropriately with the architecture as it stands even with the incorrect defines. Signed-off-by: Mark Brown Fixes: b4adc83b0770 ("arm64/sme: System register and exception syndrome definitions") Link: https://lore.kernel.org/r/20220607165128.2833157-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit 8a4d480702b71184fabcf379b80bf7539716752e Author: Xiaohui Zhang Date: Tue Jun 7 16:32:30 2022 +0800 nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Similar to the handling of play_deferred in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought a patch might be needed here as well. Currently usb_submit_urb is called directly to submit deferred tx urbs after unanchor them. So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb and cause memory leak. Put those urbs in tx_anchor to avoid the leak, and also fix the error handling. Signed-off-by: Xiaohui Zhang Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn Signed-off-by: Jakub Kicinski commit e44c8f4080ca264b5aac3183a321538662b0950b Merge: 653926f6938d0 f2e19b36593ca Author: Jakub Kicinski Date: Wed Jun 8 10:17:30 2022 -0700 Merge branch 'split-nfc-st21nfca-refactor-evt_transaction-into-3' Martin Faltesek says: ==================== Split "nfc: st21nfca: Refactor EVT_TRANSACTION" into 3 v2: https://lore.kernel.org/netdev/20220401180939.2025819-1-mfaltesek@google.com/ v1: https://lore.kernel.org/netdev/20220329175431.3175472-1-mfaltesek@google.com/ ==================== Link: https://lore.kernel.org/r/20220607025729.1673212-1-mfaltesek@google.com Signed-off-by: Jakub Kicinski commit f2e19b36593caed4c977c2f55aeba7408aeb2132 Author: Martin Faltesek Date: Mon Jun 6 21:57:29 2022 -0500 nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION The transaction buffer is allocated by using the size of the packet buf, and subtracting two which seem intended to remove the two tags which are not present in the target structure. This calculation leads to under counting memory because of differences between the packet contents and the target structure. The aid_len field is a u8 in the packet, but a u32 in the structure, resulting in at least 3 bytes always being under counted. Further, the aid data is a variable length field in the packet, but fixed in the structure, so if this field is less than the max, the difference is added to the under counting. The last validation check for transaction->params_len is also incorrect since it employs the same accounting error. To fix, perform validation checks progressively to safely reach the next field, to determine the size of both buffers and verify both tags. Once all validation checks pass, allocate the buffer and copy the data. This eliminates freeing memory on the error path, as those checks are moved ahead of memory allocation. Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION") Cc: stable@vger.kernel.org Signed-off-by: Martin Faltesek Reviewed-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit 996419e0594abb311fb958553809f24f38e7abbe Author: Martin Faltesek Date: Mon Jun 6 21:57:28 2022 -0500 nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling Error paths do not free previously allocated memory. Add devm_kfree() to those failure paths. Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION") Cc: stable@vger.kernel.org Signed-off-by: Martin Faltesek Reviewed-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit 77e5fe8f176a525523ae091d6fd0fbb8834c156d Author: Martin Faltesek Date: Mon Jun 6 21:57:27 2022 -0500 nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION The first validation check for EVT_TRANSACTION has two different checks tied together with logical AND. One is a check for minimum packet length, and the other is for a valid aid_tag. If either condition is true (fails), then an error should be triggered. The fix is to change && to ||. Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Cc: stable@vger.kernel.org Signed-off-by: Martin Faltesek Reviewed-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit 6e2b347d42e54282e4c6cfa08272db462b178f7f Merge: e54a4424925a2 f2906aa863381 Author: Maxime Ripard Date: Wed Jun 8 19:11:27 2022 +0200 Merge v5.19-rc1 into drm-misc-fixes Let's kick-off the start of the 5.19 fix cycle Signed-off-by: Maxime Ripard commit 653926f6938d0dbfa44ee66c3d3cf0df3c08b583 Merge: f5826c8c9d572 5801f064e3518 Author: Jakub Kicinski Date: Wed Jun 8 10:10:17 2022 -0700 Merge branch 'net-unexport-some-symbols-that-are-annotated-__init' Masahiro Yamada says: ==================== net: unexport some symbols that are annotated __init This patch set fixes odd combinations of EXPORT_SYMBOL and __init. Checking this in modpost is a good thing and I really wanted to do it, but Linus Torvalds imposes a very strict rule, "No new warning". I'd like the maintainer to kindly pick this up and send a fixes pull request. Unless I eliminate all the sites of warnings beforehand, Linus refuses to re-enable the modpost check. [1] [1]: https://lore.kernel.org/linux-kbuild/CAK7LNATmd0bigp7HQ4fTzHw5ugZMkSb3UXG7L4fxpGbqkRKESA@mail.gmail.com/T/#m5e50cc2da17491ba210c72b5efdbc0ce76e0217f ==================== Link: https://lore.kernel.org/r/20220606045355.4160711-1-masahiroy@kernel.org Signed-off-by: Jakub Kicinski commit 5801f064e35181c71857a80ff18af4dbec3c5f5c Author: Masahiro Yamada Date: Mon Jun 6 13:53:55 2022 +0900 net: ipv6: unexport __init-annotated seg6_hmac_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the caller (net/ipv6/seg6.c) and the callee (net/ipv6/seg6_hmac.c) belong to the same module. It seems an internal function call in ipv6.ko. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Reported-by: Stephen Rothwell Signed-off-by: Masahiro Yamada Signed-off-by: Jakub Kicinski commit 4a388f08d8784af48f352193d2b72aaf167a57a1 Author: Masahiro Yamada Date: Mon Jun 6 13:53:54 2022 +0900 net: xfrm: unexport __init-annotated xfrm4_protocol_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, net/ipv4/xfrm4_policy.c is never compiled as modular. (CONFIG_XFRM is boolean) Fixes: 2f32b51b609f ("xfrm: Introduce xfrm_input_afinfo to access the the callbacks properly") Reported-by: Stephen Rothwell Signed-off-by: Masahiro Yamada Acked-by: Steffen Klassert Signed-off-by: Jakub Kicinski commit 35b42dce619701f1300fb8498dae82c9bb1f0263 Author: Masahiro Yamada Date: Mon Jun 6 13:53:53 2022 +0900 net: mdio: unexport __init-annotated mdio_bus_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, drivers/net/phy/phy_device.c is never compiled as modular. (CONFIG_PHYLIB is boolean) Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") Reported-by: Stephen Rothwell Signed-off-by: Masahiro Yamada Reviewed-by: Florian Fainelli Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit da9e94fe000e11f21d3d6f66012fe5c6379bd93c Author: Chuck Lever Date: Tue Jun 7 16:48:18 2022 -0400 SUNRPC: Remove pointer type casts from xdr_get_next_encode_buffer() To make the code easier to read, remove visual clutter by changing the declared type of @p. Signed-off-by: Chuck Lever Reviewed-by: NeilBrown Reviewed-by: J. Bruce Fields commit bd07a64176a2be03f5195c64943063fd119f9f21 Author: Chuck Lever Date: Tue Jun 7 16:48:11 2022 -0400 SUNRPC: Clean up xdr_get_next_encode_buffer() The value of @p is not used until the "location of the next item" is computed. Help human readers by moving its initial assignment to the paragraph where that value is used and by clarifying the antecedents in the documenting comment. Signed-off-by: Chuck Lever Reviewed-by: NeilBrown Reviewed-by: J. Bruce Fields commit 90d871b3b9bb7ef8f835d6b53095f01b9c74b7b3 Author: Chuck Lever Date: Tue Jun 7 16:48:05 2022 -0400 SUNRPC: Clean up xdr_commit_encode() Both the kvec::iov_len field and the third parameter of memcpy() and memmove() are size_t. There's no reason for the implicit conversion from size_t to int and back. Change the type of @shift to make the code easier to read and understand. Signed-off-by: Chuck Lever Reviewed-by: NeilBrown Reviewed-by: J. Bruce Fields commit 62ed448cc53b654036f7d7f3c99f299d79ad14c3 Author: Chuck Lever Date: Tue Jun 7 16:47:58 2022 -0400 SUNRPC: Optimize xdr_reserve_space() Transitioning between encode buffers is quite infrequent. It happens about 1 time in 400 calls to xdr_reserve_space(), measured on NFSD with a typical build/test workload. Force the compiler to remove that code from xdr_reserve_space(), which is a hot path on both the server and the client. This change reduces the size of xdr_reserve_space() from 10 cache lines to 2 when compiled with -Os. Signed-off-by: Chuck Lever Reviewed-by: J. Bruce Fields commit 6c254bf3b637dd4ef4f78eb78c7447419c0161d7 Author: Chuck Lever Date: Tue Jun 7 16:47:52 2022 -0400 SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() I found that NFSD's new NFSv3 READDIRPLUS XDR encoder was screwing up right at the end of the page array. xdr_get_next_encode_buffer() does not compute the value of xdr->end correctly: * The check to see if we're on the final available page in xdr->buf needs to account for the space consumed by @nbytes. * The new xdr->end value needs to account for the portion of @nbytes that is to be encoded into the previous buffer. Fixes: 2825a7f90753 ("nfsd4: allow encoding across page boundaries") Signed-off-by: Chuck Lever Reviewed-by: NeilBrown Reviewed-by: J. Bruce Fields commit 34f4335c16a5f4bb7da6c8d2d5e780b6a163846a Merge: 32d380a7ef025 6cd88243c7e03 Author: Linus Torvalds Date: Wed Jun 8 09:16:31 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: - syzkaller NULL pointer dereference - TDP MMU performance issue with disabling dirty logging - 5.14 regression with SVM TSC scaling - indefinite stall on applying live patches - unstable selftest - memory leak from wrong copy-and-paste - missed PV TLB flush when racing with emulation * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: do not report a vCPU as preempted outside instruction boundaries KVM: x86: do not set st->preempted when going back to user space KVM: SVM: fix tsc scaling cache logic KVM: selftests: Make hyperv_clock selftest more stable KVM: x86/MMU: Zap non-leaf SPTEs when disabling dirty logging x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm() KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots() entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set KVM: Don't null dereference ops->destroy commit 32d380a7ef0254d65763408b955a5aa6848ea49c Merge: 9886142c7a222 dda5384313a40 Author: Linus Torvalds Date: Wed Jun 8 09:10:11 2022 -0700 Merge tag 'tpmdd-next-v5.19-rc2-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "A bug fix for migratable (whether or not a key is tied to the TPM chip soldered to the machine) handling for TPM2 trusted keys" * tag 'tpmdd-next-v5.19-rc2-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: tpm2: Fix migratable logic commit 32d4fd5751eadbe1823a37eb38df85ec5c8e6207 Author: Peter Zijlstra Date: Wed Jun 8 16:27:27 2022 +0200 cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE Commit c227233ad64c ("intel_idle: enable interrupts before C1 on Xeons") wrecked intel_idle in two ways: - must not have tracing in idle functions - must return with IRQs disabled Additionally, it added a branch for no good reason. Fixes: c227233ad64c ("intel_idle: enable interrupts before C1 on Xeons") Signed-off-by: Peter Zijlstra (Intel) [ rjw: Moved the intel_idle() kerneldoc comment next to the function ] Cc: 5.16+ # 5.16+ Signed-off-by: Rafael J. Wysocki commit 578eb31776df57c81307fb3f96ef0781332c3c7c Author: Mohammad Zafar Ziya Date: Tue Jun 7 11:38:16 2022 +0800 drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit Add jpeg vmid update under IB submit Signed-off-by: Mohammad Zafar Ziya Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 84205d00934394076552e2f597cf04a835df3364 Author: Christian König Date: Fri Jun 3 15:05:04 2022 +0200 drm/amdgpu: always flush the TLB on gfx8 The TLB on GFX8 stores each block of 8 PTEs where any of the valid bits are set. Fixes: 5255e146c99a ("drm/amdgpu: rework TLB flushing") Reviewed-by: Alex Deucher Tested-by: Michal Kubecek Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 1d2afeb7983081ecf656c2338c7db6fd405c653c Author: Christian König Date: Fri Jun 3 12:21:06 2022 +0200 drm/amdgpu: fix limiting AV1 to the first instance on VCN3 The job is not yet initialized here. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2037 Reviewed-by: Alex Deucher Tested-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Christian König Fixes: cdc7893fc93f ("drm/amdgpu: use job and ib structures directly in CS parsers") Signed-off-by: Alex Deucher commit a956a11ee669d069047525c8ec897b4c21a9cda1 Author: Jesse Zhang Date: Tue Jun 7 10:44:57 2022 +0800 drm/amdkfd:Fix fw version for 10.3.6 fix fw error when loading fw for 10.3.6 Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Reviewed-by: Mario Limonciello Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit 7c217aca85dd31dd2c8f45f6a7520767c9fae766 Author: Quentin Monnet Date: Wed Jun 8 13:14:28 2022 +0100 MAINTAINERS: Add a maintainer for bpftool I've been contributing and reviewing patches for bpftool for some time, and I'm taking care of its external mirror. On Alexei, KP, and Daniel's suggestion, I would like to step forwards and become a maintainer for the tool. This patch adds a dedicated entry to MAINTAINERS. Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Acked-by: Jakub Kicinski Acked-by: KP Singh Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20220608121428.69708-1-quentin@isovalent.com commit 5f3d696eea916693b2d4ed7e62794653fcdd6ec0 Author: Jeremy Soller Date: Wed Jun 8 08:01:11 2022 -0600 ALSA: hda/realtek: Add quirk for HP Dev One Enables the audio mute LEDs and limits the mic boost to avoid picking up noise. Signed-off-by: Jeremy Soller Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220608140111.23170-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit d678cbd2f867a564a3c5b276c454e873f43f02f8 Author: Maciej Fijalkowski Date: Tue Jun 7 16:22:00 2022 +0200 xsk: Fix handling of invalid descriptors in XSK TX batching API xdpxceiver run on a AF_XDP ZC enabled driver revealed a problem with XSK Tx batching API. There is a test that checks how invalid Tx descriptors are handled by AF_XDP. Each valid descriptor is followed by invalid one on Tx side whereas the Rx side expects only to receive a set of valid descriptors. In current xsk_tx_peek_release_desc_batch() function, the amount of available descriptors is hidden inside xskq_cons_peek_desc_batch(). This can be problematic in cases where invalid descriptors are present due to the fact that xskq_cons_peek_desc_batch() returns only a count of valid descriptors. This means that it is impossible to properly update XSK ring state when calling xskq_cons_release_n(). To address this issue, pull out the contents of xskq_cons_peek_desc_batch() so that callers (currently only xsk_tx_peek_release_desc_batch()) will always be able to update the state of ring properly, as total count of entries is now available and use this value as an argument in xskq_cons_release_n(). By doing so, xskq_cons_peek_desc_batch() can be dropped altogether. Fixes: 9349eb3a9d2a ("xsk: Introduce batched Tx descriptor interfaces") Signed-off-by: Maciej Fijalkowski Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20220607142200.576735-1-maciej.fijalkowski@intel.com commit b27ee76c74dc831d6e092eaebc2dfc9c0beed1c9 Author: Xie Yongji Date: Tue Apr 26 15:36:56 2022 +0800 vduse: Fix NULL pointer dereference on sysfs access The control device has no drvdata. So we will get a NULL pointer dereference when accessing control device's msg_timeout attribute via sysfs: [ 132.841881][ T3644] BUG: kernel NULL pointer dereference, address: 00000000000000f8 [ 132.850619][ T3644] RIP: 0010:msg_timeout_show (drivers/vdpa/vdpa_user/vduse_dev.c:1271) [ 132.869447][ T3644] dev_attr_show (drivers/base/core.c:2094) [ 132.870215][ T3644] sysfs_kf_seq_show (fs/sysfs/file.c:59) [ 132.871164][ T3644] ? device_remove_bin_file (drivers/base/core.c:2088) [ 132.872082][ T3644] kernfs_seq_show (fs/kernfs/file.c:164) [ 132.872838][ T3644] seq_read_iter (fs/seq_file.c:230) [ 132.873578][ T3644] ? __vmalloc_area_node (mm/vmalloc.c:3041) [ 132.874532][ T3644] kernfs_fop_read_iter (fs/kernfs/file.c:238) [ 132.875513][ T3644] __kernel_read (fs/read_write.c:440 (discriminator 1)) [ 132.876319][ T3644] kernel_read (fs/read_write.c:459) [ 132.877129][ T3644] kernel_read_file (fs/kernel_read_file.c:94) [ 132.877978][ T3644] kernel_read_file_from_fd (include/linux/file.h:45 fs/kernel_read_file.c:186) [ 132.879019][ T3644] __do_sys_finit_module (kernel/module.c:4207) [ 132.879930][ T3644] __ia32_sys_finit_module (kernel/module.c:4189) [ 132.880930][ T3644] do_int80_syscall_32 (arch/x86/entry/common.c:112 arch/x86/entry/common.c:132) [ 132.881847][ T3644] entry_INT80_compat (arch/x86/entry/entry_64_compat.S:419) To fix it, don't create the unneeded attribute for control device anymore. Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Reported-by: kernel test robot Cc: stable@vger.kernel.org Signed-off-by: Xie Yongji Message-Id: <20220426073656.229-1-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit dbd29e0752286af74243cf891accf472b2f3edd8 Author: Xie Yongji Date: Thu May 5 18:09:10 2022 +0800 vringh: Fix loop descriptors check in the indirect cases We should use size of descriptor chain to test loop condition in the indirect case. And another statistical count is also introduced for indirect descriptors to avoid conflict with the statistical count of direct descriptors. Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.") Signed-off-by: Xie Yongji Signed-off-by: Fam Zheng Message-Id: <20220505100910.137-1-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit f38b3c6a788f75da151b46c7da61ff26649e1843 Author: Dan Carpenter Date: Tue Jun 7 09:50:09 2022 +0300 vdpa/mlx5: clean up indenting in handle_ctrl_vlan() These lines were supposed to be indented. Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Michael S. Tsirkin Acked-by: Eli Cohen Acked-by: Si-Wei Liu commit f766c409fcb33cfd0f511e8251831520e089eb89 Author: Dan Carpenter Date: Tue Jun 7 09:49:25 2022 +0300 vdpa/mlx5: fix error code for deleting vlan Return success if we were able to delete a vlan. The current code always returns failure. Fixes: baf2ad3f6a98 ("vdpa/mlx5: Add RX MAC VLAN filter support") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Michael S. Tsirkin Acked-by: Eli Cohen Acked-by: Si-Wei Liu commit a58a7f97ba11391d2d0d408e0b24f38d86ae748e Author: chengkaitao Date: Thu Jun 2 08:55:42 2022 +0800 virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed The reference must be released when device_register(&vm_cmdline_parent) failed. Add the corresponding 'put_device()' in the error handling path. Signed-off-by: chengkaitao Message-Id: <20220602005542.16489-1-chengkaitao@didiglobal.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 2f72b2262d317093596c72bd5b27b9880be7611e Author: Xiang wangx Date: Sat Jun 4 22:38:58 2022 +0800 vdpa/mlx5: Fix syntax errors in comments Delete the redundant word 'is'. Signed-off-by: Xiang wangx Message-Id: <20220604143858.16073-1-wangxiang@cdjrlc.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 228432551bd8783211e494ab35f42a4344580502 Author: Jason Wang Date: Wed Jun 8 14:14:22 2022 +0800 virtio-rng: make device ready before making request Current virtio-rng does a entropy request before DRIVER_OK, this violates the spec: virtio spec requires that all drivers set DRIVER_OK before using devices. Further, kernel will ignore the interrupt after commit 8b4ec69d7e09 ("virtio: harden vring IRQ"). Fixing this by making device ready before the request. Cc: stable@vger.kernel.org Fixes: 8b4ec69d7e09 ("virtio: harden vring IRQ") Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.") Reported-and-tested-by: syzbot+5b59d6d459306a556f54@syzkaller.appspotmail.com Signed-off-by: Jason Wang Message-Id: <20220608061422.38437-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Laurent Vivier commit f5f93d7f5a5cbfef02609dead21e7056e83f4fab Author: Michael Kelley Date: Tue Jun 7 20:49:37 2022 -0700 HID: hyperv: Correctly access fields declared as __le16 Add the use of le16_to_cpu() for fields declared as __le16. Because Hyper-V only runs in Little Endian mode, there's no actual bug. The change is made in the interest of general correctness in addition to making sparse happy. No functional change. Reported-by: kernel test robot Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1654660177-115463-1-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 245b993d8f6c4e25f19191edfbd8080b645e12b1 Author: Masahiro Yamada Date: Mon Jun 6 14:02:38 2022 +0900 clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, arch/x86/kernel/cpu/mshyperv.c is never compiled as modular. (CONFIG_HYPERVISOR_GUEST is boolean) Fixes: dd2cb348613b ("clocksource/drivers: Continue making Hyper-V clocksource ISA agnostic") Reported-by: Stephen Rothwell Signed-off-by: Masahiro Yamada Reviewed-by: Vitaly Kuznetsov Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20220606050238.4162200-1-masahiroy@kernel.org Signed-off-by: Wei Liu commit 92ec746bcea0c51cd29fb46e510fb71fe15282df Author: Xiang wangx Date: Sun Jun 5 16:55:24 2022 +0800 Drivers: hv: Fix syntax errors in comments Delete the redundant word 'in'. Signed-off-by: Xiang wangx Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20220605085524.11289-1-wangxiang@cdjrlc.com Signed-off-by: Wei Liu commit 6640b5df1a38801be6d0595c8cd2177d968d7ee0 Author: Saurabh Sengar Date: Fri May 27 00:43:59 2022 -0700 Drivers: hv: vmbus: Don't assign VMbus channel interrupts to isolated CPUs When initially assigning a VMbus channel interrupt to a CPU, don’t choose a managed IRQ isolated CPU (as specified on the kernel boot line with parameter 'isolcpus=managed_irq,<#cpu>'). Also, when using sysfs to change the CPU that a VMbus channel will interrupt, don't allow changing to a managed IRQ isolated CPU. Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1653637439-23060-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu commit 49c3ca34f7dbe5227c0163cba4deb5d29e145fae Author: Masahiro Yamada Date: Wed Jun 8 00:18:40 2022 +0900 scripts/nsdeps: adjust to the format change of *.mod files Commit 22f26f21774f ("kbuild: get rid of duplication in *.mod files") changed the format of *.mod files to put one object per line, but missed to adjust scripts/nsdeps. Fixes: 22f26f21774f ("kbuild: get rid of duplication in *.mod files") Signed-off-by: Masahiro Yamada commit dda5384313a40ecbaafd8a9a80f47483255e4c4d Author: David Safford Date: Tue Jun 7 14:07:57 2022 -0400 KEYS: trusted: tpm2: Fix migratable logic When creating (sealing) a new trusted key, migratable trusted keys have the FIXED_TPM and FIXED_PARENT attributes set, and non-migratable keys don't. This is backwards, and also causes creation to fail when creating a migratable key under a migratable parent. (The TPM thinks you are trying to seal a non-migratable blob under a migratable parent.) The following simple patch fixes the logic, and has been tested for all four combinations of migratable and non-migratable trusted keys and parent storage keys. With this logic, you will get a proper failure if you try to create a non-migratable trusted key under a migratable parent storage key, and all other combinations work correctly. Cc: stable@vger.kernel.org # v5.13+ Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable") Signed-off-by: David Safford Reviewed-by: Ahmad Fatoum Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit b1fd94e704571f98b21027340eecf821b2bdffba Author: Florian Westphal Date: Wed May 18 20:15:31 2022 +0200 netfilter: use get_random_u32 instead of prandom bh might occur while updating per-cpu rnd_state from user context, ie. local_out path. BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725 caller is nft_ng_random_eval+0x24/0x54 [nft_numgen] Call Trace: check_preemption_disabled+0xde/0xe0 nft_ng_random_eval+0x24/0x54 [nft_numgen] Use the random driver instead, this also avoids need for local prandom state. Moreover, prandom now uses the random driver since d4150779e60f ("random32: use real rng for non-deterministic randomness"). Based on earlier patch from Pablo Neira. Fixes: 6b2faee0ca91 ("netfilter: nft_meta: place prandom handling in a helper") Fixes: 978d8f9055c3 ("netfilter: nft_numgen: add map lookups for numgen random operations") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c1c1204c0d0c1dccc1310b9277fb2bd8b663d8fe Author: Damien Le Moal Date: Mon May 23 16:29:10 2022 +0900 zonefs: fix zonefs_iomap_begin() for reads If a readahead is issued to a sequential zone file with an offset exactly equal to the current file size, the iomap type is set to IOMAP_UNWRITTEN, which will prevent an IO, but the iomap length is calculated as 0. This causes a WARN_ON() in iomap_iter(): [17309.548939] WARNING: CPU: 3 PID: 2137 at fs/iomap/iter.c:34 iomap_iter+0x9cf/0xe80 [...] [17309.650907] RIP: 0010:iomap_iter+0x9cf/0xe80 [...] [17309.754560] Call Trace: [17309.757078] [17309.759240] ? lock_is_held_type+0xd8/0x130 [17309.763531] iomap_readahead+0x1a8/0x870 [17309.767550] ? iomap_read_folio+0x4c0/0x4c0 [17309.771817] ? lockdep_hardirqs_on_prepare+0x400/0x400 [17309.778848] ? lock_release+0x370/0x750 [17309.784462] ? folio_add_lru+0x217/0x3f0 [17309.790220] ? reacquire_held_locks+0x4e0/0x4e0 [17309.796543] read_pages+0x17d/0xb60 [17309.801854] ? folio_add_lru+0x238/0x3f0 [17309.807573] ? readahead_expand+0x5f0/0x5f0 [17309.813554] ? policy_node+0xb5/0x140 [17309.819018] page_cache_ra_unbounded+0x27d/0x450 [17309.825439] filemap_get_pages+0x500/0x1450 [17309.831444] ? filemap_add_folio+0x140/0x140 [17309.837519] ? lock_is_held_type+0xd8/0x130 [17309.843509] filemap_read+0x28c/0x9f0 [17309.848953] ? zonefs_file_read_iter+0x1ea/0x4d0 [zonefs] [17309.856162] ? trace_contention_end+0xd6/0x130 [17309.862416] ? __mutex_lock+0x221/0x1480 [17309.868151] ? zonefs_file_read_iter+0x166/0x4d0 [zonefs] [17309.875364] ? filemap_get_pages+0x1450/0x1450 [17309.881647] ? __mutex_unlock_slowpath+0x15e/0x620 [17309.888248] ? wait_for_completion_io_timeout+0x20/0x20 [17309.895231] ? lock_is_held_type+0xd8/0x130 [17309.901115] ? lock_is_held_type+0xd8/0x130 [17309.906934] zonefs_file_read_iter+0x356/0x4d0 [zonefs] [17309.913750] new_sync_read+0x2d8/0x520 [17309.919035] ? __x64_sys_lseek+0x1d0/0x1d0 Furthermore, this causes iomap_readahead() to loop forever as iomap_readahead_iter() always returns 0, making no progress. Fix this by treating reads after the file size as access to holes, setting the iomap type to IOMAP_HOLE, the iomap addr to IOMAP_NULL_ADDR and using the length argument as is for the iomap length. To simplify the code with this change, zonefs_iomap_begin() is split into the read variant, zonefs_read_iomap_begin() and zonefs_read_iomap_ops, and the write variant, zonefs_write_iomap_begin() and zonefs_write_iomap_ops. Reported-by: Jorgen Hansen Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system") Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Jorgen Hansen commit 37d838de369b07b596c19ff3662bf0293fdb09ee Author: Miaoqian Lin Date: Thu May 26 11:53:22 2022 +0400 soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. In brcmstb_init_sram, it pass dn to of_address_to_resource(), of_address_to_resource() will call of_find_device_by_node() to take reference, so we should release the reference returned by of_find_matching_node(). Fixes: 0b741b8234c8 ("soc: bcm: brcmstb: Add support for S2/S3/S5 suspend states (ARM)") Signed-off-by: Miaoqian Lin Reviewed-by: Andy Shevchenko Signed-off-by: Florian Fainelli commit efedd01de475e126e43a07d0b1221bb65e497163 Author: Marc Zyngier Date: Tue Jun 7 14:14:27 2022 +0100 KVM: arm64: Warn if accessing timer pending state outside of vcpu context A recurrent bug in the KVM/arm64 code base consists in trying to access the timer pending state outside of the vcpu context, which makes zero sense (the pending state only exists when the vcpu is loaded). In order to avoid more embarassing crashes and catch the offenders red-handed, add a warning to kvm_arch_timer_get_input_level() and return the state as non-pending. This avoids taking the system down, and still helps tracking down silly bugs. Reviewed-by: Eric Auger Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220607131427.1164881-4-maz@kernel.org commit 98432ccdec9f178ba041e1e5f9f32dbd71576504 Author: Marc Zyngier Date: Tue Jun 7 14:14:26 2022 +0100 KVM: arm64: Replace vgic_v3_uaccess_read_pending with vgic_uaccess_read_pending Now that GICv2 has a proper userspace accessor for the pending state, switch GICv3 over to it, dropping the local version, moving over the specific behaviours that CGIv3 requires (such as the distinction between pending latch and line level which were never enforced with GICv2). We also gain extra locking that isn't really necessary for userspace, but that's a small price to pay for getting rid of superfluous code. Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20220607131427.1164881-3-maz@kernel.org commit 527f4643e03c298c1e3321cfa27866b1374a55e1 Author: huangwenhui Date: Wed Jun 8 16:23:57 2022 +0800 ALSA: hda/realtek - Add HW8326 support Added the support of new Huawei codec HW8326. The HW8326 is developed by Huawei with Realtek's IP Core, and it's compatible with ALC256. Signed-off-by: huangwenhui Link: https://lore.kernel.org/r/20220608082357.26898-1-huangwenhuia@uniontech.com Signed-off-by: Takashi Iwai commit 6cd88243c7e03845a450795e134b488fc2afb736 Author: Paolo Bonzini Date: Tue Jun 7 10:09:03 2022 -0400 KVM: x86: do not report a vCPU as preempted outside instruction boundaries If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn Signed-off-by: Paolo Bonzini commit 54aa83c90198e68eee8b0850c749bc70efb548da Author: Paolo Bonzini Date: Tue Jun 7 10:07:11 2022 -0400 KVM: x86: do not set st->preempted when going back to user space Similar to the Xen path, only change the vCPU's reported state if the vCPU was actually preempted. The reason for KVM's behavior is that for example optimistic spinning might not be a good idea if the guest is doing repeated exits to userspace; however, it is confusing and unlikely to make a difference, because well-tuned guests will hardly ever exit KVM_RUN in the first place. Suggested-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 46d6e11320d21dc40fce229ab3504125847de27e Author: Nicolas Saenz Julienne Date: Fri Jun 3 09:30:12 2022 +0200 MAINTAINERS: Update BCM2711/BCM2835 maintainer I haven't been able to find time to maintain BCM2711/BCM2835 these last months, so it's only fair to pass the baton to Florian who's been doing the work. Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Florian Fainelli commit 96eca145cb51f4e0132a3ea8066dfc6fdf75f24a Author: Damien Le Moal Date: Thu Jun 2 21:33:25 2022 +0900 zonefs: Do not ignore explicit_open with active zone limit A zoned device may have no limit on the number of open zones but may have a limit on the number of active zones it can support. In such case, the explicit_open mount option should not be ignored to ensure that the open() system call activates the zone with an explicit zone open command, thus guaranteeing that the zone can be written. Enforce this by ignoring the explicit_open mount option only for devices that have both the open and active zone limits equal to 0. Fixes: 87c9ce3ffec9 ("zonefs: Add active seq file accounting") Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig commit a2a513be7139b279f1b5b2cee59c6c4950c34346 Author: Damien Le Moal Date: Thu Jun 2 23:16:57 2022 +0900 zonefs: fix handling of explicit_open option on mount Ignoring the explicit_open mount option on mount for devices that do not have a limit on the number of open zones must be done after the mount options are parsed and set in s_mount_opts. Move the check to ignore the explicit_open option after the call to zonefs_parse_options() in zonefs_fill_super(). Fixes: b5c00e975779 ("zonefs: open/close zone on file open/close") Cc: Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn commit f5826c8c9d57210a17031af5527056eefdc2b7eb Author: Gal Pressman Date: Mon Jun 6 14:57:18 2022 +0300 net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure The ioctl EEPROM query wrongly returns success on read failures, fix that by returning the appropriate error code. Fixes: 7202da8b7f71 ("ethtool, net/mlx4_en: Cable info, get_module_info/eeprom ethtool support") Signed-off-by: Gal Pressman Signed-off-by: Tariq Toukan Link: https://lore.kernel.org/r/20220606115718.14233-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0737e018a05e2aa352828c52bdeed3b02cff2930 Author: Miaoqian Lin Date: Sun Jun 5 11:23:34 2022 +0400 net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. when breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the gphy_fw_np. Add missing of_node_put() to avoid refcount leak. Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220605072335.11257-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit 6d11acd452fd885ef6ace184c9c70bc863a8c72f Author: Tyler Erickson Date: Thu Jun 2 16:51:12 2022 -0600 libata: fix translation of concurrent positioning ranges Fixing the page length in the SCSI translation for the concurrent positioning ranges VPD page. It was writing starting in offset 3 rather than offset 2 where the MSB is supposed to start for the VPD page length. Cc: stable@vger.kernel.org Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log") Signed-off-by: Tyler Erickson Reviewed-by: Muhammad Ahmad Tested-by: Michael English Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal commit c745dfc541e78428ba3986f1d17fe1dfdaca8184 Author: Tyler Erickson Date: Thu Jun 2 16:51:11 2022 -0600 libata: fix reading concurrent positioning ranges log The concurrent positioning ranges log is not a fixed size and may depend on how many ranges are supported by the device. This patch uses the size reported in the GPL directory to determine the number of pages supported by the device before attempting to read this log page. This resolves this error from the dmesg output: ata6.00: Read log 0x47 page 0x00 failed, Emask 0x1 Cc: stable@vger.kernel.org Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log") Signed-off-by: Tyler Erickson Reviewed-by: Muhammad Ahmad Tested-by: Michael English Signed-off-by: Damien Le Moal commit 5c95fe8b02011c3b69173e0d86aff6d4c2798601 Author: Jason A. Donenfeld Date: Sun Jun 5 16:20:08 2022 +0800 LoongArch: Remove MIPS comment about cycle counter This comment block was taken originally from the MIPS architecture code, where indeed there are particular assumptions one can make regarding SMP and !SMP and cycle counters. On LoongArch, however, the rdtime family of functions is always available. As Xuerui wrote: The rdtime family of instructions is in fact guaranteed to be available on LoongArch; LoongArch's subsets all contain them, even the 32-bit "Primary" subset intended for university teaching -- they provide the rdtimeh.w and rdtimel.w pair of instructions that access the same 64-bit counter. So this commit simply removes the incorrect comment block. Link: https://lore.kernel.org/lkml/e78940bc-9be2-2fe7-026f-9e64a1416c9f@xen0n.name/ Fixes: b738c106f735 ("LoongArch: Add other common headers") Reviewed-by: WANG Xuerui Signed-off-by: Jason A. Donenfeld Signed-off-by: Huacai Chen commit 0626e1c9f3e5536545431538d12c762d5abf59c8 Author: Huacai Chen Date: Sun Jun 5 16:20:03 2022 +0800 LoongArch: Fix copy_thread() build errors Commit c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread") change the prototype of copy_thread(), while commit 5bd2e97c868a8a44 ("fork: Generalize PF_IO_WORKER handling") change the structure of kernel_clone_args. They cause build errors, so fix it. Fixes: 5bd2e97c868a8a44 ("fork: Generalize PF_IO_WORKER handling") Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread") Signed-off-by: Huacai Chen commit 255b4658c809e194bc10236ac24a722ec14a83d6 Author: Huacai Chen Date: Sun Jun 5 16:19:53 2022 +0800 LoongArch: Fix the !CONFIG_SMP build 1, We assume arch/loongarch/include/asm/smp.h be included in include/ linux/smp.h is valid and the reverse inclusion isn't. So remove the in arch/loongarch/include/asm/smp.h. 2, arch/loongarch/include/asm/smp.h is only needed when CONFIG_SMP, and setup.c include it only because it need plat_smp_setup(). So, reorganize setup.c & smp.h, and then remove in setup.c. 3, Fix cacheinfo.c and percpu.h build error by adding the missing header files when !CONFIG_SMP. 4, Fix acpi.c build error by adding CONFIG_SMP guards. 5, Move irq_stat definition from smp.c to irq.c and fix its declaration. 6, Select CONFIG_SMP for CONFIG_NUMA, similar as other architectures do. Signed-off-by: Huacai Chen commit ec1e8adcbdf661c57c395bca342945f4f815add7 Author: Chengguang Xu Date: Sun May 29 23:34:55 2022 +0800 scsi: pmcraid: Fix missing resource cleanup in error case Fix missing resource cleanup (when '(--i) == 0') for error case in pmcraid_register_interrupt_handler(). Link: https://lore.kernel.org/r/20220529153456.4183738-6-cgxu519@mykernel.net Reviewed-by: Dan Carpenter Signed-off-by: Chengguang Xu Signed-off-by: Martin K. Petersen commit d64c491911322af1dcada98e5b9ee0d87e8c8fee Author: Chengguang Xu Date: Sun May 29 23:34:53 2022 +0800 scsi: ipr: Fix missing/incorrect resource cleanup in error case Fix missing resource cleanup (when '(--i) == 0') for error case in ipr_alloc_mem() and skip incorrect resource cleanup (when '(--i) == 0') for error case in ipr_request_other_msi_irqs() because variable i started from 1. Link: https://lore.kernel.org/r/20220529153456.4183738-4-cgxu519@mykernel.net Reviewed-by: Dan Carpenter Acked-by: Brian King Signed-off-by: Chengguang Xu Signed-off-by: Martin K. Petersen commit 120f1d95efb1cdb6fe023c84e38ba06d8f78cd03 Author: Helge Deller Date: Tue May 31 22:09:27 2022 +0200 scsi: mpt3sas: Fix out-of-bounds compiler warning I'm facing this warning when building for the parisc64 architecture: drivers/scsi/mpt3sas/mpt3sas_base.c: In function ‘_base_make_ioc_operational’: drivers/scsi/mpt3sas/mpt3sas_base.c:5396:40: warning: array subscript ‘Mpi2SasIOUnitPage1_t {aka struct _MPI2_CONFIG_PAGE_SASIOUNIT_1}[0]’ is partly outside array bounds of ‘unsigned char[20]’ [-Warray-bounds] 5396 | (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ? drivers/scsi/mpt3sas/mpt3sas_base.c:5382:26: note: referencing an object of size 20 allocated by ‘kzalloc’ 5382 | sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); | ^~~~~~~~~~~~~~~~~~~~~~~ The problem is, that only 20 bytes are allocated with kmalloc(), which is sufficient to hold the bytes which are needed. Nevertheless, gcc complains because the whole Mpi2SasIOUnitPage1_t struct is 32 bytes in size and thus doesn't fit into those 20 bytes. This patch simply allocates all 32 bytes (instead of 20) and thus avoids the warning. There is no functional change introduced by this patch. While touching the code I cleaned up to calculation of max_wideport_qd, max_narrowport_qd and max_sata_qd to make it easier readable. Test successfully tested on a HP C8000 PA-RISC workstation with 64-bit kernel. Link: https://lore.kernel.org/r/YpZ197iZdDZSCzrT@p100 Signed-off-by: Helge Deller Signed-off-by: Martin K. Petersen commit 1af48fffd7ffe280e0c225659d826fd5ae802a08 Author: James Smart Date: Fri Jun 3 10:43:29 2022 -0700 scsi: lpfc: Update lpfc version to 14.2.0.4 Update lpfc version to 14.2.0.4 Link: https://lore.kernel.org/r/20220603174329.63777-10-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 2e7e9c0c1ec05f18d320ecc8a31eec59d2af1af9 Author: James Smart Date: Fri Jun 3 10:43:28 2022 -0700 scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion NVMe Asynchronous Event Request commands have no command timeout value per specifications. Set WQE option to allow a reduced FLUSH polling rate for I/O error detection specifically for nvme_admin_async_event commands. Link: https://lore.kernel.org/r/20220603174329.63777-9-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit ea7bd1f393311e823716a232e9d8857fb64eb105 Author: James Smart Date: Fri Jun 3 10:43:27 2022 -0700 scsi: lpfc: Add more logging of cmd and cqe information for aborted NVMe cmds When an NVMe command is aborted or completes with an ERSP, log the opcode and command ID fields to help provide more detail on the failed command. Link: https://lore.kernel.org/r/20220603174329.63777-8-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 336d63615466b4c06b9401c987813fd19bdde39b Author: James Smart Date: Fri Jun 3 10:43:26 2022 -0700 scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology After issuing a LIP, a specific target vendor does not ACC the FLOGI that lpfc sends. However, it does send its own FLOGI that lpfc ACCs. The target then establishes the port IDs by sending a PLOGI. lpfc PLOGI_ACCs and starts the RPI registration for DID 0x000001. The target then sends a LOGO to the fabric DID. lpfc is currently treating the LOGO from the fabric DID as a link down and cleans up all the ndlps. The ndlp for DID 0x000001 is put back into NPR and discovery stops, leaving the port in stuck in bypassed mode. Change lpfc behavior such that if a LOGO is received for the fabric DID in PT2PT topology skip the lpfc_linkdown_port() routine and just move the fabric DID back to NPR. Link: https://lore.kernel.org/r/20220603174329.63777-7-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit b1b3440f437b75fb2a9b0cfe58df461e40eca474 Author: James Smart Date: Fri Jun 3 10:43:25 2022 -0700 scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted A use-after-free crash can occur after an ELS LOGO is aborted. Specifically, a nodelist structure is freed and then ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the discovery state machine is mistakenly called a second time with NLP_EVT_DEVICE_RM argument. Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a nodelist structure. Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 6f808bd78e8296b4ded813b7182988d57e1f6176 Author: James Smart Date: Fri Jun 3 10:43:24 2022 -0700 scsi: lpfc: Address NULL pointer dereference after starget_to_rport() Calls to starget_to_rport() may return NULL. Add check for NULL rport before dereference. Link: https://lore.kernel.org/r/20220603174329.63777-5-jsmart2021@gmail.com Fixes: bb21fc9911ee ("scsi: lpfc: Use fc_block_rport()") Cc: # v5.18 Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit e27f05147bff21408c1b8410ad8e90cd286e7952 Author: James Smart Date: Fri Jun 3 10:43:23 2022 -0700 scsi: lpfc: Resolve some cleanup issues following SLI path refactoring Following refactoring and consolidation in SLI processing, fix up some minor issues related to SLI path: - Correct the setting of LPFC_EXCHANGE_BUSY flag in response IOCB. - Fix some typographical errors. - Fix duplicate log messages. Link: https://lore.kernel.org/r/20220603174329.63777-4-jsmart2021@gmail.com Fixes: 1b64aa9eae28 ("scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4") Cc: # v5.18 Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 24e1f056677eefe834d5dcf61905cce857ca4b19 Author: James Smart Date: Fri Jun 3 10:43:22 2022 -0700 scsi: lpfc: Resolve some cleanup issues following abort path refactoring Refactoring and consolidation of abort paths: - lpfc_sli4_abort_fcp_cmpl() and lpfc_sli_abort_fcp_cmpl() are combined into a single generic lpfc_sli_abort_fcp_cmpl() routine. Thus, remove extraneous lpfc_sli4_abort_fcp_cmpl() prototype declaration. - lpfc_nvme_abort_fcreq_cmpl() abort completion routine is called with a mismatched argument type. This may result in misleading log message content. Update to the correct argument type of lpfc_iocbq instead of lpfc_wcqe_complete. The lpfc_wcqe_complete should be derived from the lpfc_iocbq structure. Link: https://lore.kernel.org/r/20220603174329.63777-3-jsmart2021@gmail.com Fixes: 31a59f75702f ("scsi: lpfc: SLI path split: Refactor Abort paths") Cc: # v5.18 Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 44ba9786b67345dc4e5eabe537c9ef2bfd889888 Author: James Smart Date: Fri Jun 3 10:43:21 2022 -0700 scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event() A previous commit assumed all XMIT_SEQ64_WQEs are prepped with the correct BDE type in word 0-2. However, lpfc_ct_reject_event() routine was missed and is still filling out the incorrect BDE type. Fix lpfc_ct_reject_event() routine so that type BUFF_TYPE_BDE_64 is set instead of BUFF_TYPE_BLP_64. Link: https://lore.kernel.org/r/20220603174329.63777-2-jsmart2021@gmail.com Fixes: 596fc8adb171 ("scsi: lpfc: Fix dmabuf ptr assignment in lpfc_ct_reject_event()") Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit cf71d59c2eceadfcde0fb52e237990a0909880d7 Author: Wentao Wang Date: Thu Jun 2 08:57:00 2022 +0000 scsi: vmw_pvscsi: Expand vcpuHint to 16 bits vcpuHint has been expanded to 16 bit on host to enable routing to more CPUs. Guest side should align with the change. This change has been tested with hosts with 8-bit and 16-bit vcpuHint, on both platforms host side can get correct value. Link: https://lore.kernel.org/r/EF35F4D5-5DCC-42C5-BCC4-29DF1729B24C@vmware.com Signed-off-by: Wentao Wang Signed-off-by: Martin K. Petersen commit f92de9d110429e39929a49240d823251c2fe903e Author: Tyler Erickson Date: Thu Jun 2 16:51:13 2022 -0600 scsi: sd: Fix interpretation of VPD B9h length Fixing the interpretation of the length of the B9h VPD page (Concurrent Positioning Ranges). Adding 4 is necessary as the first 4 bytes of the page is the header with page number and length information. Adding 3 was likely a misinterpretation of the SBC-5 specification which sets all offsets starting at zero. This fixes the error in dmesg: [ 9.014456] sd 1:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page Link: https://lore.kernel.org/r/20220602225113.10218-4-tyler.erickson@seagate.com Fixes: e815d36548f0 ("scsi: sd: add concurrent positioning ranges support") Cc: stable@vger.kernel.org Tested-by: Michael English Reviewed-by: Muhammad Ahmad Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Signed-off-by: Tyler Erickson Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 91ffb0893291ff80cb3695f87e397533abc26823 Merge: cf67838c4422e 3a41c64d9c118 Author: Jakub Kicinski Date: Tue Jun 7 17:49:47 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix NAT support for NFPROTO_INET without layer 3 address, from Florian Westphal. 2) Use kfree_rcu(ptr, rcu) variant in nf_tables clean_net path. 3) Use list to collect flowtable hooks to be deleted. 4) Initialize list of hook field in flowtable transaction. 5) Release hooks on error for flowtable updates. 6) Memleak in hardware offload rule commit and abort paths. 7) Early bail out in case device does not support for hardware offload. This adds a new interface to net/core/flow_offload.c to check if the flow indirect block list is empty. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: bail out early if hardware offload is not supported netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: always initialize flowtable hook list in transaction netfilter: nf_tables: delete flowtable hooks via transaction list netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path netfilter: nat: really support inet nat without l3 address ==================== Link: https://lore.kernel.org/r/20220606212055.98300-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 9886142c7a2226439c1e3f7d9b69f9c7094c3ef6 Merge: f7a447eda2120 6ab2e51898cd4 Author: Linus Torvalds Date: Tue Jun 7 15:00:29 2022 -0700 Merge tag 'input-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - proper annotation of USB buffers in bcm5974 touchpad dirver - a quirk in SOC button driver to handle Lenovo Yoga Tablet2 1051F - a fix for missing dependency in raspberrypi-ts driver to avoid compile breakages with random configs. * tag 'input-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Input: raspberrypi-ts - add missing HAS_IOMEM dependency commit f7a447eda2120ab8988b0f8c708c1fd3bd4d3729 Merge: e71e60cd74df9 479260419fa4c Author: Linus Torvalds Date: Tue Jun 7 14:24:30 2022 -0700 Merge tag 'mmc-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix CQE recovery reset success for block I/O MMC host: - sdhci-pci-gli: Fix support for runtime resume - Fix unevaluatedProperties warnings in DT examples" * tag 'mmc-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: dt-bindings: mmc: Fix unevaluatedProperties warnings in examples mmc: block: Fix CQE recovery reset success mmc: sdhci-pci-gli: Fix GL9763E runtime PM when the system resumes from suspend commit 6ab2e51898cd4343bbdf8587af8ce8fbabddbcb5 Author: Marius Hoch Date: Tue Jun 7 12:10:52 2022 -0700 Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Commit 223f61b8c5ad ("Input: soc_button_array - add Lenovo Yoga Tablet2 1051L to the dmi_use_low_level_irq list") added the 1051L to this list already, but the same problem applies to the 1051F. As there are no further 1051 variants (just the F/L), we can just DMI match 1051. Tested on a Lenovo Yoga Tablet2 1051F: Without this patch the home-button stops working after a wakeup from suspend. Signed-off-by: Marius Hoch Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20220603120246.3065-1-mail@mariushoch.de Signed-off-by: Dmitry Torokhov commit c42e65664390be7c1ef3838cd84956d3a2739d60 Author: Mathias Nyman Date: Tue Jun 7 12:11:33 2022 -0700 Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag The bcm5974 driver does the allocation and dma mapping of the usb urb data buffer, but driver does not set the URB_NO_TRANSFER_DMA_MAP flag to let usb core know the buffer is already mapped. usb core tries to map the already mapped buffer, causing a warning: "xhci_hcd 0000:00:14.0: rejecting DMA map of vmalloc memory" Fix this by setting the URB_NO_TRANSFER_DMA_MAP, letting usb core know buffer is already mapped by bcm5974 driver Signed-off-by: Mathias Nyman Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=215890 Link: https://lore.kernel.org/r/20220606113636.588955-1-mathias.nyman@linux.intel.com Signed-off-by: Dmitry Torokhov commit b3f9234e106c9ca4dd0fab3cebbdc8ac74504f97 Author: Joseph Greathouse Date: Mon Jun 6 16:09:25 2022 -0500 drm/amdgpu: Add MODE register to wave debug info in gfx11 All other chips, from gfx6-gfx10, now include the MODE register at the end of the wave debug state. This appears to have been missed in gfx11, so this patch adds in MODE to the debug state for gfx11. Signed-off-by: Joseph Greathouse Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8b8ce2b90af1bea3d7b24e250832fcc3c7e687ea Author: Nicholas Kazlauskas Date: Tue May 17 10:12:27 2022 -0400 Revert "drm/amd/display: Pass the new context into disable OTG WA" This reverts commit 8440f57532496d398a461887e56ca6f45089fbcf. Causes a hang when hotplugging DP, shutting down system, or enabling dual eDP. Reviewed-by: Dmytro Laktyushkin Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 41782d7056e2866ca40cb2d3f56c4c97fd5af337 Author: Guchun Chen Date: Mon Jun 6 10:09:48 2022 +0800 Revert "drm/amdgpu: Ensure the DMA engine is deactivated during set ups" This reverts commit b992a19085885c096b19625a85c674cb89829ca1. This causes regression in GPU reset related test. Cc: Alexander Deucher Cc: ricetons@gmail.com Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit ce0db505bc0c51ef5e9ba446c660de7e26f78f29 Author: Maximilian Luz Date: Mon Jun 6 23:13:05 2022 +0200 drm/msm: Fix double pm_runtime_disable() call Following commit 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}"), any call to adreno_unbind() will disable runtime PM twice, as indicated by the call trees below: adreno_unbind() -> pm_runtime_force_suspend() -> pm_runtime_disable() adreno_unbind() -> gpu->funcs->destroy() [= aNxx_destroy()] -> adreno_gpu_cleanup() -> pm_runtime_disable() Note that pm_runtime_force_suspend() is called right before gpu->funcs->destroy() and both functions are called unconditionally. With recent addition of the eDP AUX bus code, this problem manifests itself when the eDP panel cannot be found yet and probing is deferred. On the first probe attempt, we disable runtime PM twice as described above. This then causes any later probe attempt to fail with [drm:adreno_load_gpu [msm]] *ERROR* Couldn't power up the GPU: -13 preventing the driver from loading. As there seem to be scenarios where the aNxx_destroy() functions are not called from adreno_unbind(), simply removing pm_runtime_disable() from inside adreno_unbind() does not seem to be the proper fix. This is what commit 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") intended to fix. Therefore, instead check whether runtime PM is still enabled, and only disable it in that case. Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") Signed-off-by: Maximilian Luz Tested-by: Bjorn Andersson Reviewed-by: Rob Clark Link: https://lore.kernel.org/r/20220606211305.189585-1-luzmaximilian@gmail.com Signed-off-by: Rob Clark commit 122e951eb8045338089b086c8bd9b0b9afb04a92 Author: Robert Marko Date: Sat Jun 4 21:33:00 2022 +0200 regulator: qcom_smd: correct MP5496 ranges Currently set MP5496 Buck and LDO ranges dont match its datasheet[1]. According to the datasheet: Buck range is 0.6-2.1875V with a 12.5mV step LDO range is 0.8-3.975V with a 25mV step. So, correct the ranges according to the datasheet[1]. [1] https://www.monolithicpower.com/en/documentview/productdocument/index/version/2/document_type/Datasheet/lang/en/sku/MP5496GR/document_id/6906/ Signed-off-by: Robert Marko Link: https://lore.kernel.org/r/20220604193300.125758-2-robimarko@gmail.com Signed-off-by: Mark Brown commit 5871321fb4558c55bf9567052b618ff0be6b975e Author: Mark Brown Date: Sat Jun 4 11:52:46 2022 +0100 ASoC: ops: Fix off by one in range control validation We currently report that range controls accept a range of 0..(max-min) but accept writes in the range 0..(max-min+1). Remove that extra +1. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220604105246.4055214-1-broonie@kernel.org Signed-off-by: Mark Brown commit 073350da0aa2aead9df7927a1c1046ebf5cdd816 Merge: 2abdf9f80019e f2906aa863381 Author: Mark Brown Date: Tue Jun 7 20:37:12 2022 +0100 Merge tag 'v5.19-rc1' into asoc-5.19 Linux 5.19-rc1 commit 7bb0fb7c63df95d6027dc50d6af3bc3bbbc25483 Author: Olivier Matz Date: Wed Apr 6 11:52:52 2022 +0200 ixgbe: fix unexpected VLAN Rx in promisc mode on VF When the promiscuous mode is enabled on a VF, the IXGBE_VMOLR_VPE bit (VLAN Promiscuous Enable) is set. This means that the VF will receive packets whose VLAN is not the same than the VLAN of the VF. For instance, in this situation: ┌────────┐ ┌────────┐ ┌────────┐ │ │ │ │ │ │ │ │ │ │ │ │ │ VF0├────┤VF1 VF2├────┤VF3 │ │ │ │ │ │ │ └────────┘ └────────┘ └────────┘ VM1 VM2 VM3 vf 0: vlan 1000 vf 1: vlan 1000 vf 2: vlan 1001 vf 3: vlan 1001 If we tcpdump on VF3, we see all the packets, even those transmitted on vlan 1000. This behavior prevents to bridge VF1 and VF2 in VM2, because it will create a loop: packets transmitted on VF1 will be received by VF2 and vice-versa, and bridged again through the software bridge. This patch remove the activation of VLAN Promiscuous when a VF enables the promiscuous mode. However, the IXGBE_VMOLR_UPE bit (Unicast Promiscuous) is kept, so that a VF receives all packets that has the same VLAN, whatever the destination MAC address. Fixes: 8443c1a4b192 ("ixgbe, ixgbevf: Add new mbox API xcast mode") Cc: stable@vger.kernel.org Cc: Nicolas Dichtel Signed-off-by: Olivier Matz Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 803e9895ea2b0fe80bc85980ae2d7a7e44037914 Author: Olivier Matz Date: Wed Apr 6 11:52:51 2022 +0200 ixgbe: fix bcast packets Rx on VF after promisc removal After a VF requested to remove the promiscuous flag on an interface, the broadcast packets are not received anymore. This breaks some protocols like ARP. In ixgbe_update_vf_xcast_mode(), we should keep the IXGBE_VMOLR_BAM bit (Broadcast Accept) on promiscuous removal. This flag is already set by default in ixgbe_set_vmolr() on VF reset. Fixes: 8443c1a4b192 ("ixgbe, ixgbevf: Add new mbox API xcast mode") Cc: stable@vger.kernel.org Cc: Nicolas Dichtel Signed-off-by: Olivier Matz Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 2b8c612c6102f751e6e3e1bd425f64e9d3d3f638 Author: Dmitry Osipenko Date: Mon Jun 6 19:56:40 2022 +0300 kernel/reboot: Fix powering off using a non-syscall code paths There are other methods of powering off machine than the reboot syscall. Previously we missed to cover those methods and it created power-off regression for some machines, like the PowerPC e500. Fix this problem by moving the legacy sys-off handler registration to the latest phase of power-off process and making the kernel_can_power_off() check the legacy pm_power_off presence. Tested-by: Michael Ellerman # ppce500 Reported-by: Michael Ellerman # ppce500 Fixes: da007f171fc9 ("kernel/reboot: Change registration order of legacy power-off handler") Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 2cf7b7ffdae519b284f1406012b52e2282fa36bf Author: Toke Høiland-Jørgensen Date: Mon Jun 6 09:52:52 2022 +0200 selftests/bpf: Add selftest for calling global functions from freplace Add a selftest that calls a global function with a context object parameter from an freplace function to check that the program context type is correctly converted to the freplace target when fetching the context type from the kernel BTF. v2: - Trim includes - Get rid of global function - Use __noinline Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20220606075253.28422-2-toke@redhat.com Signed-off-by: Alexei Starovoitov commit f858c2b2ca04fc7ead291821a793638ae120c11d Author: Toke Høiland-Jørgensen Date: Mon Jun 6 09:52:51 2022 +0200 bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs The verifier allows programs to call global functions as long as their argument types match, using BTF to check the function arguments. One of the allowed argument types to such global functions is PTR_TO_CTX; however the check for this fails on BPF_PROG_TYPE_EXT functions because the verifier uses the wrong type to fetch the vmlinux BTF ID for the program context type. This failure is seen when an XDP program is loaded using libxdp (which loads it as BPF_PROG_TYPE_EXT and attaches it to a global XDP type program). Fix the issue by passing in the target program type instead of the BPF_PROG_TYPE_EXT type to bpf_prog_get_ctx() when checking function argument compatibility. The first Fixes tag refers to the latest commit that touched the code in question, while the second one points to the code that first introduced the global function call verification. v2: - Use resolve_prog_type() Fixes: 3363bd0cfbb8 ("bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support") Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification") Reported-by: Simon Sundberg Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20220606075253.28422-1-toke@redhat.com Signed-off-by: Alexei Starovoitov commit fd58f7df2415ef747782e01f94880fefad1247cf Author: Dan Carpenter Date: Thu May 26 13:24:05 2022 +0300 bpf: Use safer kvmalloc_array() where possible The kvmalloc_array() function is safer because it has a check for integer overflows. These sizes come from the user and I was not able to see any bounds checking so an integer overflow seems like a realistic concern. Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") Signed-off-by: Dan Carpenter Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/Yo9VRVMeHbALyjUH@kili Signed-off-by: Alexei Starovoitov commit 10f3b29c65bb2fe0d47c2945cd0b4087be1c5218 Author: Eric Dumazet Date: Tue May 31 14:51:13 2022 -0700 bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might be possible that the found vm_struct was garbage. [1] usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)! kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0 Hardware name: linux,dummy-virt (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:101 lr : usercopy_abort+0x90/0x94 mm/usercopy.c:89 sp : ffff80000b773a20 x29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48 x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000 x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001 x20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420 x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031 x11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865 x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830 x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000 x2 : 0000000000000000 x1 : f7ff000028fc0000 x0 : 0000000000000064 Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:89 check_heap_object mm/usercopy.c:186 [inline] __check_object_size mm/usercopy.c:252 [inline] __check_object_size+0x198/0x36c mm/usercopy.c:214 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_to_user include/linux/uaccess.h:159 [inline] bpf_prog_get_info_by_fd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993 bpf_obj_get_info_by_fd+0x12c/0x510 kernel/bpf/syscall.c:4253 __sys_bpf+0x900/0x2150 kernel/bpf/syscall.c:4956 __do_sys_bpf kernel/bpf/syscall.c:5021 [inline] __se_sys_bpf kernel/bpf/syscall.c:5019 [inline] __arm64_sys_bpf+0x28/0x40 kernel/bpf/syscall.c:5019 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142 do_el0_svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206 el0_svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624 el0t_64_sync_handler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581 Code: aa0003e3 d00038c0 91248000 97fff65f (d4210000) Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20220531215113.1100754-1-eric.dumazet@gmail.com Signed-off-by: Alexei Starovoitov commit 873a400938b31a1e443c4d94b560b78300787540 Author: Wonhyuk Yang Date: Wed May 4 11:32:03 2022 +0900 workqueue: Fix type of cpu in trace event The trace event "workqueue_queue_work" use unsigned int type for req_cpu, cpu. This casue confusing cpu number like below log. $ cat /sys/kernel/debug/tracing/trace cat-317 [001] ...: workqueue_queue_work: ... req_cpu=8192 cpu=4294967295 So, change unsigned type to signed type in the trace event. After applying this patch, cpu number will be printed as -1 instead of 4294967295 as folllows. $ cat /sys/kernel/debug/tracing/trace cat-1338 [002] ...: workqueue_queue_work: ... req_cpu=8192 cpu=-1 Cc: Baik Song An Cc: Hong Yeon Kim Cc: Taeung Song Cc: linuxgeek@linuxgeek.io Signed-off-by: Wonhyuk Yang Signed-off-by: Tejun Heo commit c4f135d643823a869becfa87539f7820ef9d5bfa Author: Tetsuo Handa Date: Wed Jun 1 16:32:47 2022 +0900 workqueue: Wrap flush_workqueue() using a macro Since flush operation synchronously waits for completion, flushing system-wide WQs (e.g. system_wq) might introduce possibility of deadlock due to unexpected locking dependency. Tejun Heo commented at [1] that it makes no sense at all to call flush_workqueue() on the shared WQs as the caller has no idea what it's gonna end up waiting for. Although there is flush_scheduled_work() which flushes system_wq WQ with "Think twice before calling this function! It's very easy to get into trouble if you don't take great care." warning message, syzbot found a circular locking dependency caused by flushing system_wq WQ [2]. Therefore, let's change the direction to that developers had better use their local WQs if flush_scheduled_work()/flush_workqueue(system_*_wq) is inevitable. Steps for converting system-wide WQs into local WQs are explained at [3], and a conversion to stop flushing system-wide WQs is in progress. Now we want some mechanism for preventing developers who are not aware of this conversion from again start flushing system-wide WQs. Since I found that WARN_ON() is complete but awkward approach for teaching developers about this problem, let's use __compiletime_warning() for incomplete but handy approach. For completeness, we will also insert WARN_ON() into __flush_workqueue() after all in-tree users stopped calling flush_scheduled_work(). Link: https://lore.kernel.org/all/YgnQGZWT%2Fn3VAITX@slm.duckdns.org/ [1] Link: https://syzkaller.appspot.com/bug?extid=bde0f89deacca7c765b8 [2] Link: https://lkml.kernel.org/r/49925af7-78a8-a3dd-bce6-cfc02e1a9236@I-love.SAKURA.ne.jp [3] Signed-off-by: Tetsuo Handa Signed-off-by: Tejun Heo commit 7bf179de5b2dfae54a6839eaf7caba44a888ee2e Author: Kevin Locke Date: Mon Jun 6 20:42:54 2022 -0600 kbuild: avoid regex RS for POSIX awk In 22f26f21774f8 awk was added to deduplicate *.mod files. The awk invocation passes -v RS='( |\n)' to match a space or newline character as the record separator. Unfortunately, POSIX states[1] > If RS contains more than one character, the results are unspecified. Some implementations (such as the One True Awk[2] used by the BSDs) do not treat RS as a regular expression. When awk does not support regex RS, build failures such as the following are produced (first error using allmodconfig): CC [M] arch/x86/events/intel/uncore.o CC [M] arch/x86/events/intel/uncore_nhmex.o CC [M] arch/x86/events/intel/uncore_snb.o CC [M] arch/x86/events/intel/uncore_snbep.o CC [M] arch/x86/events/intel/uncore_discovery.o LD [M] arch/x86/events/intel/intel-uncore.o ld: cannot find uncore_nhmex.o: No such file or directory ld: cannot find uncore_snb.o: No such file or directory ld: cannot find uncore_snbep.o: No such file or directory ld: cannot find uncore_discovery.o: No such file or directory make[3]: *** [scripts/Makefile.build:422: arch/x86/events/intel/intel-uncore.o] Error 1 make[2]: *** [scripts/Makefile.build:487: arch/x86/events/intel] Error 2 make[1]: *** [scripts/Makefile.build:487: arch/x86/events] Error 2 make: *** [Makefile:1839: arch/x86] Error 2 To avoid this, use printf(1) to produce a newline between each object path, instead of the space produced by echo(1), so that the default RS can be used by awk. [1]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/awk.html [2]: https://github.com/onetrueawk/awk Fixes: 22f26f21774f ("kbuild: get rid of duplication in *.mod files") Signed-off-by: Kevin Locke Signed-off-by: Masahiro Yamada commit 927c63e07810fe41cc0428d767ea4b59db193b80 Author: Rob Herring Date: Mon Jun 6 17:51:36 2022 -0500 dt-bindings: Drop more redundant 'maxItems/minItems' in if/then schemas Another round from new cases in 5.19-rc of removing redundant minItems/maxItems when 'items' list is specified. This time it is in if/then schemas as the meta-schema was failing to check this case. If a property has an 'items' list, then a 'minItems' or 'maxItems' with the same size as the list is redundant and can be dropped. Note that is DT schema specific behavior and not standard json-schema behavior. The tooling will fixup the final schema adding any unspecified minItems/maxItems. Signed-off-by: Rob Herring Acked-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Acked-by: Ulf Hansson Link: https://lore.kernel.org/r/20220606225137.1536010-1-robh@kernel.org commit c3c09e393a5e25fb2fd30b62f3c689e92b4343c4 Author: Rob Herring Date: Mon Jun 6 16:22:30 2022 -0500 dt-bindings: nvme: apple,nvme-ans: Drop 'maxItems' from 'apple,sart' A 'phandle' type is always a single cell, so 'maxItems: 1' is redundant. Fixes: 82b96552f15a ("dt-bindings: nvme: Add Apple ANS NVMe") Signed-off-by: Rob Herring Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/20220606212230.1360617-1-robh@kernel.org commit e3a4167c880cf889f66887a152799df4d609dd21 Author: David Sterba Date: Thu Jun 2 23:57:17 2022 +0200 btrfs: add error messages to all unrecognized mount options Almost none of the errors stemming from a valid mount option but wrong value prints a descriptive message which would help to identify why mount failed. Like in the linked report: $ uname -r v4.19 $ mount -o compress=zstd /dev/sdb /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sdb, missing codepage or helper program, or other error. $ dmesg ... BTRFS error (device sdb): open_ctree failed Errors caused by memory allocation failures are left out as it's not a user error so reporting that would be confusing. Link: https://lore.kernel.org/linux-btrfs/9c3fec36-fc61-3a33-4977-a7e207c3fa4e@gmx.de/ CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Qu Wenruo Reviewed-by: Nikolay Borisov Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 11d39e8cc43e1c6737af19ca9372e590061b5ad2 Author: Maxim Levitsky Date: Mon Jun 6 21:11:49 2022 +0300 KVM: SVM: fix tsc scaling cache logic SVM uses a per-cpu variable to cache the current value of the tsc scaling multiplier msr on each cpu. Commit 1ab9287add5e2 ("KVM: X86: Add vendor callbacks for writing the TSC multiplier") broke this caching logic. Refactor the code so that all TSC scaling multiplier writes go through a single function which checks and updates the cache. This fixes the following scenario: 1. A CPU runs a guest with some tsc scaling ratio. 2. New guest with different tsc scaling ratio starts on this CPU and terminates almost immediately. This ensures that the short running guest had set the tsc scaling ratio just once when it was set via KVM_SET_TSC_KHZ. Due to the bug, the per-cpu cache is not updated. 3. The original guest continues to run, it doesn't restore the msr value back to its own value, because the cache matches, and thus continues to run with a wrong tsc scaling ratio. Fixes: 1ab9287add5e2 ("KVM: X86: Add vendor callbacks for writing the TSC multiplier") Signed-off-by: Maxim Levitsky Message-Id: <20220606181149.103072-1-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit eae260be3a0111a28fe95923e117a55dddec0384 Author: Vitaly Kuznetsov Date: Wed Jun 1 16:43:22 2022 +0200 KVM: selftests: Make hyperv_clock selftest more stable hyperv_clock doesn't always give a stable test result, especially with AMD CPUs. The test compares Hyper-V MSR clocksource (acquired either with rdmsr() from within the guest or KVM_GET_MSRS from the host) against rdtsc(). To increase the accuracy, increase the measured delay (done with nop loop) by two orders of magnitude and take the mean rdtsc() value before and after rdmsr()/KVM_GET_MSRS. Reported-by: Maxim Levitsky Signed-off-by: Vitaly Kuznetsov Reviewed-by: Maxim Levitsky Tested-by: Maxim Levitsky Message-Id: <20220601144322.1968742-1-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit 5ba7c4c6d1c7af47a916f728bb5940669684a087 Author: Ben Gardon Date: Wed May 25 23:09:04 2022 +0000 KVM: x86/MMU: Zap non-leaf SPTEs when disabling dirty logging Currently disabling dirty logging with the TDP MMU is extremely slow. On a 96 vCPU / 96G VM backed with gigabyte pages, it takes ~200 seconds to disable dirty logging with the TDP MMU, as opposed to ~4 seconds with the shadow MMU. When disabling dirty logging, zap non-leaf parent entries to allow replacement with huge pages instead of recursing and zapping all of the child, leaf entries. This reduces the number of TLB flushes required. and reduces the disable dirty log time with the TDP MMU to ~3 seconds. Opportunistically add a WARN() to catch GFNs that are mapped at a higher level than their max level. Signed-off-by: Ben Gardon Message-Id: <20220525230904.1584480-1-bgardon@google.com> Signed-off-by: Paolo Bonzini commit 1df931d95f4dc1c11db1123e85d4e08156e46ef9 Author: Jan Beulich Date: Tue Jun 7 17:00:53 2022 +0200 x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm() As noted (and fixed) a couple of times in the past, "=@cc" outputs and clobbering of "cc" don't work well together. The compiler appears to mean to reject such, but doesn't - in its upstream form - quite manage to yet for "cc". Furthermore two similar macros don't clobber "cc", and clobbering "cc" is pointless in asm()-s for x86 anyway - the compiler always assumes status flags to be clobbered there. Fixes: 989b5db215a2 ("x86/uaccess: Implement macros for CMPXCHG on user addresses") Signed-off-by: Jan Beulich Message-Id: <485c0c0b-a3a7-0b7c-5264-7d00c01de032@suse.com> Signed-off-by: Paolo Bonzini commit cf4a8693d97a51dccf5a1557248d12d6d8be4b9e Author: Shaoqin Huang Date: Mon Jun 6 18:59:05 2022 -0600 KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots() When freeing obsolete previous roots, check prev_roots as intended, not the current root. Signed-off-by: Shaoqin Huang Fixes: 527d5cd7eece ("KVM: x86/mmu: Zap only obsolete roots if a root shadow page is zapped") Message-Id: <20220607005905.2933378-1-shaoqin.huang@intel.com> Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 2cdea19a34c2340b3aa69508804efe4e3750fcec Author: Marc Zyngier Date: Tue Jun 7 14:14:25 2022 +0100 KVM: arm64: Don't read a HW interrupt pending state in user context Since 5bfa685e62e9 ("KVM: arm64: vgic: Read HW interrupt pending state from the HW"), we're able to source the pending bit for an interrupt that is stored either on the physical distributor or on a device. However, this state is only available when the vcpu is loaded, and is not intended to be accessed from userspace. Unfortunately, the GICv2 emulation doesn't provide specific userspace accessors, and we fallback with the ones that are intended for the guest, with fatal consequences. Add a new vgic_uaccess_read_pending() accessor for userspace to use, build on top of the existing vgic_mmio_read_pending(). Reported-by: Eric Auger Reviewed-by: Eric Auger Tested-by: Eric Auger Signed-off-by: Marc Zyngier Fixes: 5bfa685e62e9 ("KVM: arm64: vgic: Read HW interrupt pending state from the HW") Link: https://lore.kernel.org/r/20220607131427.1164881-2-maz@kernel.org Cc: stable@vger.kernel.org commit 3e684903a8574ffc9475fdf13c4780a7adb506ad Author: Seth Forshee Date: Wed May 4 13:08:40 2022 -0500 entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set A livepatch transition may stall indefinitely when a kvm vCPU is heavily loaded. To the host, the vCPU task is a user thread which is spending a very long time in the ioctl(KVM_RUN) syscall. During livepatch transition, set_notify_signal() will be called on such tasks to interrupt the syscall so that the task can be transitioned. This interrupts guest execution, but when xfer_to_guest_mode_work() sees that TIF_NOTIFY_SIGNAL is set but not TIF_SIGPENDING it concludes that an exit to user mode is unnecessary, and guest execution is resumed without transitioning the task for the livepatch. This handling of TIF_NOTIFY_SIGNAL is incorrect, as set_notify_signal() is expected to break tasks out of interruptible kernel loops and cause them to return to userspace. Change xfer_to_guest_mode_work() to handle TIF_NOTIFY_SIGNAL the same as TIF_SIGPENDING, signaling to the vCPU run loop that an exit to userpsace is needed. Any pending task_work will be run when get_signal() is called from exit_to_user_mode_loop(), so there is no longer any need to run task work from xfer_to_guest_mode_work(). Suggested-by: "Eric W. Biederman" Cc: Petr Mladek Signed-off-by: Seth Forshee Message-Id: <20220504180840.2907296-1-sforshee@digitalocean.com> Signed-off-by: Paolo Bonzini commit e8bc2427018826e02add7b0ed0fc625a60390ae5 Author: Alexey Kardashevskiy Date: Wed Jun 1 03:43:28 2022 +0200 KVM: Don't null dereference ops->destroy A KVM device cleanup happens in either of two callbacks: 1) destroy() which is called when the VM is being destroyed; 2) release() which is called when a device fd is closed. Most KVM devices use 1) but Book3s's interrupt controller KVM devices (XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during the machine execution. The error handling in kvm_ioctl_create_device() assumes destroy() is always defined which leads to NULL dereference as discovered by Syzkaller. This adds a checks for destroy!=NULL and adds a missing release(). This is not changing kvm_destroy_devices() as devices with defined release() should have been removed from the KVM devices list by then. Suggested-by: Paolo Bonzini Signed-off-by: Alexey Kardashevskiy Signed-off-by: Paolo Bonzini commit 304791255a2dc1c9be7e7c8a6cbdb31b6847b0e5 Author: Scott Mayhew Date: Wed Jun 1 13:34:49 2022 -0400 sunrpc: set cl_max_connect when cloning an rpc_clnt If the initial attempt at trunking detection using the krb5i auth flavor fails with -EACCES, -NFS4ERR_CLID_INUSE, or -NFS4ERR_WRONGSEC, then the NFS client tries again using auth_sys, cloning the rpc_clnt in the process. If this second attempt at trunking detection succeeds, then the resulting nfs_client->cl_rpcclient winds up having cl_max_connect=0 and subsequent attempts to add additional transport connections to the rpc_clnt will fail with a message similar to the following being logged: [502044.312640] SUNRPC: reached max allowed number (0) did not add transport to server: 192.168.122.3 Signed-off-by: Scott Mayhew Fixes: dc48e0abee24 ("SUNRPC enforce creation of no more than max_connect xprts") Signed-off-by: Anna Schumaker commit e3fe65e0d3671ee5ae8a2723e429ee4830a7c89c Author: sunliming Date: Thu Jun 2 10:48:05 2022 +0800 KVM: arm64: Fix inconsistent indenting Fix the following smatch warnings: arch/arm64/kvm/vmid.c:62 flush_context() warn: inconsistent indenting Reported-by: kernel test robot Signed-off-by: sunliming Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220602024805.511457-1-sunliming@kylinos.cn commit 039f49c4cafb785504c678f28664d088e0108d35 Author: Marc Zyngier Date: Sat May 28 12:38:12 2022 +0100 KVM: arm64: Always start with clearing SME flag on load On each vcpu load, we set the KVM_ARM64_HOST_SME_ENABLED flag if SME is enabled for EL0 on the host. This is used to restore the correct state on vpcu put. However, it appears that nothing ever clears this flag. Once set, it will stick until the vcpu is destroyed, which has the potential to spuriously enable SME for userspace. As it turns out, this is due to the SME code being more or less copied from SVE, and inheriting the same shortcomings. We never saw the issue because nothing uses SME, and the amount of testing is probably still pretty low. Fixes: 861262ab8627 ("KVM: arm64: Handle SME host state when running guests") Signed-off-by: Marc Zyngier Reviwed-by: Mark Brown Link: https://lore.kernel.org/r/20220528113829.1043361-3-maz@kernel.org commit d52d165d67c5aa26c8c89909003c94a66492d23d Author: Marc Zyngier Date: Sat May 28 12:38:11 2022 +0100 KVM: arm64: Always start with clearing SVE flag on load On each vcpu load, we set the KVM_ARM64_HOST_SVE_ENABLED flag if SVE is enabled for EL0 on the host. This is used to restore the correct state on vpcu put. However, it appears that nothing ever clears this flag. Once set, it will stick until the vcpu is destroyed, which has the potential to spuriously enable SVE for userspace. We probably never saw the issue because no VMM uses SVE, but that's still pretty bad. Unconditionally clearing the flag on vcpu load addresses the issue. Fixes: 8383741ab2e7 ("KVM: arm64: Get rid of host SVE tracking/saving") Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20220528113829.1043361-2-maz@kernel.org commit ac6888ac5a11c0a47d1f1da4b7809c0c595fdc5d Author: Eddie James Date: Mon Jun 6 13:54:55 2022 -0500 hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active Unbinding the driver or removing the parent device at the same time as using the OCC active sysfs file can cause the driver to unregister the hwmon device twice. Prevent this by locking the occ mutex in the shutdown function. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220606185455.21126-1-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit 5e3f89ad8e0cbd75aa3479e9ceb96d9e1c5585b8 Author: Rob Herring Date: Mon Jun 6 16:22:22 2022 -0500 dt-bindings: hwmon: ti,tmp401: Drop 'items' from 'ti,n-factor' property 'ti,n-factor' is a scalar type, so 'items' should not be used as that is for arrays/matrix. A pending meta-schema change will catch future cases. Fixes: bd90c5b93950 ("dt-bindings: hwmon: Add TMP401, TMP411 and TMP43x") Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220606212223.1360395-1-robh@kernel.org Signed-off-by: Guenter Roeck commit 53ee5d7b4523019a1bc1f3d41235234d1f3f5ada Merge: d5ea7544c32ba 2abdf9f80019e Author: Takashi Iwai Date: Tue Jun 7 14:11:38 2022 +0200 Merge tag 'asoc-fix-v5.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 A few more fixes for v5.19 which came in during the second half of the merge window, again nothing that's really remarkable outside of the individual drivers. commit cf67838c4422eab826679b076dad99f96152b4de Author: Lina Wang Date: Mon Jun 6 14:45:17 2022 +0800 selftests net: fix bpf build error bpf_helpers.h has been moved to tools/lib/bpf since 5.10, so add more including path. Fixes: edae34a3ed92 ("selftests net: add UDP GRO fraglist + bpf self-tests") Reported-by: kernel test robot Signed-off-by: Lina Wang Acked-by: Song Liu Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/20220606064517.8175-1-lina.wang@mediatek.com Signed-off-by: Paolo Abeni commit 1d0811b03eb30b2f0793acaa96c6ce90b8b9c87a Author: Helge Deller Date: Tue Jun 7 12:57:58 2022 +0200 parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI Fix this build error noticed by the kernel test robot: drivers/video/console/sticore.c:1132:5: error: redefinition of 'fb_is_primary_device' arch/parisc/include/asm/fb.h:18:19: note: previous definition of 'fb_is_primary_device' Signed-off-by: Helge Deller Reported-by: kernel test robot Cc: stable@vger.kernel.org # v5.10+ commit 662a80946ce13633ae90a55379f1346c10f0c432 Author: Kuniyuki Iwashima Date: Sun Jun 5 16:23:25 2022 -0700 af_unix: Fix a data-race in unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to use unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise KCSAN will report a data-race. Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue") Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20220605232325.11804-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit 5e74a4b3ec1816e3bbfd715d46ae29d2508079cb Author: Christophe JAILLET Date: Sun Jun 5 22:50:48 2022 +0200 stmmac: intel: Fix an error handling path in intel_eth_pci_probe() When the managed API is used, there is no need to explicitly call pci_free_irq_vectors(). This looks to be a left-over from the commit in the Fixes tag. Only the .remove() function had been updated. So remove this unused function call and update goto label accordingly. Fixes: 8accc467758e ("stmmac: intel: use managed PCI function on probe and resume") Signed-off-by: Christophe JAILLET Reviewed-by: Wong Vee Khee Link: https://lore.kernel.org/r/1ac9b6787b0db83b0095711882c55c77c8ea8da0.1654462241.git.christophe.jaillet@wanadoo.fr Signed-off-by: Paolo Abeni commit d5ea7544c32ba27c2c5826248e4ff58bd50a2518 Author: huangwenhui Date: Tue Jun 7 14:56:31 2022 +0800 ALSA: hda/conexant - Fix loopback issue with CX20632 On a machine with CX20632, Alsamixer doesn't have 'Loopback Mixing' and 'Line'. Signed-off-by: huangwenhui Cc: Link: https://lore.kernel.org/r/20220607065631.10708-1-huangwenhuia@uniontech.com Signed-off-by: Takashi Iwai commit 16bc4d196b2a8960cac3bdfd4c98d72c44ab043b Author: Peter Geis Date: Mon Jun 6 12:30:23 2022 -0400 arm64: dts: rockchip: Fix ethernet on production Quartz64-B The production Quartz64 Model B has compatibility issues when using rgmii-id mode. Switch to rgmii mode and use the SoC's delays to ensure full compatibility. Reported-by: Frank Mankel Fixes: dcc8c66bef79 ("arm64: dts: rockchip: add Pine64 Quartz64-B device tree") Signed-off-by: Peter Geis Tested-by: Frank Mankel Link: https://lore.kernel.org/r/20220606163023.3677147-1-pgwipeout@gmail.com Signed-off-by: Heiko Stuebner commit 118f767413ada4eef7825fbd4af7c0866f883441 Author: Kamal Heib Date: Wed May 25 16:20:29 2022 +0300 RDMA/qedr: Fix reporting QP timeout attribute Make sure to save the passed QP timeout attribute when the QP gets modified, so when calling query QP the right value is reported and not the converted value that is required by the firmware. This issue was found while running the pyverbs tests. Fixes: cecbcddf6461 ("qedr: Add support for QP verbs") Link: https://lore.kernel.org/r/20220525132029.84813-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Acked-by: Michal Kalderon  Signed-off-by: Leon Romanovsky commit 77991645952c21962a095910c51fe0f73d35bf91 Author: Roger Knecht Date: Sat May 21 14:47:45 2022 +0200 crc-itu-t: fix typo in CRC ITU-T polynomial comment The code comment says that the polynomial is x^16 + x^12 + x^15 + 1, but the correct polynomial is x^16 + x^12 + x^5 + 1. Quoting from page 2 in the ITU-T V.41 specification [1]: 2 Encoding and checking process The service bits and information bits, taken in conjunction, correspond to the coefficients of a message polynomial having terms from x^(n-1) (n = total number of bits in a block or sequence) down to x^16. This polynomial is divided, modulo 2, by the generating polynomial x^16 + x^12 + x^5 + 1. The hex (truncated) polynomial 0x1021 and CRC code implementation are correct, however. [1] https://www.itu.int/rec/T-REC-V.41-198811-I/en Signed-off-by: Roger Knecht Acked-by: Randy Dunlap Signed-off-by: Jason A. Donenfeld commit dbac14a5a05ff8e1ce7c0da0e1f520ce39ec62ea Author: Masahiro Yamada Date: Mon Jun 6 13:59:20 2022 +0900 xen: unexport __init-annotated xen_xlate_map_ballooned_pages() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because none of the in-tree call-sites (arch/arm/xen/enlighten.c, arch/x86/xen/grant-table.c) is compiled as modular. Fixes: 243848fc018c ("xen/grant-table: Move xlated_setup_gnttab_pages to common place") Reported-by: Stephen Rothwell Signed-off-by: Masahiro Yamada Reviewed-by: Oleksandr Tyshchenko Acked-by: Stefano Stabellini Link: https://lore.kernel.org/r/20220606045920.4161881-1-masahiroy@kernel.org Signed-off-by: Juergen Gross commit 2e45f2185283a2d927ef2cdbdc246cd65740c8df Author: Yong Zhi Date: Mon Jun 6 15:42:32 2022 -0500 ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID Add HD Audio PCI ID for Intel Meteorlake platform. [ corrected the hex number to lower letters by tiwai ] Signed-off-by: Kai Vehmanen Signed-off-by: Yong Zhi Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220606204232.144296-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 680c0aee97690c3f595e074a5f677599aac5d26b Author: Chester Lin Date: Wed May 25 09:49:22 2022 +0800 MAINTAINERS: add a new reviewer for S32G Add the NXP S32 Linux team as a designated review group of s32g. Signed-off-by: Chester Lin Link: https://lore.kernel.org/r/20220525161422.14156-1-clin@suse.com commit 4266e2f70d4388b8c6a95056169954ff049ced94 Author: Fabio Estevam Date: Sat May 14 11:35:05 2022 -0300 arm64: s32g2: Pass unit name to soc node Pass unit name to soc node to fix the following W=1 build warning: arch/arm64/boot/dts/freescale/s32g2.dtsi:82.6-123.4: Warning (unit_address_vs_reg): /soc: node has a reg or ranges property, but no unit name Signed-off-by: Fabio Estevam Reviewed-by: Chester Lin Signed-off-by: Chester Lin Link: https://lore.kernel.org/r/20220514143505.1554813-1-festevam@gmail.com commit e71e60cd74df9386c3f684c54888f2367050b831 Merge: f2906aa863381 e15db62bc5648 Author: Linus Torvalds Date: Mon Jun 6 17:56:18 2022 -0700 Merge tag 'dma-mapping-5.19-2022-06-06' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - fix a regressin in setting swiotlb ->force_bounce (me) - make dma-debug less chatty (Rob Clark) * tag 'dma-mapping-5.19-2022-06-06' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: fix setting ->force_bounce dma-debug: make things less spammy under memory pressure commit 8ea21823aa584b55ba4b861307093b78054b0c1b Author: Shyam Prasad N Date: Tue May 31 12:31:05 2022 +0000 cifs: return errors during session setup during reconnects During reconnects, we check the return value from cifs_negotiate_protocol, and have handlers for both success and failures. But if that passes, and cifs_setup_session returns any errors other than -EACCES, we do not handle that. This fix adds a handler for that, so that we don't go ahead and try a tree_connect on a failed session. Signed-off-by: Shyam Prasad N Reviewed-by: Enzo Matsumiya Cc: stable@vger.kernel.org Signed-off-by: Steve French commit b8d91399775c55162073bb2aca061ec42e3d4bc1 Author: Miaoqian Lin Date: Fri Jun 3 17:32:38 2022 +0400 net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 55954f3bfdac ("net: ethernet: bgmac: move BCMA MDIO Phy code into a separate file") Signed-off-by: Miaoqian Lin Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220603133238.44114-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit 41bdb8a0cc4722d7e00606a49b35921652821cea Merge: c76acfb7e19dc d7970039d87c9 Author: Jakub Kicinski Date: Mon Jun 6 14:27:39 2022 -0700 Merge branch 'amt-fix-several-bugs-in-amt_rcv' Taehee Yoo says: ==================== amt: fix several bugs in amt_rcv() This series fixes bugs in amt_rcv(). First patch fixes pskb_may_pull() issue. Some functions missed to call pskb_may_pull() and uses wrong parameter of pskb_may_pull(). Second patch fixes possible null-ptr-deref in amt_rcv(). If there is no amt private data in sock, skb will be freed. And it increases stats. But in order to increase stats, amt private data is needed. So, uninitialised pointer will be used at that point. Third patch fixes wrong definition of type_str[] in amt.c ==================== Link: https://lore.kernel.org/r/20220602140108.18329-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit d7970039d87c926bb648982e920cb9851c19f3e1 Author: Taehee Yoo Date: Thu Jun 2 14:01:08 2022 +0000 amt: fix wrong type string definition amt message type definition starts from 1, not 0. But type_str[] starts from 0. So, it prints wrong type information. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit d16207f92a4a823c48b4ea953ad51f4483456768 Author: Taehee Yoo Date: Thu Jun 2 14:01:07 2022 +0000 amt: fix possible null-ptr-deref in amt_rcv() When amt interface receives amt message, it tries to obtain amt private data from sock. If there is no amt private data, it frees an skb immediately. After kfree_skb(), it increases the rx_dropped stats. But in order to use rx_dropped, amt private data is needed. So, it makes amt_rcv() to do not increase rx_dropped stats when it can not obtain amt private data. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 1a1a0e80e005 ("amt: fix possible memory leak in amt_rcv()") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit f55a07074fdd38cab8c097ac5bd397d68eff733c Author: Taehee Yoo Date: Thu Jun 2 14:01:06 2022 +0000 amt: fix wrong usage of pskb_may_pull() It adds missing pskb_may_pull() in amt_update_handler() and amt_multicast_data_handler(). And it fixes wrong parameter of pskb_may_pull() in amt_advertisement_handler() and amt_membership_query_handler(). Reported-by: Jakub Kicinski Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit e54a4424925a27ed94dff046db3ce5caf4b1e748 Author: Brian Norris Date: Mon Feb 28 12:25:32 2022 -0800 drm/atomic: Force bridge self-refresh-exit on CRTC switch It's possible to change which CRTC is in use for a given connector/encoder/bridge while we're in self-refresh without fully disabling the connector/encoder/bridge along the way. This can confuse the bridge encoder/bridge, because (a) it needs to track the SR state (trying to perform "active" operations while the panel is still in SR can be Bad(TM)); and (b) it tracks the SR state via the CRTC state (and after the switch, the previous SR state is lost). Thus, we need to either somehow carry the self-refresh state over to the new CRTC, or else force an encoder/bridge self-refresh transition during such a switch. I choose the latter, so we disable the encoder (and exit PSR) before attaching it to the new CRTC (where we can continue to assume a clean (non-self-refresh) state). This fixes PSR issues seen on Rockchip RK3399 systems with drivers/gpu/drm/bridge/analogix/analogix_dp_core.c. Change in v2: - Drop "->enable" condition; this could possibly be "->active" to reflect the intended hardware state, but it also is a little over-specific. We want to make a transition through "disabled" any time we're exiting PSR at the same time as a CRTC switch. (Thanks Liu Ying) Cc: Liu Ying Cc: Fixes: 1452c25b0e60 ("drm: Add helpers to kick off self refresh mode in drivers") Signed-off-by: Brian Norris Reviewed-by: Sean Paul Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20220228122522.v2.2.Ic15a2ef69c540aee8732703103e2cff51fb9c399@changeid commit ca871659ec1606d33b1e76de8d4cf924cf627e34 Author: Brian Norris Date: Mon Feb 28 12:25:31 2022 -0800 drm/bridge: analogix_dp: Support PSR-exit to disable transition Most eDP panel functions only work correctly when the panel is not in self-refresh. In particular, analogix_dp_bridge_disable() tends to hit AUX channel errors if the panel is in self-refresh. Given the above, it appears that so far, this driver assumes that we are never in self-refresh when it comes time to fully disable the bridge. Prior to commit 846c7dfc1193 ("drm/atomic: Try to preserve the crtc enabled state in drm_atomic_remove_fb, v2."), this tended to be true, because we would automatically disable the pipe when framebuffers were removed, and so we'd typically disable the bridge shortly after the last display activity. However, that is not guaranteed: an idle (self-refresh) display pipe may be disabled, e.g., when switching CRTCs. We need to exit PSR first. Stable notes: this is definitely a bugfix, and the bug has likely existed in some form for quite a while. It may predate the "PSR helpers" refactor, but the code looked very different before that, and it's probably not worth rewriting the fix. Cc: Fixes: 6c836d965bad ("drm/rockchip: Use the helpers for PSR") Signed-off-by: Brian Norris Reviewed-by: Sean Paul Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20220228122522.v2.1.I161904be17ba14526f78536ccd78b85818449b51@changeid commit 7b6c7a877cc616bc7dc9cd39646fe454acbed48b Author: Josh Poimboeuf Date: Fri Jun 3 08:04:44 2022 -0700 x86/ftrace: Remove OBJECT_FILES_NON_STANDARD usage The file-wide OBJECT_FILES_NON_STANDARD annotation is used with CONFIG_FRAME_POINTER to tell objtool to skip the entire file when frame pointers are enabled. However that annotation is now deprecated because it doesn't work with IBT, where objtool runs on vmlinux.o instead of individual translation units. Instead, use more fine-grained function-specific annotations: - The 'save_mcount_regs' macro does funny things with the frame pointer. Use STACK_FRAME_NON_STANDARD_FP to tell objtool to ignore the functions using it. - The return_to_handler() "function" isn't actually a callable function. Instead of being called, it's returned to. The real return address isn't on the stack, so unwinding is already doomed no matter which unwinder is used. So just remove the STT_FUNC annotation, telling objtool to ignore it. That also removes the implicit ANNOTATE_NOENDBR, which now needs to be made explicit. Fixes the following warning: vmlinux.o: warning: objtool: __fentry__+0x16: return with modified stack frame Fixes: ed53a0d97192 ("x86/alternative: Use .ibt_endbr_seal to seal indirect calls") Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/b7a7a42fe306aca37826043dac89e113a1acdbac.1654268610.git.jpoimboe@kernel.org commit dcea997beed694cbd8705100ca1a6eb0d886de69 Author: Josh Poimboeuf Date: Wed Jun 1 17:42:22 2022 -0700 faddr2line: Fix overlapping text section failures, the sequel If a function lives in a section other than .text, but .text also exists in the object, faddr2line may wrongly assume .text. This can result in comically wrong output. For example: $ scripts/faddr2line vmlinux.o enter_from_user_mode+0x1c enter_from_user_mode+0x1c/0x30: find_next_bit at /home/jpoimboe/git/linux/./include/linux/find.h:40 (inlined by) perf_clear_dirty_counters at /home/jpoimboe/git/linux/arch/x86/events/core.c:2504 Fix it by passing the section name to addr2line, unless the object file is vmlinux, in which case the symbol table uses absolute addresses. Fixes: 1d1a0e7c5100 ("scripts/faddr2line: Fix overlapping text section failures") Reported-by: Peter Zijlstra Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/7d25bc1408bd3a750ac26e60d2f2815a5f4a8363.1654130536.git.jpoimboe@kernel.org commit c2f75a43f5ae48b9babeb5b82c9f23fe18d3d144 Author: Josh Poimboeuf Date: Wed Jun 1 09:42:12 2022 -0700 objtool: Fix obsolete reference to CONFIG_X86_SMAP CONFIG_X86_SMAP no longer exists. For objtool's purposes it has been replaced with CONFIG_HAVE_UACCESS_VALIDATION. Fixes: 03f16cd020eb ("objtool: Add CONFIG_OBJTOOL") Reported-by: Lukas Bulwahn Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/44c57668768c1ba1b4ba1ff541ec54781636e07c.1654101721.git.jpoimboe@kernel.org commit 3a41c64d9c1185a2f3a184015e2a9b78bfc99c71 Author: Pablo Neira Ayuso Date: Mon Jun 6 17:31:29 2022 +0200 netfilter: nf_tables: bail out early if hardware offload is not supported If user requests for NFT_CHAIN_HW_OFFLOAD, then check if either device provides the .ndo_setup_tc interface or there is an indirect flow block that has been registered. Otherwise, bail out early from the preparation phase. Moreover, validate that family == NFPROTO_NETDEV and hook is NF_NETDEV_INGRESS. Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso commit a2d2bfc9d56513684260b6aab26a2e0b56b09d92 Author: Lukas Bulwahn Date: Wed Jun 1 06:17:46 2022 +0200 MAINTAINERS: rectify entries for ARM DRM DRIVERS after dt conversion The three commits: 36fd2a65bcaf ("dt-bindings: display: convert Arm HDLCD to DT schema") 0f6983509ea1 ("dt-bindings: display: convert Arm Komeda to DT schema") 2c8b082a3ab1 ("dt-bindings: display: convert Arm Mali-DP to DT schema") convert the arm display dt-bindings, arm,*.txt to arm,*.yaml, but miss to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about broken references. Repair these file references in ARM HDLCD DRM DRIVER, ARM KOMEDA DRM-KMS DRIVER and ARM MALI-DP DRM DRIVER. Signed-off-by: Lukas Bulwahn Acked-by: Andre Przywara Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220601041746.22986-1-lukas.bulwahn@gmail.com commit 09fed02c20a659e15c9b47a52e8cf2dffa41cda9 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:42 2022 +0100 MAINTAINERS: update snps,axs10x-reset.yaml reference Changeset 820f722c05dd ("dt-bindings: reset: snps,axs10x-reset: Convert to yaml") renamed: Documentation/devicetree/bindings/reset/snps,axs10x-reset.txt to: Documentation/devicetree/bindings/reset/snps,axs10x-reset.yaml. Update its cross-reference accordingly. Fixes: 820f722c05dd ("dt-bindings: reset: snps,axs10x-reset: Convert to yaml") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/56560a2bcc06af94d36a28ed2cfdb25de481eee5.1654529011.git.mchehab@kernel.org commit e5f580e72498ef634ae293c8d4ba7184f5191c74 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:40 2022 +0100 MAINTAINERS: update dongwoon,dw9807-vcm.yaml reference Changeset a1f4626b282d ("media: dt-bindings: Convert Dongwoon dw9807-vcm bindings to json-schema") renamed: Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.txt to: Documentation/devicetree/bindings/media/i2c/dongwoon,dw9807-vcm.yaml. Update its cross-reference accordingly. Fixes: a1f4626b282d ("media: dt-bindings: Convert Dongwoon dw9807-vcm bindings to json-schema") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/89f11772dd4afe9700d6cbbb3da8749eb98b396a.1654529011.git.mchehab@kernel.org commit 7470ce60be24de8117b71614a3d610b8619f2108 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:39 2022 +0100 MAINTAINERS: update cortina,gemini-ethernet.yaml reference Changeset 208b65f7b5cc ("dt-bindings: net: convert net/cortina,gemini-ethernet to yaml") renamed: Documentation/devicetree/bindings/net/cortina,gemini-ethernet.txt to: Documentation/devicetree/bindings/net/cortina,gemini-ethernet.yaml. Update its cross-reference accordingly. Fixes: 208b65f7b5cc ("dt-bindings: net: convert net/cortina,gemini-ethernet to yaml") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/d27b5d508fb757147b720bf573ce5a2e3fc5920e.1654529011.git.mchehab@kernel.org commit 69c2533eb9dfc650baa5f0f624ee4e7cc57afd7a Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:27 2022 +0100 dt-bindings: mfd: rk808: update rockchip,rk808.yaml reference Changeset 6c38ca03406e ("dt-bindings: mfd: rk808: Convert bindings to yaml") renamed: Documentation/devicetree/bindings/mfd/rk808.txt to: Documentation/devicetree/bindings/mfd/rockchip,rk808.yaml. Update its cross-reference accordingly. Fixes: 6c38ca03406e ("dt-bindings: mfd: rk808: Convert bindings to yaml") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/417281c270e098eefed763859480014bec75c883.1654529011.git.mchehab@kernel.org commit 47a22a251543f4710b954f4b36f3e6063017a82b Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:26 2022 +0100 dt-bindings: reset: update st,stih407-powerdown.yaml references Changeset 2ca065dc9468 ("dt-bindings: reset: st,sti-powerdown: Convert to yaml") renamed: Documentation/devicetree/bindings/reset/st,sti-powerdown.txt to: Documentation/devicetree/bindings/reset/st,stih407-powerdown.yaml. Update the cross-references accordingly. Fixes: 2ca065dc9468 ("dt-bindings: reset: st,sti-powerdown: Convert to yaml") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/debdd5a9a1bfa0cf1c7e9c45da32edbc2ac2d10a.1654529011.git.mchehab@kernel.org commit 71a834b7f744fab6ae83dc1bfc22030b5baa5dd5 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:25 2022 +0100 dt-bindings: arm: update vexpress-config.yaml references Changeset 7e8339b5162f ("dt-bindings: arm: convert vexpress-config to DT schema") renamed: Documentation/devicetree/bindings/arm/vexpress-sysreg.txt to: Documentation/devicetree/bindings/arm/vexpress-config.yaml. Update the cross-references accordingly. Fixes: 7e8339b5162f ("dt-bindings: arm: convert vexpress-config to DT schema") Signed-off-by: Mauro Carvalho Chehab Acked-by: Guenter Roeck Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/7020edd9e183652249fc95bf61a1055cc342a4dc.1654529011.git.mchehab@kernel.org commit 7e40381d8a33e41e347cea5bdd000091653000c6 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:24 2022 +0100 dt-bindings: interrupt-controller: update brcm,l2-intc.yaml reference Changeset 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML") renamed: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.txt to: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.yaml. Update its cross-reference accordingly. Fixes: 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/a40c02a7aaea91ea7b6ce24b6bc574ae5bcf4cf6.1654529011.git.mchehab@kernel.org commit e0b5c5984d4810733b7c24a3d16c904fffc086d2 Author: Mauro Carvalho Chehab Date: Mon Jun 6 16:25:23 2022 +0100 dt-bindings: mfd: bd9571mwv: update rohm,bd9571mwv.yaml reference Changeset 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema") renamed: Documentation/devicetree/bindings/mfd/bd9571mwv.txt to: Documentation/devicetree/bindings/mfd/rohm,bd9571mwv.yaml. Update its cross-reference accordingly. Fixes: 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/1906a4d935eab57c10ce09358eae02175ce4abb7.1654529011.git.mchehab@kernel.org commit c76acfb7e19dcc3a0964e0563770b1d11b8d4540 Author: Tan Tee Min Date: Thu May 26 17:03:47 2022 +0800 net: phy: dp83867: retrigger SGMII AN when link change There is a limitation in TI DP83867 PHY device where SGMII AN is only triggered once after the device is booted up. Even after the PHY TPI is down and up again, SGMII AN is not triggered and hence no new in-band message from PHY to MAC side SGMII. This could cause an issue during power up, when PHY is up prior to MAC. At this condition, once MAC side SGMII is up, MAC side SGMII wouldn`t receive new in-band message from TI PHY with correct link status, speed and duplex info. As suggested by TI, implemented a SW solution here to retrigger SGMII Auto-Neg whenever there is a link change. v2: Add Fixes tag in commit message. Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") Cc: # 5.4.x Signed-off-by: Sit, Michael Wei Hong Reviewed-by: Voon Weifeng Signed-off-by: Tan Tee Min Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220526090347.128742-1-tee.min.tan@linux.intel.com Signed-off-by: Jakub Kicinski commit e0469d6581aecb0e34e2ec64f39f88e6985cc52f Author: Takashi Iwai Date: Mon Jun 6 18:09:10 2022 +0200 ALSA: usb-audio: Set up (implicit) sync for Saffire 6 Focusrite Saffire 6 has fixed audioformat quirks with multiple endpoints assigned to a single altsetting. Unfortunately the generic parser couldn't detect the sync endpoint correctly as the implicit sync due to the missing EP attribute bits. In the former kernels, it used to work somehow casually, but it's been broken for a while after the large code change in 5.11. This patch cures the regression by the following: - Allow the static quirk table to provide the sync EP information; we just need to fill the fields and let the generic parser skipping parsing if sync_ep is already set. - Add the sync endpoint information to the entry for Saffire 6. Fixes: 7b0efea4baf0 ("ALSA: usb-audio: Add missing ep_idx in fixed EP quirks") Reported-and-tested-by: André Kapelrud Cc: Link: https://lore.kernel.org/r/20220606160910.6926-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit efb75df105e82f076a85b9f2d81410428bcb55fc Author: Takashi Iwai Date: Mon Jun 6 18:09:09 2022 +0200 ALSA: usb-audio: Skip generic sync EP parse for secondary EP When ep_idx is already non-zero, it means usually a capture stream that is set up explicity by a fixed-format quirk, and applying the check for generic (non-implicit-fb) sync EPs might hit incorrectly, resulting in a bogus sync endpoint for the capture stream. This patch adds a check for the ep_idx and skip if it's a secondary endpoint. It's a part of the fixes for regressions on Saffire 6. Fixes: 7b0efea4baf0 ("ALSA: usb-audio: Add missing ep_idx in fixed EP quirks") Reported-and-tested-by: André Kapelrud Cc: Link: https://lore.kernel.org/r/20220606160910.6926-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 880265c77ac415090090d1fe72a188fee71cb458 Author: Trond Myklebust Date: Tue May 31 11:03:07 2022 -0400 pNFS: Avoid a live lock condition in pnfs_update_layout() If we're about to send the first layoutget for an empty layout, we want to make sure that we drain out the existing pending layoutget calls first. The reason is that these layouts may have been already implicitly returned to the server by a recall to which the client gave a NFS4ERR_NOMATCHING_LAYOUT response. The problem is that wait_var_event_killable() could in principle see the plh_outstanding count go back to '1' when the first process to wake up starts sending a new layoutget. If it fails to get a layout, then this loop can continue ad infinitum... Fixes: 0b77f97a7e42 ("NFSv4/pnfs: Fix layoutget behaviour after invalidation") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit fe44fb23d6ccde4c914c44ef74ab8d9d9ba02bea Author: Trond Myklebust Date: Tue May 31 11:03:06 2022 -0400 pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE If the server tells us that a pNFS layout is not available for a specific file, then we should not keep pounding it with further layoutget requests. Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 9dd732e0bdf538b1b76dc7c157e2b5e560ff30d3 Author: Pablo Neira Ayuso Date: Mon Jun 6 17:15:57 2022 +0200 netfilter: nf_tables: memleak flow rule from commit path Abort path release flow rule object, however, commit path does not. Update code to destroy these objects before releasing the transaction. Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso commit c271cc9febaaa1bcbc0842d1ee30466aa6148ea8 Author: Pablo Neira Ayuso Date: Sun Jun 5 13:40:06 2022 +0200 netfilter: nf_tables: release new hooks on unsupported flowtable flags Release the list of new hooks that are pending to be registered in case that unsupported flowtable flags are provided. Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Signed-off-by: Pablo Neira Ayuso commit d0c94bef70e71e364c0a016b0e92307cd4d1d719 Author: Cristian Marussi Date: Mon May 30 12:52:36 2022 +0100 firmware: arm_scmi: Remove all the unused local variables While using SCMI iterators helpers a few local automatic variables are defined but then used only as input for sizeof operators. cppcheck is fooled to complain about this with: | drivers/firmware/arm_scmi/sensors.c:341:48: warning: Variable 'msg' is | not assigned a value. [unassignedVariable] | struct scmi_msg_sensor_list_update_intervals *msg; Even though this is an innocuos warning, since the uninitialized variable is at the end never used in the reported cases, fix these occurences all over SCMI stack to avoid keeping unneeded objects on the stack. Link: https://lore.kernel.org/r/20220530115237.277077-1-cristian.marussi@arm.com Cc: Dan Carpenter Cc: Sudeep Holla Reported-by: kernel test robot Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 122839b58a089ff7f231759e2c8f63790724cae2 Author: Cristian Marussi Date: Mon May 23 18:15:59 2022 +0100 firmware: arm_scmi: Relax base protocol sanity checks on the protocol list Even though malformed replies from firmware must be treated carefully to avoid memory corruption in the kernel, some out-of-spec SCMI replies can be tolerated to avoid breaking existing deployed system, as long as they won't cause memory issues. Relax the sanity checks on the recieved protocol list in the base protocol to avoid breaking one of the deployed platform whose firmware is not easily upgradable currently. Link: https://lore.kernel.org/r/20220523171559.472112-1-cristian.marussi@arm.com Cc: Etienne Carriere Cc: Sudeep Holla Reported-by: Nicolas Frattaroli Tested-By: Frank Wunderlich Acked-by: Michael Riesch Acked-by: Etienne Carriere Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 0591f04036218d572d54349ea8c7914ad9c82b2b Author: Qu Wenruo Date: Wed May 18 13:03:09 2022 +0800 btrfs: prevent remounting to v1 space cache for subpage mount Upstream commit 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount") forces subpage mount to use v2 cache, to avoid deprecated v1 cache which doesn't support subpage properly. But there is a loophole that user can still remount to v1 cache. The existing check will only give users a warning, but does not really prevent to do the remount. Although remounting to v1 will not cause any problems since the v1 cache will always be marked invalid when mounted with a different page size, it's still better to prevent v1 cache at all for subpage mounts. Fixes: 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 31e70e527806c546a72262f2fc3d982ee23c42d3 Author: Filipe Manana Date: Wed May 18 10:41:48 2022 +0100 btrfs: fix hang during unmount when block group reclaim task is running When we start an unmount, at close_ctree(), if we have the reclaim task running and in the middle of a data block group relocation, we can trigger a deadlock when stopping an async reclaim task, producing a trace like the following: [629724.498185] task:kworker/u16:7 state:D stack: 0 pid:681170 ppid: 2 flags:0x00004000 [629724.499760] Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] [629724.501267] Call Trace: [629724.501759] [629724.502174] __schedule+0x3cb/0xed0 [629724.502842] schedule+0x4e/0xb0 [629724.503447] btrfs_wait_on_delayed_iputs+0x7c/0xc0 [btrfs] [629724.504534] ? prepare_to_wait_exclusive+0xc0/0xc0 [629724.505442] flush_space+0x423/0x630 [btrfs] [629724.506296] ? rcu_read_unlock_trace_special+0x20/0x50 [629724.507259] ? lock_release+0x220/0x4a0 [629724.507932] ? btrfs_get_alloc_profile+0xb3/0x290 [btrfs] [629724.508940] ? do_raw_spin_unlock+0x4b/0xa0 [629724.509688] btrfs_async_reclaim_metadata_space+0x139/0x320 [btrfs] [629724.510922] process_one_work+0x252/0x5a0 [629724.511694] ? process_one_work+0x5a0/0x5a0 [629724.512508] worker_thread+0x52/0x3b0 [629724.513220] ? process_one_work+0x5a0/0x5a0 [629724.514021] kthread+0xf2/0x120 [629724.514627] ? kthread_complete_and_exit+0x20/0x20 [629724.515526] ret_from_fork+0x22/0x30 [629724.516236] [629724.516694] task:umount state:D stack: 0 pid:719055 ppid:695412 flags:0x00004000 [629724.518269] Call Trace: [629724.518746] [629724.519160] __schedule+0x3cb/0xed0 [629724.519835] schedule+0x4e/0xb0 [629724.520467] schedule_timeout+0xed/0x130 [629724.521221] ? lock_release+0x220/0x4a0 [629724.521946] ? lock_acquired+0x19c/0x420 [629724.522662] ? trace_hardirqs_on+0x1b/0xe0 [629724.523411] __wait_for_common+0xaf/0x1f0 [629724.524189] ? usleep_range_state+0xb0/0xb0 [629724.524997] __flush_work+0x26d/0x530 [629724.525698] ? flush_workqueue_prep_pwqs+0x140/0x140 [629724.526580] ? lock_acquire+0x1a0/0x310 [629724.527324] __cancel_work_timer+0x137/0x1c0 [629724.528190] close_ctree+0xfd/0x531 [btrfs] [629724.529000] ? evict_inodes+0x166/0x1c0 [629724.529510] generic_shutdown_super+0x74/0x120 [629724.530103] kill_anon_super+0x14/0x30 [629724.530611] btrfs_kill_super+0x12/0x20 [btrfs] [629724.531246] deactivate_locked_super+0x31/0xa0 [629724.531817] cleanup_mnt+0x147/0x1c0 [629724.532319] task_work_run+0x5c/0xa0 [629724.532984] exit_to_user_mode_prepare+0x1a6/0x1b0 [629724.533598] syscall_exit_to_user_mode+0x16/0x40 [629724.534200] do_syscall_64+0x48/0x90 [629724.534667] entry_SYSCALL_64_after_hwframe+0x44/0xae [629724.535318] RIP: 0033:0x7fa2b90437a7 [629724.535804] RSP: 002b:00007ffe0b7e4458 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [629724.536912] RAX: 0000000000000000 RBX: 00007fa2b9182264 RCX: 00007fa2b90437a7 [629724.538156] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000555d6cf20dd0 [629724.539053] RBP: 0000555d6cf20ba0 R08: 0000000000000000 R09: 00007ffe0b7e3200 [629724.539956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [629724.540883] R13: 0000555d6cf20dd0 R14: 0000555d6cf20cb0 R15: 0000000000000000 [629724.541796] This happens because: 1) Before entering close_ctree() we have the async block group reclaim task running and relocating a data block group; 2) There's an async metadata (or data) space reclaim task running; 3) We enter close_ctree() and park the cleaner kthread; 4) The async space reclaim task is at flush_space() and runs all the existing delayed iputs; 5) Before the async space reclaim task calls btrfs_wait_on_delayed_iputs(), the block group reclaim task which is doing the data block group relocation, creates a delayed iput at replace_file_extents() (called when COWing leaves that have file extent items pointing to relocated data extents, during the merging phase of relocation roots); 6) The async reclaim space reclaim task blocks at btrfs_wait_on_delayed_iputs(), since we have a new delayed iput; 7) The task at close_ctree() then calls cancel_work_sync() to stop the async space reclaim task, but it blocks since that task is waiting for the delayed iput to be run; 8) The delayed iput is never run because the cleaner kthread is parked, and no one else runs delayed iputs, resulting in a hang. So fix this by stopping the async block group reclaim task before we park the cleaner kthread. Fixes: 18bb8bbf13c183 ("btrfs: zoned: automatically reclaim zones") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit fea981610c25173e6e5d63ccd4fce49739663ab0 Author: Oleksandr Tyshchenko Date: Thu Jun 2 22:23:53 2022 +0300 arm/xen: Assign xen-grant DMA ops for xen-grant DMA devices By assigning xen-grant DMA ops we will restrict memory access for passed device using Xen grant mappings. This is needed for using any virtualized device (e.g. virtio) in Xen guests in a safe manner. Please note, for the virtio devices the XEN_VIRTIO config should be enabled (it forces ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS). Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/1654197833-25362-9-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 625ab90ecdf7770bda7ae21c4d5c938aa9b43bb4 Author: Oleksandr Tyshchenko Date: Thu Jun 2 22:23:52 2022 +0300 xen/grant-dma-ops: Retrieve the ID of backend's domain for DT devices Use the presence of "iommus" property pointed to the IOMMU node with recently introduced "xen,grant-dma" compatible as a clear indicator of enabling Xen grant mappings scheme for that device and read the ID of Xen domain where the corresponding backend is running. The domid (domain ID) is used as an argument to the Xen grant mapping APIs. To avoid the deferred probe timeout which takes place after reusing generic IOMMU device tree bindings (because the IOMMU device never becomes available) enable recently introduced stub IOMMU driver by selecting XEN_GRANT_DMA_IOMMU. Also introduce xen_is_grant_dma_device() to check whether xen-grant DMA ops need to be set for a passed device. Remove the hardcoded domid 0 in xen_grant_setup_dma_ops(). Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/1654197833-25362-8-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 1ca55d50e50c74747a7b8846dac306fbe5ac4cf5 Author: Oleksandr Tyshchenko Date: Thu Jun 2 22:23:51 2022 +0300 xen/grant-dma-iommu: Introduce stub IOMMU driver In order to reuse generic IOMMU device tree bindings by Xen grant DMA-mapping layer we need to add this stub driver from a fw_devlink perspective (grant-dma-ops cannot be converted into the proper IOMMU driver). Otherwise, just reusing IOMMU bindings (without having a corresponding driver) leads to the deferred probe timeout afterwards, because the IOMMU device never becomes available. This stub driver does nothing except registering empty iommu_ops, the upper layer "of_iommu" will treat this as NO_IOMMU condition and won't return -EPROBE_DEFER. As this driver is quite different from the most hardware IOMMU implementations and only needed in Xen guests, place it in drivers/xen directory. The subsequent commit will make use of it. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/1654197833-25362-7-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit add413a1d966d8458571a2571881903d234a9f8e Author: Oleksandr Tyshchenko Date: Thu Jun 2 22:23:50 2022 +0300 dt-bindings: Add xen,grant-dma IOMMU description for xen-grant DMA ops The main purpose of this binding is to communicate Xen specific information using generic IOMMU device tree bindings (which is a good fit here) rather than introducing a custom property. Introduce Xen specific IOMMU for the virtualized device (e.g. virtio) to be used by Xen grant DMA-mapping layer in the subsequent commit. The reference to Xen specific IOMMU node using "iommus" property indicates that Xen grant mappings need to be enabled for the device, and it specifies the ID of the domain where the corresponding backend resides. The domid (domain ID) is used as an argument to the Xen grant mapping APIs. This is needed for the option to restrict memory access using Xen grant mappings to work which primary goal is to enable using virtio devices in Xen guests. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/1654197833-25362-6-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit fa1f57421e0b1c57843902c89728f823abc32f02 Author: Juergen Gross Date: Thu Jun 2 22:23:49 2022 +0300 xen/virtio: Enable restricted memory access using Xen grant mappings In order to support virtio in Xen guests add a config option XEN_VIRTIO enabling the user to specify whether in all Xen guests virtio should be able to access memory via Xen grant mappings only on the host side. Also set PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS feature from the guest initialization code on Arm and x86 if CONFIG_XEN_VIRTIO is enabled. Signed-off-by: Juergen Gross Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/1654197833-25362-5-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 216d1a8013433bacb2001d492a467e3a58db91bc Author: Luca Ceresoli Date: Fri Jun 3 17:57:23 2022 +0200 dt-bindings: update Luca Ceresoli's e-mail address My Bootlin address is preferred from now on. Signed-off-by: Luca Ceresoli Signed-off-by: Luca Ceresoli Acked-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220603155727.1232061-2-luca@lucaceresoli.net commit cce65bb2c36dd32d7bb413636b89a80d85b94196 Author: Krishna Manikandan Date: Thu Jun 2 16:19:58 2022 +0530 dt-bindings: msm: update maintainers list with proper id Use quic id instead of codeaurora id in maintainers list for display devicetree bindings. Signed-off-by: Krishna Manikandan Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/1654166998-14907-1-git-send-email-quic_mkrishn@quicinc.com commit 0a884eadc428b9e7070d86e8b22c278bdb52a422 Author: Krzysztof Kozlowski Date: Wed Jun 1 15:52:22 2022 +0200 dt-bindings: vendor-prefixes: document deprecated Atheros Two old boards use "atheros" prefix instead of already documented "qca". Document it as deprecated to fix warnings like: at91-gatwick.dtb: atheros@0: 'atheros,board-id' does not match any of the regexes Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220601135222.205035-1-krzysztof.kozlowski@linaro.org commit e059da384ffdc93778e69a5f212c2ac7357ec09a Author: Wesley Cheng Date: Thu Jun 2 19:14:32 2022 -0700 dt-bindings: Update QCOM USB subsystem maintainer information Update devicetree binding files with the proper maintainer, and updated contact email. Signed-off-by: Wesley Cheng Acked-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220603021432.13365-1-quic_wcheng@quicinc.com commit 6aa27071e4354c351d98e345fc888b70f335f185 Author: Rob Herring Date: Wed May 25 20:41:41 2022 -0500 spi: dt-bindings: Fix unevaluatedProperties warnings in examples The 'unevaluatedProperties' schema checks is not fully working and doesn't catch some cases where there's a $ref to another schema. A fix is pending, but results in new warnings in examples. 'spi-max-frequency' is supposed to be a per SPI peripheral device property, not a SPI controller property, so drop it. Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20220526014141.2872567-1-robh@kernel.org Signed-off-by: Mark Brown commit 2283679f4c468df367830b7eb8f22d48a6940e19 Author: Patrice Chotard Date: Thu Jun 2 11:10:22 2022 +0200 spi: spi-mem: Fix spi_mem_poll_status() In spi_mem_exec_op(), in case cs_gpiod descriptor is set, exec_op() callback can't be used. The same must be applied in spi_mem_poll_status(), poll_status() callback can't be used, we must use the legacy path using read_poll_timeout(). Tested on STM32mp257c-ev1 specific evaluation board on which a spi-nand was mounted instead of a spi-nor. Signed-off-by: Patrice Chotard Tested-by: Patrice Chotard Link: https://lore.kernel.org/r/20220602091022.358127-1-patrice.chotard@foss.st.com Signed-off-by: Mark Brown commit 7b40322f7183a92c4303457528ae7cda571c60b9 Author: Lars-Peter Clausen Date: Fri May 27 11:11:43 2022 +0200 spi: cadence: Detect transmit FIFO depth The depth of the transmit FIFO for the Cadence SPI controller is currently hardcoded to 128. But the depth is a synthesis configuration parameter of the core and can vary between different SoCs. If the configured FIFO size is less than 128 the driver will busy loop in the cdns_spi_fill_tx_fifo() function waiting for FIFO space to become available. Depending on the length and speed of the transfer it can spin for a significant amount of time. The cdns_spi_fill_tx_fifo() function is called from the drivers interrupt handler, so it can leave interrupts disabled for a prolonged amount of time. In addition the read FIFO will also overflow and data will be discarded. To avoid this detect the actual size of the FIFO and use that rather than the hardcoded value. To detect the FIFO size the FIFO threshold register is used. The register is sized so that it can hold FIFO size - 1 as its maximum value. Bits that are not needed to hold the threshold value will always read 0. By writing 0xffff to the register and then reading back the value in the register we get the FIFO size. Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20220527091143.3780378-1-lars@metafoo.de Signed-off-by: Mark Brown commit 21b511ddee09a78909035ec47a6a594349fe3296 Author: Sai Krishna Potthuri Date: Mon Jun 6 11:55:25 2022 +0530 spi: spi-cadence: Fix SPI CS gets toggling sporadically As part of unprepare_transfer_hardware, SPI controller will be disabled which will indirectly deassert the CS line. This will create a problem in some of the devices where message will be transferred with cs_change flag set(CS should not be deasserted). As per SPI controller implementation, if SPI controller is disabled then all output enables are inactive and all pins are set to input mode which means CS will go to default state high(deassert). This leads to an issue when core explicitly ask not to deassert the CS (cs_change = 1). This patch fix the above issue by checking the Slave select status bits from configuration register before disabling the SPI. Signed-off-by: Sai Krishna Potthuri Signed-off-by: Amit Kumar Mahapatra Link: https://lore.kernel.org/r/20220606062525.18447-1-amit.kumar-mahapatra@xilinx.com Signed-off-by: Mark Brown commit 2abdf9f80019e8244d3806ed0e1c9f725e50b452 Author: Mark Brown Date: Fri Jun 3 13:50:03 2022 +0200 ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() Currently wm_adsp_fw_put() returns 0 rather than 1 when updating the value of the control, meaning that no event is generated to userspace. Fix this by setting the default return value to 1, the code already exits early with a return value of 0 if the value is unchanged. Signed-off-by: Mark Brown Reviewed-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20220603115003.3865834-1-broonie@kernel.org Signed-off-by: Mark Brown commit 8259610c2ec01c5cbfb61882ae176aabacac9c19 Author: Mark Brown Date: Fri Jun 3 14:39:37 2022 +0200 ASoC: es8328: Fix event generation for deemphasis control Currently the put() method for the deemphasis control returns 0 when a new value is written to the control even if the value changed, meaning events are not generated. Fix this, skip the work of updating the value when it is unchanged and then return 1 after having done so. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220603123937.4013603-1-broonie@kernel.org Signed-off-by: Mark Brown commit d1f5272c0f7d2e53c6f2480f46725442776f5f78 Author: Adam Ford Date: Thu May 26 13:21:28 2022 -0500 ASoC: wm8962: Fix suspend while playing music If the audio CODEC is playing sound when the system is suspended, it can be left in a state which throws the following error: wm8962 3-001a: ASoC: error at soc_component_read_no_lock on wm8962.3-001a: -16 Once this error has occurred, the audio will not work again until rebooted. Fix this by configuring SET_SYSTEM_SLEEP_PM_OPS. Signed-off-by: Adam Ford Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220526182129.538472-1-aford173@gmail.com Signed-off-by: Mark Brown commit bedc357217e6e09623f6209c891fa8d57a737ac1 Author: Dan Carpenter Date: Thu Jun 2 12:09:35 2022 +0300 ASoC: SOF: ipc-msg-injector: Fix reversed if statement This if statement is reversed. In fact, the condition can just be deleted because writing zero bytes is a no-op. Fixes: 066c67624d8c ("ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages") Signed-off-by: Dan Carpenter Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/Yph+T3PpGCdPsEDj@kili Signed-off-by: Mark Brown commit d9a251a029f23e79c1ac394bc551ed5d536bc740 Author: Dan Carpenter Date: Thu Jun 2 12:08:25 2022 +0300 ASoC: SOF: ipc-msg-injector: Propagate write errors correctly This code is supposed to propagate errors from simple_write_to_buffer() or return -EFAULT if "size != count". However "size" needs to be signed for the code to work correctly and the case where "size == 0" is not handled correctly. Fixes: 066c67624d8c ("ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages") Fixes: 2f0b1b013bbc ("ASoC: SOF: debug: Add support for IPC message injection") Signed-off-by: Dan Carpenter Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/Yph+Cd+JrfOH0i7z@kili Signed-off-by: Mark Brown commit 9688073ee98cb2894d5434fe91dd256383727089 Author: Shengjiu Wang Date: Tue May 31 11:02:03 2022 +0800 ASoC: fsl_sai: Add support for i.MX8MN The SAI module on i.MX8MN is almost same as i.MX8MP, So reuse same soc data as i.MX8MP. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1653966123-28217-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 2fe08216fda33bbc1f80133b8fd560ffd094b987 Author: Amadeusz Sławiński Date: Thu Jun 2 15:57:57 2022 +0200 ASoC: SOF: Fix potential NULL pointer dereference Cleanup path for sof_prepare_widgets_in_path() should check if unprepare callback exists before calling it, instead it checks if it does not exist. Fix the check. Signed-off-by: Amadeusz Sławiński Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220602135757.3335351-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit b93a8b2c5161696e732185311d309e0aaf0575be Author: Andy Shevchenko Date: Thu May 12 20:39:21 2022 +0300 gpio: dln2: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Andy Shevchenko commit f1138dacb7ff5221c4a37b823e42fc0a34df8731 Author: Andy Shevchenko Date: Wed Jun 1 18:36:56 2022 +0300 gpio: sch: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski commit a80fed9fb643175832e2fb8481d38f5d92cbcd34 Author: Andy Shevchenko Date: Thu May 12 20:39:21 2022 +0300 gpio: merrifield: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Andy Shevchenko commit 41a18c4918dcd57a49b0d046d9f2d587878de739 Author: Andy Shevchenko Date: Thu May 12 20:39:21 2022 +0300 gpio: wcove: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Andy Shevchenko Reviewed-by: Kuppuswamy Sathyanarayanan commit 68a12c19e1cb0f3332d3f59e1d5447f2aff97cd7 Author: Andy Shevchenko Date: Wed Jun 1 17:22:04 2022 +0300 gpio: crystalcove: Join function declarations and long lines There is no more hard limit of 80 characters for long lines, so join a few of them for better readability. Signed-off-by: Andy Shevchenko commit b34d2ad73af3c58dbaf8aa71b7308f17d9863780 Author: Andy Shevchenko Date: Wed Jun 1 17:18:02 2022 +0300 gpio: crystalcove: Use specific type and API for IRQ number Use specific type and API for IRQ number in the callbacks. Signed-off-by: Andy Shevchenko commit 386cbe7f1b152c8476a7d322d39512b1b4259ed5 Author: Andy Shevchenko Date: Thu May 12 20:39:21 2022 +0300 gpio: crystalcove: make irq_chip immutable Since recently, the kernel is nagging about mutable irq_chips: "not an immutable chip, please consider fixing it!" Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new helper functions and call the appropriate gpiolib functions. Signed-off-by: Andy Shevchenko commit ba79c5e45eecb9e009eca7f5da224f6e42bd4fcb Author: Andy Shevchenko Date: Mon May 30 14:57:50 2022 +0300 MAINTAINERS: Update Intel pin control to Supported The actual status of the code is Supported. Reported-by: dave.hansen@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg commit 1332661e09304b7b8e84e5edc11811ba08d12abe Author: Miaoqian Lin Date: Thu Jun 2 08:17:21 2022 +0400 memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function doesn't call of_node_put() in some error paths. To unify the structure, Add put_node label and goto it on errors. Fixes: 6e7674c3c6df ("memory: Add DMC driver for Exynos5422") Signed-off-by: Miaoqian Lin Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20220602041721.64348-1-linmq006@gmail.com Signed-off-by: Krzysztof Kozlowski commit 038ae37c510fd57cbc543ac82db1e7b23b28557a Author: Miaoqian Lin Date: Wed Jun 1 16:01:18 2022 +0400 memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common The reference taken by 'of_find_device_by_node()' must be released when not needed anymore. Add the corresponding 'put_device()' in the error handling paths. Fixes: 47404757702e ("memory: mtk-smi: Add device link for smi-sub-common") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220601120118.60225-1-linmq006@gmail.com Signed-off-by: Krzysztof Kozlowski commit 67c7fc6cd915d809be4de2eed323aa5f2205c52f Author: Geert Uytterhoeven Date: Tue May 10 11:29:13 2022 +0200 memory: omap-gpmc: OMAP_GPMC should depend on ARCH_OMAP2PLUS || ARCH_KEYSTONE || ARCH_K3 The Texas Instruments OMAP General Purpose Memory Controller (GPMC) is only present on TI OMAP2/3/4/5, Keystone, AM33xx, AM43x, DRA7xx, TI81xx, and K3 SoCs. Hence add a dependency on ARCH_OMAP2PLUS || ARCH_KEYSTONE || ARCH_K3, to prevent asking the user about this driver when configuring a kernel without OMAP2+, Keystone, or K3 SoC family support. Fixes: be34f45f0d4aa91c ("memory: omap-gpmc: Make OMAP_GPMC config visible and selectable") Signed-off-by: Geert Uytterhoeven Acked-by: Roger Quadros Link: https://lore.kernel.org/r/f6780f572f882ed6ab5934321942cf2b412bf8d1.1652174849.git.geert+renesas@glider.be Signed-off-by: Krzysztof Kozlowski commit c4c79525042a4a7df96b73477feaf232fe44ae81 Author: Miaoqian Lin Date: Mon May 23 18:55:13 2022 +0400 ARM: exynos: Fix refcount leak in exynos_map_pmu of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() checks null pointer. Fixes: fce9e5bb2526 ("ARM: EXYNOS: Add support for mapping PMU base address via DT") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220523145513.12341-1-linmq006@gmail.com Signed-off-by: Krzysztof Kozlowski commit f84d83d8165570380f55f4ce578bfb131a9266c5 Author: David Virag Date: Thu May 26 07:58:40 2022 +0200 arm64: dts: exynos: Correct UART clocks on Exynos7885 The clocks in the serial UART nodes were swapped by mistake on Exynos7885. This only worked correctly because of a mistake in the clock driver which has been fixed. With the fixed clock driver in place, the baudrate of the UARTs get miscalculated. Fix this by correcting the clocks in the dtsi. Fixes: 06874015327b ("arm64: dts: exynos: Add initial device tree support for Exynos7885 SoC") Signed-off-by: David Virag Link: https://lore.kernel.org/r/20220526055840.45209-3-virag.david003@gmail.com Signed-off-by: Krzysztof Kozlowski commit 537e11cdc7a6b3ce94fa25ed41306193df9677b7 Author: Matthew Wilcox (Oracle) Date: Sun Jun 5 15:38:13 2022 +0100 quota: Prevent memory allocation recursion while holding dq_lock As described in commit 02117b8ae9c0 ("f2fs: Set GF_NOFS in read_cache_page_gfp while doing f2fs_quota_read"), we must not enter filesystem reclaim while holding the dq_lock. Prevent this more generally by using memalloc_nofs_save() while holding the lock. Link: https://lore.kernel.org/r/20220605143815.2330891-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Jan Kara commit 85743a847caeab696dafc4ce1a7e1e2b7e29a0f6 Author: Cameron Berkenpas Date: Sun Jun 5 17:23:30 2022 -0700 ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 Enables the ALC287_FIXUP_YOGA7_14ITL_SPEAKERS quirk for the Lenovo Yoga DuetITL 2021 laptop to fix speaker output. [ re-sorted in the SSID order by tiwai ] BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555 Signed-off-by: Cameron Berkenpas Co-authored-by: Songine Cc: stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220606002329.215330-1-cam@neo-zeon.de Signed-off-by: Takashi Iwai commit 10e14073107dd0b6d97d9516a02845a8e501c2c9 Author: Jchao Sun Date: Tue May 24 08:05:40 2022 -0700 writeback: Fix inode->i_io_list not be protected by inode->i_lock error Commit b35250c0816c ("writeback: Protect inode->i_io_list with inode->i_lock") made inode->i_io_list not only protected by wb->list_lock but also inode->i_lock, but inode_io_list_move_locked() was missed. Add lock there and also update comment describing things protected by inode->i_lock. This also fixes a race where __mark_inode_dirty() could move inode under flush worker's hands and thus sync(2) could miss writing some inodes. Fixes: b35250c0816c ("writeback: Protect inode->i_io_list with inode->i_lock") Link: https://lore.kernel.org/r/20220524150540.12552-1-sunjunchao2870@gmail.com CC: stable@vger.kernel.org Signed-off-by: Jchao Sun Signed-off-by: Jan Kara commit 2aab03b86766a27f99a0b24f63e1730faac128d0 Author: Xiang wangx Date: Sun Jun 5 20:55:09 2022 +0800 fs: Fix syntax errors in comments Delete the redundant word 'not'. Link: https://lore.kernel.org/r/20220605125509.14837-1-wangxiang@cdjrlc.com Signed-off-by: Xiang wangx Signed-off-by: Jan Kara commit d6aca3504c7ded5f4f46957e3685b9344d9743dd Author: Juergen Gross Date: Thu Jun 2 22:23:48 2022 +0300 xen/grant-dma-ops: Add option to restrict memory access under Xen Introduce Xen grant DMA-mapping layer which contains special DMA-mapping routines for providing grant references as DMA addresses to be used by frontends (e.g. virtio) in Xen guests. Add the needed functionality by providing a special set of DMA ops handling the needed grant operations for the I/O pages. The subsequent commit will introduce the use case for xen-grant DMA ops layer to enable using virtio devices in Xen guests in a safe manner. Signed-off-by: Juergen Gross Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/1654197833-25362-4-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 02a9e681a3f7998074f39ec265080bf934871530 Author: Juergen Gross Date: Thu Jun 2 22:23:47 2022 +0300 xen/grants: support allocating consecutive grants For support of virtio via grant mappings in rare cases larger mappings using consecutive grants are needed. Support those by adding a bitmap of free grants. As consecutive grants will be needed only in very rare cases (e.g. when configuring a virtio device with a multi-page ring), optimize for the normal case of non-consecutive allocations. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/1654197833-25362-3-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 9bf22421dc8a69cade3c994771637e9693ff0216 Author: Oleksandr Tyshchenko Date: Thu Jun 2 22:23:46 2022 +0300 arm/xen: Introduce xen_setup_dma_ops() This patch introduces new helper and places it in new header. The helper's purpose is to assign any Xen specific DMA ops in a single place. For now, we deal with xen-swiotlb DMA ops only. The one of the subsequent commits in current series will add xen-grant DMA ops case. Also re-use the xen_swiotlb_detect() check on Arm32. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini [For arm64] Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/1654197833-25362-2-git-send-email-olekstysh@gmail.com Signed-off-by: Juergen Gross commit 3f9dfbebdc48cebfbda738f6f3d1dbf6d7232f90 Author: Juergen Gross Date: Mon Jun 6 08:09:16 2022 +0200 virtio: replace arch_has_restricted_virtio_memory_access() Instead of using arch_has_restricted_virtio_memory_access() together with CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, replace those with platform_has() and a new platform feature PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Reviewed-by: Christoph Hellwig Acked-by: Borislav Petkov commit 96f0a54e8e65a765b3a4ad4b53751581f23279f3 Author: Larry Finger Date: Mon May 30 20:31:03 2022 -0500 staging: r8188eu: Fix warning of array overflow in ioctl_linux.c Building with -Warray-bounds results in the following warning plus others related to the same problem: CC [M] drivers/staging/r8188eu/os_dep/ioctl_linux.o In function ‘wpa_set_encryption’, inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9: drivers/staging/r8188eu/os_dep/ioctl_linux.c:412:41: warning: array subscript ‘struct ndis_802_11_wep[0]’ is partly outside array bounds of ‘void[25]’ [-Warray-bounds] 412 | pwep->KeyLength = wep_key_len; | ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ In file included from drivers/staging/r8188eu/os_dep/../include/osdep_service.h:19, from drivers/staging/r8188eu/os_dep/ioctl_linux.c:4: In function ‘kmalloc’, inlined from ‘kzalloc’ at ./include/linux/slab.h:733:9, inlined from ‘wpa_set_encryption’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:408:11, inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9: ./include/linux/slab.h:605:16: note: object of size [17, 25] allocated by ‘__kmalloc’ 605 | return __kmalloc(size, flags); | ^~~~~~~~~~~~~~~~~~~~~~ ./include/linux/slab.h:600:24: note: object of size [17, 25] allocated by ‘kmem_cache_alloc_trace’ 600 | return kmem_cache_alloc_trace( | ^~~~~~~~~~~~~~~~~~~~~~~ 601 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 602 | flags, size); | ~~~~~~~~~~~~ Although it is unlikely that anyone is still using WEP encryption, the size of the allocation needs to be increased just in case. Fixes commit 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Signed-off-by: Larry Finger Cc: Phillip Potter Cc: Dan Carpenter Link: https://lore.kernel.org/r/20220531013103.2175-3-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 5b7419ae1d208cab1e2826d473d8dab045aa75c7 Author: Phillip Potter Date: Sat May 21 21:47:41 2022 +0100 staging: r8188eu: fix rtw_alloc_hwxmits error detection for now In _rtw_init_xmit_priv, we use the res variable to store the error return from the newly converted rtw_alloc_hwxmits function. Sadly, the calling function interprets res using _SUCCESS and _FAIL still, meaning we change the semantics of the variable, even in the success case. This leads to the following on boot: r8188eu 1-2:1.0: _rtw_init_xmit_priv failed In the long term, we should reverse these semantics, but for now, this fixes the driver. Also, inside rtw_alloc_hwxmits remove the if blocks, as HWXMIT_ENTRY is always 4. Fixes: f94b47c6bde6 ("staging: r8188eu: add check for kzalloc") Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220521204741.921-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 2130a790ca49763f724ec45cf93b9dd765e2023e Author: Juergen Gross Date: Thu Jun 2 15:05:26 2022 +0200 kernel: add platform_has() infrastructure Add a simple infrastructure for setting, resetting and querying platform feature flags. Flags can be either global or architecture specific. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Reviewed-by: Christoph Hellwig Acked-by: Borislav Petkov Signed-off-by: Juergen Gross commit c36ee7dab7749f7be21f7a72392744490b2a9a2b Author: Paulo Alcantara Date: Sun Jun 5 19:54:26 2022 -0300 cifs: fix reconnect on smb3 mount types cifs.ko defines two file system types: cifs & smb3, and __cifs_get_super() was not including smb3 file system type when looking up superblocks, therefore failing to reconnect tcons in cifs_tree_connect(). Fix this by calling iterate_supers_type() on both file system types. Link: https://lore.kernel.org/r/CAFrh3J9soC36+BVuwHB=g9z_KB5Og2+p2_W+BBoBOZveErz14w@mail.gmail.com Cc: stable@vger.kernel.org Tested-by: Satadru Pramanik Reported-by: Satadru Pramanik Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 10d6bdf532902be1d8aa5900b3c03c5671612aa2 Author: Miaoqian Lin Date: Wed Jun 1 12:59:26 2022 +0400 ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe of_find_device_by_node() takes reference, we should use put_device() to release it when not need anymore. Add missing put_device() to avoid refcount leak. Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.") Signed-off-by: Miaoqian Lin Reviewed-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit bf476fe22aa1851bab4728e0c49025a6a0bea307 Author: Sergey Shtylyov Date: Sat May 21 23:34:10 2022 +0300 ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit a734510fa8b4e61e6a37176f0da01f4c55fa52de Author: Hannes Reinecke Date: Wed May 25 13:49:42 2022 +0200 ata: libata: drop 'sas_last_tag' Unused now. Fixes: 4f1a22ee7b57 ("libata: Improve ATA queued command allocation") Cc: John Garry Signed-off-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Damien Le Moal commit 7ad4bd887d27c6b6ffbef216f19c19f8fe2b8f52 Author: Masahiro Yamada Date: Sat Jun 4 17:50:50 2022 +0900 powerpc/book3e: get rid of #include You cannot include here because it is generated in init/Makefile but there is no guarantee that it happens before arch/powerpc/mm/nohash/kaslr_booke.c is compiled for parallel builds. The places where you can reliably include are: - init/ (because init/Makefile can specify the dependency) - arch/*/boot/ (because it is compiled after vmlinux) Commit f231e4333312 ("hexagon: get rid of #include ") fixed the last breakage at that time, but powerpc re-added this. was unneeded because 'build_str' is almost the same as 'linux_banner' defined in init/version.c Let's copy the solution from MIPS. (get_random_boot() in arch/mips/kernel/relocate.c) Fixes: 6a38ea1d7b94 ("powerpc/fsl_booke/32: randomize the kernel image offset") Signed-off-by: Masahiro Yamada Acked-by: Scott Wood Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220604085050.4078927-1-masahiroy@kernel.org commit f2906aa863381afb0015a9eb7fefad885d4e5a56 Author: Linus Torvalds Date: Sun Jun 5 17:18:54 2022 -0700 Linux 5.19-rc1 commit 6684cf42906ff5f44580e16a1f898e89c19aabd5 Merge: 815b196c70573 40a1926022d12 Author: Linus Torvalds Date: Sun Jun 5 17:14:03 2022 -0700 Merge tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull file descriptor fix from Al Viro: "Fix for breakage in #work.fd this window" * tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix the breakage in close_fd_get_file() calling conventions change commit 815b196c7057356e7ffa9ce97892cb5fd5de17e0 Merge: e17fee8976c3d a19cad0691597 Author: Linus Torvalds Date: Sun Jun 5 17:05:38 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull mm hotfixes from Andrew Morton: "Fixups for various recently-added and longer-term issues and a few minor tweaks: - fixes for material merged during this merge window - cc:stable fixes for more longstanding issues - minor mailmap and MAINTAINERS updates" * tag 'mm-hotfixes-stable-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/oom_kill.c: fix vm_oom_kill_table[] ifdeffery x86/kexec: fix memory leak of elf header buffer mm/memremap: fix missing call to untrack_pfn() in pagemap_range() mm: page_isolation: use compound_nr() correctly in isolate_single_pageblock() mm: hugetlb_vmemmap: fix CONFIG_HUGETLB_PAGE_FREE_VMEMMAP_DEFAULT_ON MAINTAINERS: add maintainer information for z3fold mailmap: update Josh Poimboeuf's email commit e17fee8976c3d2ccf9add6d6c8912a37b025d840 Merge: e1cff7002b716 662ce1dc9caf4 Author: Linus Torvalds Date: Sun Jun 5 16:58:27 2022 -0700 Merge tag 'mm-nonmm-stable-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull delay-accounting update from Andrew Morton: "A single featurette for delay accounting. Delayed a bit because, unusually, it had dependencies on both the mm-stable and mm-nonmm-stable queues" * tag 'mm-nonmm-stable-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: delayacct: track delays from write-protect copy commit e1cff7002b716bd0b5f5f4afd4273c99aa8644be Author: Linus Torvalds Date: Sun Jun 5 11:51:48 2022 -0700 bluetooth: don't use bitmaps for random flag accesses The bluetooth code uses our bitmap infrastructure for the two bits (!) of connection setup flags, and in the process causes odd problems when it converts between a bitmap and just the regular values of said bits. It's completely pointless to do things like bitmap_to_arr32() to convert a bitmap into a u32. It shoudln't have been a bitmap in the first place. The reason to use bitmaps is if you have arbitrary number of bits you want to manage (not two!), or if you rely on the atomicity guarantees of the bitmap setting and clearing. The code could use an "atomic_t" and use "atomic_or/andnot()" to set and clear the bit values, but considering that it then copies the bitmaps around with "bitmap_to_arr32()" and friends, there clearly cannot be a lot of atomicity requirements. So just use a regular integer. In the process, this avoids the warnings about erroneous use of bitmap_from_u64() which were triggered on 32-bit architectures when conversion from a u64 would access two words (and, surprise, surprise, only one word is needed - and indeed overkill - for a 2-bit bitmap). That was always problematic, but the compiler seems to notice it and warn about the invalid pattern only after commit 0a97953fd221 ("lib: add bitmap_{from,to}_arr64") changed the exact implementation details of 'bitmap_from_u64()', as reported by Sudip Mukherjee and Stephen Rothwell. Fixes: fe92ee6425a2 ("Bluetooth: hci_core: Rework hci_conn_params flags") Link: https://lore.kernel.org/all/YpyJ9qTNHJzz0FHY@debian/ Link: https://lore.kernel.org/all/20220606080631.0c3014f2@canb.auug.org.au/ Link: https://lore.kernel.org/all/20220605162537.1604762-1-yury.norov@gmail.com/ Reported-by: Stephen Rothwell Reported-by: Sudip Mukherjee Reviewed-by: Yury Norov Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Signed-off-by: Linus Torvalds commit 40a1926022d128057376d35167128a7c74e3dca4 Author: Al Viro Date: Sun Jun 5 14:01:42 2022 -0400 fix the breakage in close_fd_get_file() calling conventions change It used to grab an extra reference to struct file rather than just transferring to caller the one it had removed from descriptor table. New variant doesn't, and callers need to be adjusted. Reported-and-tested-by: syzbot+47dd250f527cb7bebf24@syzkaller.appspotmail.com Fixes: 6319194ec57b ("Unify the primitives for file descriptor closing") Signed-off-by: Al Viro commit d717180e7f9775d468f415c10a4a474640146001 Merge: 0b7da15c21c2d 0c9782e204d3c Author: Linus Torvalds Date: Sun Jun 5 11:00:43 2022 -0700 Merge tag 'x86-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SGX fix from Thomas Gleixner: "A single fix for x86/SGX to prevent that memory which is allocated for an SGX enclave is accounted to the wrong memory control group" * tag 'x86-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Set active memcg prior to shmem allocation commit 0b7da15c21c2d4a37495fafc0350acec18f67d87 Merge: 9784edd73a08e e19d11267f0e6 Author: Linus Torvalds Date: Sun Jun 5 10:57:35 2022 -0700 Merge tag 'x86-mm-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm cleanup from Thomas Gleixner: "Use PAGE_ALIGNED() instead of open coding it in the x86/mm code" * tag 'x86-mm-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Use PAGE_ALIGNED(x) instead of IS_ALIGNED(x, PAGE_SIZE) commit 9784edd73a08ea08d0ce5606e1f0f729df688c59 Merge: a925128092d8d 0c0fe08c76485 Author: Linus Torvalds Date: Sun Jun 5 10:55:23 2022 -0700 Merge tag 'x86-microcode-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode updates from Thomas Gleixner: - Disable late microcode loading by default. Unless the HW people get their act together and provide a required minimum version in the microcode header for making a halfways informed decision its just lottery and broken. - Warn and taint the kernel when microcode is loaded late - Remove the old unused microcode loader interface - Remove a redundant perf callback from the microcode loader * tag 'x86-microcode-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Remove unnecessary perf callback x86/microcode: Taint and warn on late loading x86/microcode: Default-disable late loading x86/microcode: Rip out the OLD_INTERFACE commit a925128092d8dd5c2ea8644e1dddd510b7ebc9c7 Merge: 1fd9f4ce8442e f7081834b2d5b Author: Linus Torvalds Date: Sun Jun 5 10:53:41 2022 -0700 Merge tag 'x86-cleanups-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Thomas Gleixner: "A set of small x86 cleanups: - Remove unused headers in the IDT code - Kconfig indendation and comment fixes - Fix all 'the the' typos in one go instead of waiting for bots to fix one at a time" * tag 'x86-cleanups-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Fix all occurences of the "the the" typo x86/idt: Remove unused headers x86/Kconfig: Fix indentation of arch/x86/Kconfig.debug x86/Kconfig: Fix indentation and add endif comments to arch/x86/Kconfig commit 1fd9f4ce8442e34d4f817924d191d2855cdb80c5 Merge: c049ecc523171 8a33d96bd178d Author: Linus Torvalds Date: Sun Jun 5 10:49:42 2022 -0700 Merge tag 'x86-boot-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot update from Thomas Gleixner: "Use strlcpy() instead of strscpy() in arch_setup()" * tag 'x86-boot-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/setup: Use strscpy() to replace deprecated strlcpy() commit c049ecc523171481accd2c83f79ffeecbf53a915 Merge: bc1e02c3e500e 57963a92a70b0 Author: Linus Torvalds Date: Sun Jun 5 10:47:06 2022 -0700 Merge tag 'timers-core-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clockevent/clocksource updates from Thomas Gleixner: - Device tree bindings for MT8186 - Tell the kernel that the RISC-V SBI timer stops in deeper power states - Make device tree parsing in sp804 more robust - Dead code removal and tiny fixes here and there - Add the missing SPDX identifiers * tag 'timers-core-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value clocksource/drivers/timer-ti-dm: Remove unnecessary NULL check clocksource/drivers/timer-sun5i: Convert to SPDX identifier clocksource/drivers/timer-sun4i: Convert to SPDX identifier clocksource/drivers/pistachio: Convert to SPDX identifier clocksource/drivers/orion: Convert to SPDX identifier clocksource/drivers/lpc32xx: Convert to SPDX identifier clocksource/drivers/digicolor: Convert to SPDX identifier clocksource/drivers/armada-370-xp: Convert to SPDX identifier clocksource/drivers/mips-gic-timer: Convert to SPDX identifier clocksource/drivers/jcore: Convert to SPDX identifier clocksource/drivers/bcm_kona: Convert to SPDX identifier clocksource/drivers/sp804: Avoid error on multiple instances clocksource/drivers/riscv: Events are stopped during CPU suspend clocksource/drivers/ixp4xx: Drop boardfile probe path dt-bindings: timer: Add compatible for Mediatek MT8186 commit bc1e02c3e500e2eec5afd2fd3efc3b7f9637c35c Merge: fa11c28046528 82f586f923e3a Author: Linus Torvalds Date: Sun Jun 5 10:42:40 2022 -0700 Merge tag 'sched-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Thomas Gleixner: "Fix the fallout of sysctl code move which placed the init function wrong" * tag 'sched-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/autogroup: Fix sysctl move commit fa11c2804652809f93f79722e770890b07b3953e Merge: 5cc47d4a920c4 8b4dd2d8627e8 Author: Linus Torvalds Date: Sun Jun 5 10:40:31 2022 -0700 Merge tag 'perf-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: - Make the ICL event constraints match reality - Remove a unused local variable * tag 'perf-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Remove unused local variable perf/x86/intel: Fix event constraints for ICL commit 5cc47d4a920c4766c5e6f4667d8e5194fccfc862 Merge: 44688ffd111af 108ea7eb3e754 Author: Linus Torvalds Date: Sun Jun 5 10:39:20 2022 -0700 Merge tag 'perf-core-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixlet from Thomas Gleixner: "Trivial indentation fix in Kconfig" * tag 'perf-core-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/Kconfig: Fix indentation in the Kconfig file commit 44688ffd111af31984237f0cba05f2e201eac530 Merge: b2c9a83d262a8 2028a255f4df3 Author: Linus Torvalds Date: Sun Jun 5 09:45:27 2022 -0700 Merge tag 'objtool-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Thomas Gleixner: - Handle __ubsan_handle_builtin_unreachable() correctly and treat it as noreturn - Allow architectures to select uaccess validation - Use the non-instrumented bit test for test_cpu_has() to prevent escape from non-instrumentable regions - Use arch_ prefixed atomics for JUMP_LABEL=n builds to prevent escape from non-instrumentable regions - Mark a few tiny inline as __always_inline to prevent GCC from bringing them out of line and instrumenting them - Mark the empty stub context_tracking_enabled() as always inline as GCC brings them out of line and instruments the empty shell - Annotate ex_handler_msr_mce() as dead end * tag 'objtool-urgent-2022-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/extable: Annotate ex_handler_msr_mce() as a dead end context_tracking: Always inline empty stubs x86: Always inline on_thread_stack() and current_top_of_stack() jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds x86/cpu: Elide KCSAN for cpu_has() and friends objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn objtool: Add CONFIG_HAVE_UACCESS_VALIDATION commit b2c9a83d262a8feb022e24e9f9aadb66cb10a7a8 Merge: 2981436374177 aa2a4ded05058 Author: Linus Torvalds Date: Sun Jun 5 09:25:12 2022 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Mostly small bug fixes plus other trivial updates. The major change of note is moving ufs out of scsi and a minor update to lpfc vmid handling" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (24 commits) scsi: qla2xxx: Remove unused 'ql_dm_tgt_ex_pct' parameter scsi: qla2xxx: Remove setting of 'req' and 'rsp' parameters scsi: mpi3mr: Fix kernel-doc scsi: lpfc: Add support for ATTO Fibre Channel devices scsi: core: Return BLK_STS_TRANSPORT for ALUA transitioning scsi: sd_zbc: Prevent zone information memory leak scsi: sd: Fix potential NULL pointer dereference scsi: mpi3mr: Rework mrioc->bsg_device model to fix warnings scsi: myrb: Fix up null pointer access on myrb_cleanup() scsi: core: Unexport scsi_bus_type scsi: sd: Don't call blk_cleanup_disk() in sd_probe() scsi: ufs: ufshcd: Delete unnecessary NULL check scsi: isci: Fix typo in comment scsi: pmcraid: Fix typo in comment scsi: smartpqi: Fix typo in comment scsi: qedf: Fix typo in comment scsi: esas2r: Fix typo in comment scsi: storvsc: Fix typo in comment scsi: ufs: Split the drivers/scsi/ufs directory scsi: qla1280: Remove redundant variable ... commit 2981436374177f78539b026ce5bcbab8c251818e Merge: 71e80720dbf0f 5dad4eccd2b43 Author: Linus Torvalds Date: Sun Jun 5 09:12:28 2022 -0700 Merge tag 'hte/for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux Pull hardware timestamping subsystem from Thierry Reding: "This contains the new HTE (hardware timestamping engine) subsystem that has been in the works for a couple of months now. The infrastructure provided allows for drivers to register as hardware timestamp providers, while consumers will be able to request events that they are interested in (such as GPIOs and IRQs) to be timestamped by the hardware providers. Note that this currently supports only one provider, but there seems to be enough interest in this functionality and we expect to see more drivers added once this is merged" [ Linus Walleij mentions the Intel PMC in the Elkhart and Tiger Lake platforms as another future timestamp provider ] * tag 'hte/for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: timestamp: Correct id path dt-bindings: Renamed hte directory to timestamp hte: Uninitialized variable in hte_ts_get() hte: Fix off by one in hte_push_ts_ns() hte: Fix possible use-after-free in tegra_hte_test_remove() hte: Remove unused including MAINTAINERS: Add HTE Subsystem hte: Add Tegra HTE test driver tools: gpio: Add new hardware clock type gpiolib: cdev: Add hardware timestamp clock type gpio: tegra186: Add HTE support gpiolib: Add HTE support dt-bindings: Add HTE bindings hte: Add Tegra194 HTE kernel provider drivers: Add hardware timestamp engine (HTE) subsystem Documentation: Add HTE subsystem guide commit 71e80720dbf0f08c6979e54f21ddaa5735ce742d Merge: 952923ddc0112 42ce60aa5aa46 Author: Linus Torvalds Date: Sun Jun 5 09:06:03 2022 -0700 Merge tag 'kbuild-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull more Kbuild updates from Masahiro Yamada: - Fix build regressions for parisc, csky, nios2, openrisc - Simplify module builds for CONFIG_LTO_CLANG and CONFIG_X86_KERNEL_IBT - Remove arch/parisc/nm, which was presumably a workaround for old tools - Check the odd combination of EXPORT_SYMBOL and 'static' precisely - Make external module builds robust against "too long argument error" - Support j, k keys for moving the cursor in nconfig * tag 'kbuild-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (25 commits) kbuild: Allow to select bash in a modified environment scripts: kconfig: nconf: make nconfig accept jk keybindings modpost: use fnmatch() to simplify match() modpost: simplify mod->name allocation kbuild: factor out the common objtool arguments kbuild: move vmlinux.o link to scripts/Makefile.vmlinux_o kbuild: clean .tmp_* pattern by make clean kbuild: remove redundant cleanups in scripts/link-vmlinux.sh kbuild: rebuild multi-object modules when objtool is updated kbuild: add cmd_and_savecmd macro kbuild: make *.mod rule robust against too long argument error kbuild: make built-in.a rule robust against too long argument error kbuild: check static EXPORT_SYMBOL* by script instead of modpost parisc: remove arch/parisc/nm kbuild: do not create *.prelink.o for Clang LTO or IBT kbuild: replace $(linked-object) with CONFIG options kbuild: do not try to parse *.cmd files for objects provided by compiler kbuild: replace $(if A,A,B) with $(or A,B) in scripts/Makefile.modpost modpost: squash if...else-if in find_elf_symbol2() modpost: reuse ARRAY_SIZE() macro for section_mismatch() ... commit 952923ddc01120190dcf671e7b354364ce1d1362 Merge: cbd76edeabd5e 30476f7e6dbcb Author: Linus Torvalds Date: Sat Jun 4 19:07:15 2022 -0700 Merge tag 'pull-18-rc1-work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs pathname updates from Al Viro: "Several cleanups in fs/namei.c" * tag 'pull-18-rc1-work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: namei: cleanup double word in comment get rid of dead code in legitimize_root() fs/namei.c:reserve_stack(): tidy up the call of try_to_unlazy() commit cbd76edeabd5ed078391abb2323b7aee790cdc04 Merge: dbe0ee4661401 70f8d9c5750bb Author: Linus Torvalds Date: Sat Jun 4 19:00:05 2022 -0700 Merge tag 'pull-18-rc1-work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount handling updates from Al Viro: "Cleanups (and one fix) around struct mount handling. The fix is usermode_driver.c one - once you've done kern_mount(), you must kern_unmount(); simple mntput() will end up with a leak. Several failure exits in there messed up that way... In practice you won't hit those particular failure exits without fault injection, though" * tag 'pull-18-rc1-work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: move mount-related externs from fs.h to mount.h blob_to_mnt(): kern_unmount() is needed to undo kern_mount() m->mnt_root->d_inode->i_sb is a weird way to spell m->mnt_sb... linux/mount.h: trim includes uninline may_mount() and don't opencode it in fspick(2)/fsopen(2) commit dbe0ee46614016146c1b3e1fc063b44333bb2401 Merge: d66016c5cd3d4 6319194ec57b0 Author: Linus Torvalds Date: Sat Jun 4 18:52:00 2022 -0700 Merge tag 'pull-18-rc1-work.fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull file descriptor updates from Al Viro. - Descriptor handling cleanups * tag 'pull-18-rc1-work.fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Unify the primitives for file descriptor closing fs: remove fget_many and fput_many interface io_uring_enter(): don't leave f.flags uninitialized commit d66016c5cd3d4c474cd24622c511dcd358645613 Merge: d0e60d46bc032 ee3c8019cce25 Author: Linus Torvalds Date: Sat Jun 4 17:42:33 2022 -0700 Merge tag '5.19-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Nine cifs/smb3 client fixes. Includes DFS fixes, some cleanup of leagcy SMB1 code, duplicated message cleanup and a double free and deadlock fix" * tag '5.19-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share cifs: skip trailing separators of prefix paths cifs: update internal module number cifs: version operations for smb20 unneeded when legacy support disabled cifs: do not build smb1ops if legacy support is disabled cifs: fix potential deadlock in direct reclaim cifs: when extending a file with falloc we should make files not-sparse cifs: remove repeated debug message on cifs_put_smb_ses() cifs: fix potential double free during failed mount commit 42ce60aa5aa46ae00f71aa806a11510b6db6d1a7 Author: Schspa Shi Date: Fri Jun 3 17:38:52 2022 +0800 kbuild: Allow to select bash in a modified environment This fixes the build error when the system has a default bash version which is too old to support associative array variables. The build error log as fellowing: linux/scripts/check-local-export: line 11: declare: -A: invalid option declare: usage: declare [-afFirtx] [-p] [name[=value] ...] Signed-off-by: Schspa Shi Signed-off-by: Masahiro Yamada commit 2bbb486162c4ace673ea423bbd7e7b40f020ad45 Author: Isak Ellmer Date: Wed Jun 1 15:08:19 2022 +0200 scripts: kconfig: nconf: make nconfig accept jk keybindings Make nconfig accept jk keybindings for movement in addition to arrow keys. Signed-off-by: Isak Ellmer Signed-off-by: Masahiro Yamada commit a89227d769845eb9e9ab113f9f83df34d3c91db5 Author: Masahiro Yamada Date: Mon May 30 18:01:39 2022 +0900 modpost: use fnmatch() to simplify match() Replace the own implementation for wildcard (glob) matching with a function call to fnmatch(). Also, change the return type to 'bool'. Signed-off-by: Masahiro Yamada commit 8c9ce89c5b63028dd3be43807f10b009cd2c6e51 Author: Masahiro Yamada Date: Mon May 30 18:01:38 2022 +0900 modpost: simplify mod->name allocation mod->name is set to the ELF filename with the suffix ".o" stripped. The current code calls strdup() and free() to manipulate the string, but a simpler approach is to pass new_module() with the name length subtracted by 2. Also, check if the passed filename ends with ".o" before stripping it. The current code blindly chops the suffix: tmp[strlen(tmp) - 2] = '\0' It will cause buffer under-run if strlen(tmp) < 2; Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit b42d2306502419688190aa6dd4dab4a6def24b3d Author: Masahiro Yamada Date: Sun May 29 00:47:04 2022 +0900 kbuild: factor out the common objtool arguments scripts/Makefile.build and scripts/link-vmlinux.sh have similar setups for the objtool arguments. It was difficult to factor out them because all the vmlinux build rules were written in a shell script. It is somewhat tedious to touch the two files every time a new objtool option is supported. To reduce the code duplication, move the objtool for vmlinux.o into scripts/Makefile.vmlinux_o. Then, move the common macros to Makefile.lib so they are shared between Makefile.build and Makefile.vmlinux_o. Signed-off-by: Masahiro Yamada Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 5d45950dfbb1540bba3e3762a3497de8b4a715d3 Author: Masahiro Yamada Date: Sun May 29 00:47:03 2022 +0900 kbuild: move vmlinux.o link to scripts/Makefile.vmlinux_o This is a preparation for moving the objtool rule in the next commit. Signed-off-by: Masahiro Yamada Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit b0d6207bad2cb5a6f2099ac4a6ea4e76864dd596 Author: Masahiro Yamada Date: Sun May 29 00:47:02 2022 +0900 kbuild: clean .tmp_* pattern by make clean Change the "make clean" rule to remove all the .tmp_* files. .tmp_objdiff is the only exception, which should be removed by "make mrproper". Rename the record directory of objdiff, .tmp_objdiff to .objdiff to avoid the removal by "make clean". Signed-off-by: Masahiro Yamada Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit d0e60d46bc03252b8d4ffaaaa0b371970ac16cda Merge: 23df9ba64bb9e 0dfe54071d7c8 Author: Linus Torvalds Date: Sat Jun 4 14:04:27 2022 -0700 Merge tag 'bitmap-for-5.19-rc1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - bitmap: optimize bitmap_weight() usage, from me - lib/bitmap.c make bitmap_print_bitmask_to_buf parseable, from Mauro Carvalho Chehab - include/linux/find: Fix documentation, from Anna-Maria Behnsen - bitmap: fix conversion from/to fix-sized arrays, from me - bitmap: Fix return values to be unsigned, from Kees Cook It has been in linux-next for at least a week with no problems. * tag 'bitmap-for-5.19-rc1' of https://github.com/norov/linux: (31 commits) nodemask: Fix return values to be unsigned bitmap: Fix return values to be unsigned KVM: x86: hyper-v: replace bitmap_weight() with hweight64() KVM: x86: hyper-v: fix type of valid_bank_mask ia64: cleanup remove_siblinginfo() drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate KVM: s390: replace bitmap_copy with bitmap_{from,to}_arr64 where appropriate lib/bitmap: add test for bitmap_{from,to}_arr64 lib: add bitmap_{from,to}_arr64 lib/bitmap: extend comment for bitmap_(from,to)_arr32() include/linux/find: Fix documentation lib/bitmap.c make bitmap_print_bitmask_to_buf parseable MAINTAINERS: add cpumask and nodemask files to BITMAP_API arch/x86: replace nodes_weight with nodes_empty where appropriate mm/vmstat: replace cpumask_weight with cpumask_empty where appropriate clocksource: replace cpumask_weight with cpumask_empty in clocksource.c genirq/affinity: replace cpumask_weight with cpumask_empty where appropriate irq: mips: replace cpumask_weight with cpumask_empty where appropriate drm/i915/pmu: replace cpumask_weight with cpumask_empty where appropriate arch/x86: replace cpumask_weight with cpumask_empty where appropriate ... commit 23df9ba64bb9e26cfee6b34f5c3ece49a8a61ee1 Merge: 4ccbe91de91a8 b046f984814af Author: Linus Torvalds Date: Sat Jun 4 13:50:23 2022 -0700 Merge tag 'for-5.19/parisc-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull more parisc architecture updates from Helge Deller: "A fix to prevent crash at bootup if CONFIG_SCHED_MC is enabled, and add auto-detection of primary graphics card for framebuffer driver" * tag 'for-5.19/parisc-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc/stifb: Keep track of hardware path of graphics card parisc/stifb: Implement fb_is_primary_device() parisc: fix a crash with multicore scheduler commit 4ccbe91de91a8f9559052179d15c0229a8ac9f8a Merge: 45b2e5ad6837d 41925b105e345 Author: Linus Torvalds Date: Sat Jun 4 13:42:53 2022 -0700 Merge tag 'for-linus-5.19-rc1b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull more xen updates from Juergen Gross: "Two cleanup patches for Xen related code and (more important) an update of MAINTAINERS for Xen, as Boris Ostrovsky decided to step down" * tag 'for-linus-5.19-rc1b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: replace xen_remap() with memremap() MAINTAINERS: Update Xen maintainership xen: switch gnttab_end_foreign_access() to take a struct page pointer commit 45b2e5ad6837dfe4de6b9028c575bd57c132774c Merge: 032dcf09e2bf7 1bcca2b1bd67f Author: Linus Torvalds Date: Sat Jun 4 13:33:12 2022 -0700 Merge tag 'perf-tools-for-v5.19-2022-06-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tools updates from Arnaldo Carvalho de Melo: - Synthesize task events for pre-existing threads when using 'perf lock --threads', as we need to show task names. - Fix unwinding with ld.lld (>= version 10.0) linked objects, where .eh_frame_hdr and .text are in different PT_LOAD program headers, which makes perf record --call-graph dwarf fail with such obkects. - Check if 'perf record' hangs in the ARM SPE (Statistical Profiling Extensions) 'perf test' entry when recording a workload with forks. - Trace physical address for Arm SPE events, needed for 'perf c2c' to locate the memory node for samples. - Fix sorting in percent_rmt_hitm_cmp() in 'perf c2c'. - Further support for Intel hybrid systems in the evlist and 'perf record' code. - Update IBM s/390 vendor event JSON tables. - Add metrics (JSON) for Intel Sapphirerapids. - Update metrics for Intel Alderlake. - Correct typo of sysf 'event_source' directory in the documentation. * tag 'perf-tools-for-v5.19-2022-06-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf vendor events intel: Update metrics for Alderlake perf vendor events intel: Add metrics for Sapphirerapids perf c2c: Fix sorting in percent_rmt_hitm_cmp() perf mem: Trace physical address for Arm SPE events perf list: Update event description for IBM zEC12/zBC12 to latest level perf list: Update event description for IBM z196/z114 to latest level perf list: Update event description for IBM z15 to latest level perf list: Update event description for IBM z14 to latest level perf list: Update event description for IBM z13 to latest level perf list: Update event description for IBM z10 to latest level perf list: Add IBM z16 event description for s390 perf record: Support sample-read topdown metric group for hybrid platforms perf lock: Change to synthesize task events perf unwind: Fix segbase for ld.lld linked objects perf test arm-spe: Check if perf-record hangs when recording workload with forks perf docs: Correct typo of event_sources perf evlist: Extend arch_evsel__must_be_in_group to support hybrid systems commit ee3c8019cce254f586b7fc2c5b836c275b275527 Author: Steve French Date: Sat Jun 4 01:18:37 2022 -0500 cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share Set default value of ppath to null. Reported-by: kernel test robot Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit b046f984814af7985f444150ec28716d42d00d9a Author: Helge Deller Date: Thu Jun 2 13:55:26 2022 +0200 parisc/stifb: Keep track of hardware path of graphics card Keep the pa_path (hardware path) of the graphics card in sti_struct and use this info to give more useful info which card is currently being used. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.10+ commit cf936af790a3ef5f41ff687ec91bfbffee141278 Author: Helge Deller Date: Thu Jun 2 13:50:44 2022 +0200 parisc/stifb: Implement fb_is_primary_device() Implement fb_is_primary_device() function, so that fbcon detects if this framebuffer belongs to the default graphics card which was used to start the system. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.10+ commit 032dcf09e2bf7c822be25b4abef7a6c913870d98 Merge: 77d4d3609cd2d 7bb8a0cf49d5f Author: Linus Torvalds Date: Fri Jun 3 20:01:25 2022 -0700 Merge tag 'gpio-fixes-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use the correct register for regcache sync in gpio-pca953x - remove unused and potentially harmful code from gpio-adp5588 - MAINTAINERS update * tag 'gpio-fixes-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: adp5588: Remove support for platform setup and teardown callbacks gpio: pca953x: use the correct register address to do regcache sync MAINTAINERS: Update Intel GPIO (PMIC and PCH) to Supported MAINTAINERS: Update GPIO ACPI library to Supported commit 77d4d3609cd2dd613b6f4c3162616a944d3aeb0b Merge: 1f952675835bf 28cbc2d4c54c0 Author: Linus Torvalds Date: Fri Jun 3 19:57:25 2022 -0700 Merge tag 'regulator-fix-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One fix that came in during the merge window, fixing an error in the examples in the DT binding documentation for mt6315" * tag 'regulator-fix-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: mt6315-regulator: fix invalid allowed mode commit 1f952675835bfe18d6ae494a5581724d68c52352 Merge: 67850b7bdcd28 724bbe49c5e42 Author: Linus Torvalds Date: Fri Jun 3 16:57:16 2022 -0700 Merge tag 'ntfs3_for_5.19' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: - fix some memory leaks and panic - fixed xfstests (tested on x86_64): generic/092 generic/099 generic/228 generic/240 generic/307 generic/444 - fix some typos, dead code, etc * tag 'ntfs3_for_5.19' of https://github.com/Paragon-Software-Group/linux-ntfs3: fs/ntfs3: provide block_invalidate_folio to fix memory leak fs/ntfs3: Fix invalid free in log_replay fs/ntfs3: Update valid size if -EIOCBQUEUED fs/ntfs3: Check new size for limits fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space) fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if called from function ntfs_init_acl fs/ntfs3: Optimize locking in ntfs_save_wsl_perm fs/ntfs3: Update i_ctime when xattr is added fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions fs/ntfs3: Keep preallocated only if option prealloc enabled fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' commit 67850b7bdcd2803e10d019f0da5673a92139b43a Merge: 1ec6574a3c0a2 31cae1eaae4fd Author: Linus Torvalds Date: Fri Jun 3 16:13:25 2022 -0700 Merge tag 'ptrace_stop-cleanup-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull ptrace_stop cleanups from Eric Biederman: "While looking at the ptrace problems with PREEMPT_RT and the problems Peter Zijlstra was encountering with ptrace in his freezer rewrite I identified some cleanups to ptrace_stop that make sense on their own and move make resolving the other problems much simpler. The biggest issue is the habit of the ptrace code to change task->__state from the tracer to suppress TASK_WAKEKILL from waking up the tracee. No other code in the kernel does that and it is straight forward to update signal_wake_up and friends to make that unnecessary. Peter's task freezer sets frozen tasks to a new state TASK_FROZEN and then it stores them by calling "wake_up_state(t, TASK_FROZEN)" relying on the fact that all stopped states except the special stop states can tolerate spurious wake up and recover their state. The state of stopped and traced tasked is changed to be stored in task->jobctl as well as in task->__state. This makes it possible for the freezer to recover tasks in these special states, as well as serving as a general cleanup. With a little more work in that direction I believe TASK_STOPPED can learn to tolerate spurious wake ups and become an ordinary stop state. The TASK_TRACED state has to remain a special state as the registers for a process are only reliably available when the process is stopped in the scheduler. Fundamentally ptrace needs acess to the saved register values of a task. There are bunch of semi-random ptrace related cleanups that were found while looking at these issues. One cleanup that deserves to be called out is from commit 57b6de08b5f6 ("ptrace: Admit ptrace_stop can generate spuriuos SIGTRAPs"). This makes a change that is technically user space visible, in the handling of what happens to a tracee when a tracer dies unexpectedly. According to our testing and our understanding of userspace nothing cares that spurious SIGTRAPs can be generated in that case" * tag 'ptrace_stop-cleanup-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state ptrace: Always take siglock in ptrace_resume ptrace: Don't change __state ptrace: Admit ptrace_stop can generate spuriuos SIGTRAPs ptrace: Document that wait_task_inactive can't fail ptrace: Reimplement PTRACE_KILL by always sending SIGKILL signal: Use lockdep_assert_held instead of assert_spin_locked ptrace: Remove arch_ptrace_attach ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP signal: Replace __group_send_sig_info with send_signal_locked signal: Rename send_signal send_signal_locked commit 1ec6574a3c0a22c130c08e8c36c825cb87d68f8e Merge: 1888e9b4bb78c b3f9916d81e8f Author: Linus Torvalds Date: Fri Jun 3 16:03:05 2022 -0700 Merge tag 'kthread-cleanups-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull kthread updates from Eric Biederman: "This updates init and user mode helper tasks to be ordinary user mode tasks. Commit 40966e316f86 ("kthread: Ensure struct kthread is present for all kthreads") caused init and the user mode helper threads that call kernel_execve to have struct kthread allocated for them. This struct kthread going away during execve in turned made a use after free of struct kthread possible. Here, commit 343f4c49f243 ("kthread: Don't allocate kthread_struct for init and umh") is enough to fix the use after free and is simple enough to be backportable. The rest of the changes pass struct kernel_clone_args to clean things up and cause the code to make sense. In making init and the user mode helpers tasks purely user mode tasks I ran into two complications. The function task_tick_numa was detecting tasks without an mm by testing for the presence of PF_KTHREAD. The initramfs code in populate_initrd_image was using flush_delayed_fput to ensuere the closing of all it's file descriptors was complete, and flush_delayed_fput does not work in a userspace thread. I have looked and looked and more complications and in my code review I have not found any, and neither has anyone else with the code sitting in linux-next" * tag 'kthread-cleanups-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: sched: Update task_tick_numa to ignore tasks without an mm fork: Stop allowing kthreads to call execve fork: Explicitly set PF_KTHREAD init: Deal with the init process being a user mode process fork: Generalize PF_IO_WORKER handling fork: Explicity test for idle tasks in copy_thread fork: Pass struct kernel_clone_args into copy_thread kthread: Don't allocate kthread_struct for init and umh commit 1888e9b4bb78c88514b24ecafa9e4e4faf761747 Merge: 07953c54a1056 38cd5b12b7854 Author: Linus Torvalds Date: Fri Jun 3 15:54:57 2022 -0700 Merge tag 'per-namespace-ipc-sysctls-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull ipc sysctl namespace updates from Eric Biederman: "This updates the ipc sysctls so that they are fundamentally per ipc namespace. Previously these sysctls depended upon a hack to simulate being per ipc namespace by looking up the ipc namespace in read or write. With this set of changes the ipc sysctls are registered per ipc namespace and open looks up the ipc namespace. Not only does this series of changes ensure the traditional binding at open time happens, but it sets a foundation for being able to relax the permission checks to allow a user namspace root to change the ipc sysctls for an ipc namespace that the user namespace root requires. To do this requires the ipc namespace to be known at open time" * tag 'per-namespace-ipc-sysctls-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: ipc: Remove extra braces ipc: Check permissions for checkpoint_restart sysctls at open time ipc: Remove extra1 field abuse to pass ipc namespace ipc: Use the same namespace to modify and validate ipc: Store ipc sysctls in the ipc namespace ipc: Store mqueue sysctls in the ipc namespace commit 07953c54a10567e484cefd8f8c782025dc68b3b1 Author: Linus Torvalds Date: Fri Jun 3 15:46:03 2022 -0700 firmware_loader: enable XZ by default if compressed support is enabled Commit 23cfbc6ec44e ("firmware: Add the support for ZSTD-compressed firmware files") added support for ZSTD compression, but in the process also made the previously default XZ compression a config option. That means that anybody who upgrades their kernel and does a make oldconfig to update their configuration, will end up without the XZ compression that the configuration used to have. Add the 'default y' to make sure this doesn't happen. The whole compression question should probably be improved upon, since it is now possible to "enable" compression in the kernel config but not enable any actual compression algorithm, which makes it all very useless. It makes no sense to ask Kconfig questions that enable situations that are nonsensical like that. This at least fixes the immediate problem of a kernel update resulting in a nonbootable machine because of a missed option. Fixes: 23cfbc6ec44e ("firmware: Add the support for ZSTD-compressed firmware files") Cc: Takashi Iwai Cc: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 744983d8784214c4f184be7448efb216315b48ae Merge: 4e583ff9df912 8c03a1c21d722 Author: Linus Torvalds Date: Fri Jun 3 14:42:24 2022 -0700 Merge tag 'for-linus-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull JFFS2, UBI and UBIFS updates from Richard Weinberger: "JFFS2: - Fixes for a memory leak UBI: - Fixes for fastmap (UAF, high CPU usage) UBIFS: - Minor cleanups" * tag 'for-linus-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubi: ubi_create_volume: Fix use-after-free when volume creation failed ubi: fastmap: Check wl_pool for free peb before wear leveling ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty ubifs: Use NULL instead of using plain integer as pointer ubifs: Simplify the return expression of run_gc() jffs2: fix memory leak in jffs2_do_fill_super jffs2: Use kzalloc instead of kmalloc/memset commit 4e583ff9df9126e275c32c6ecff54b0316fe1dee Merge: a01fe7ec42b7f 2a4a62a14be19 Author: Linus Torvalds Date: Fri Jun 3 14:35:14 2022 -0700 Merge tag 'for-linus-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - Various cleanups and fixes: xterm, serial line, time travel - Set ARCH_HAS_GCOV_PROFILE_ALL * tag 'for-linus-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Fix out-of-bounds read in LDT setup um: chan_user: Fix winch_tramp() return value um: virtio_uml: Fix broken device handling in time-travel um: line: Use separate IRQs per line um: Enable ARCH_HAS_GCOV_PROFILE_ALL um: Use asm-generic/dma-mapping.h um: daemon: Make default socket configurable um: xterm: Make default terminal emulator configurable commit a01fe7ec42b7fcd4201084dc56a2372f7b101f99 Merge: 9af13088ab139 987cf300e76d3 Author: Linus Torvalds Date: Fri Jun 3 14:24:44 2022 -0700 Merge tag 'devicetree-fixes-for-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fixes for unevaluatedProperties warnings. These were missed to due to a bug in dtschema which is now fixed. The changes involve either adding missing properties or removing spurious properties from examples. - Update several Qualcomm binding maintainer email addresses - Fix typo in imx8mp-media-blk-ctrl example - Fix fixed string pattern in qcom,smd - Correct the order of 'reg' entries in Xilinx PCI binding * tag 'devicetree-fixes-for-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: mtd: spi-nand: Add spi-peripheral-props.yaml reference dt-bindings: memory-controllers: ingenic: Split out child node properties dt-bindings: net/dsa: Add spi-peripheral-props.yaml references dt-bindings: PCI: apple: Add missing 'power-domains' property dt-bindings: Update Sibi Sankar's email address dt-bindings: clock: Update my email address dt-bindings: PCI: xilinx-cpm: Fix reg property order dt-bindings: net: Fix unevaluatedProperties warnings in examples dt-bindings: PCI: socionext,uniphier-pcie: Add missing child interrupt controller dt-bindings: usb: snps,dwc3: Add missing 'dma-coherent' property dt-bindings: soc: imx8mp-media-blk-ctrl: Fix DT example dt-bindings: soc: qcom,smd: do not use pattern for simple rpm-requests string commit 9af13088ab139ff1663e44e5746e152303cffbc7 Merge: c6f2f3e2c80e9 7036440eab3e2 Author: Linus Torvalds Date: Fri Jun 3 14:20:28 2022 -0700 Merge tag 'arm-multiplatform-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull yet more ARM multiplatform updates from Arnd Bergmann: "This is the third and final bit of the multiplatform conversion for ARMv5, finishing off OMAP1. One patch enables the common-clk interface, and the other ones does the Kconfig change. These were waiting on a few dependencies to trickle in for common-clk, and the last one of those was in the USB tree" * tag 'arm-multiplatform-5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: omap1: enable multiplatform ARM: OMAP1: clock: Convert to CCF commit c6f2f3e2c80e975804360665d973211e4d9390cb Merge: 21873bd66b6e6 8be4493119b0a Author: Linus Torvalds Date: Fri Jun 3 14:09:21 2022 -0700 Merge tag 'loongarch-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull initial Loongarch architecture code from Arnd Bergmann: "This is the majority of the loongarch architecture code, including the final system call interface and all core functionality. It still misses three sets of peripheral but vital patches to add support for other subsystems, which have yet to pass review: - The drivers/firmware/efi stub for booting from a standard UEFI firmware implementation. Both the original custom boot interface and a draft implementation of the EFI stub did not make it, so it is currently impossible to boot the kernel, until the loongarch specific portions get accepted into the UEFI subsystem - The drivers/irqchip/irq-loongson-*.c drivers are shared with the the MIPS port, but currently lack support for ACPI based booting, which will get merged through the irqchip subsystem. - Similarly, the drivers/pci/controller/pci-loongson.c needs to be modified for ACPI support, which will be merged through the PCI subsystem. While the port cannot actually be used before all the above are merged, having it in 5.19 helps to establish the user space ABI for the libc ports to build on, and to help any treewide changes in the mainline kernel get applied here as well. A gcc-12 based tool chains for build testing is now included in https://mirrors.edge.kernel.org/pub/tools/crosstool/" Original description from Huacai Chen: "LoongArch is a new RISC ISA, which is a bit like MIPS or RISC-V. LoongArch includes a reduced 32-bit version (LA32R), a standard 32-bit version (LA32S) and a 64-bit version (LA64). LoongArch use ACPI as its boot protocol LoongArch-specific interrupt controllers (similar to APIC) are already added in the next revision of ACPI Specification (current revision is 6.4). This patchset is adding basic LoongArch support in mainline kernel, we can see a complete snapshot here: https://github.com/loongson/linux/tree/loongarch-next https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson.git/log/?h=loongarch-next Cross-compile tool chain to build kernel: https://github.com/loongson/build-tools/releases/download/2021.12.21/loongarch64-clfs-2022-03-03-cross-tools-gcc-glibc.tar.xz A CLFS-based Linux distro: https://github.com/loongson/build-tools/releases/download/2021.12.21/loongarch64-clfs-system-2022-03-03.tar.bz2 Open-source tool chain which is under review (Binutils and Gcc are already upstream): https://github.com/loongson/binutils-gdb/tree/upstream_v3.1 https://github.com/loongson/gcc/tree/loongarch_upstream_v6.3 https://github.com/loongson/glibc/tree/loongarch_2_35_dev_v2.2 Loongson and LoongArch documentations: https://github.com/loongson/LoongArch-Documentation LoongArch-specific interrupt controllers: https://mantis.uefi.org/mantis/view.php?id=2203 https://mantis.uefi.org/mantis/view.php?id=2313" Link: https://lore.kernel.org/lkml/20220603072053.35005-1-chenhuacai@loongson.cn/ * tag 'loongarch-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: (24 commits) MAINTAINERS: Add maintainer information for LoongArch LoongArch: Add Loongson-3 default config file LoongArch: Add Non-Uniform Memory Access (NUMA) support LoongArch: Add multi-processor (SMP) support LoongArch: Add VDSO and VSYSCALL support LoongArch: Add some library functions LoongArch: Add misc common routines LoongArch: Add ELF and module support LoongArch: Add signal handling support LoongArch: Add system call support LoongArch: Add memory management LoongArch: Add process management LoongArch: Add exception/interrupt handling LoongArch: Add boot and setup routines LoongArch: Add other common headers LoongArch: Add atomic/locking headers LoongArch: Add CPU definition headers LoongArch: Add build infrastructure LoongArch: Add writecombine support for drm LoongArch: Add ELF-related definitions ... commit 21873bd66b6e6040d95d0a33525ea6933bdc6c71 Merge: f66e797b407bc 78c09c0f4df89 Author: Linus Torvalds Date: Fri Jun 3 14:05:34 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "Most of issues addressed were introduced during this merging window. - Initialise jump labels before setup_machine_fdt(), needed by commit f5bda35fba61 ("random: use static branch for crng_ready()"). - Sparse warnings: missing prototype, incorrect __user annotation. - Skip SVE kselftest if not sufficient vector lengths supported" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported arm64: Initialize jump labels before setup_machine_fdt() arm64: hibernate: Fix syntax errors in comments arm64: Remove the __user annotation for the restore_za_context() argument ftrace/fgraph: fix increased missing-prototypes warnings commit f66e797b407bc03a438d1f05057dc7918bab473f Merge: 4ab6cfc4ad9f8 61114e734ccb8 Author: Linus Torvalds Date: Fri Jun 3 14:01:43 2022 -0700 Merge tag 'riscv-for-linus-5.19-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: "This is mostly some DT updates, but also a handful of cleanups and some fixes. The most user-visible of those are: - A device tree for the Sundance Polarberry, along with a handful of fixes and clenups to the PolarFire SOC device trees and bindings. - The memfd_secret syscall number is now visible to userspace, - Some improvements to the vm layout dump, which really should have followed shortly after the sv48 patches but I missed" * tag 'riscv-for-linus-5.19-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Move alternative length validation into subsection riscv: mm: init: make pt_ops_set_[early|late|fixmap] static riscv: move errata/ and kvm/ builds to arch/riscv/Kbuild RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY riscv: Wire up memfd_secret in UAPI header riscv: Fix irq_work when SMP is disabled riscv: Improve virtual kernel memory layout dump riscv: Initialize thread pointer before calling C functions Documentation: riscv: Add sv48 description to VM layout RISC-V: Only default to spinwait on SBI-0.1 and M-mode riscv: dts: icicle: sort nodes alphabetically riscv: microchip: icicle: readability fixes riscv: dts: microchip: add the sundance polarberry dt-bindings: riscv: microchip: add polarberry compatible string dt-bindings: vendor-prefixes: add Sundance DSP riscv: dts: microchip: make the fabric dtsi board specific dt-bindings: riscv: microchip: document icicle reference design riscv: dts: microchip: remove soc vendor from filenames riscv: dts: microchip: move sysctrlr out of soc bus riscv: dts: microchip: remove icicle memory clocks commit 4ab6cfc4ad9f867a107b0ef029088dd4c0a8f83c Merge: 93ce7948e38ff e0ffcf3fe18e0 Author: Linus Torvalds Date: Fri Jun 3 13:57:50 2022 -0700 Merge tag 's390-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Heiko Carstens: "Just a couple of small improvements, bug fixes and cleanups: - Add Eric Farman as maintainer for s390 virtio drivers. - Improve machine check handling, and avoid incorrectly injecting a machine check into a kvm guest. - Add cond_resched() call to gmap page table walker in order to avoid possible huge latencies. Also use non-quiesing sske instruction to speed up storage key handling. - Add __GFP_NORETRY to KEXEC_CONTROL_MEMORY_GFP so s390 behaves similar like common code. - Get sie control block address from correct stack slot in perf event code. This fixes potential random memory accesses. - Change uaccess code so that the exception handler sets the result of get_user() and __get_kernel_nofault() to zero in case of a fault. Until now this was done via input parameters for inline assemblies. Doing it via fault handling is what most or even all other architectures are doing. - Couple of other small cleanups and fixes" * tag 's390-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/stack: add union to reflect kvm stack slot usages s390/stack: merge empty stack frame slots s390/uaccess: whitespace cleanup s390/uaccess: use __noreturn instead of __attribute__((noreturn)) s390/uaccess: use exception handler to zero result on get_user() failure s390/uaccess: use symbolic names for inline assembler operands s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag s390/mm: use non-quiescing sske for KVM switch to keyed guest s390/gmap: voluntarily schedule during key setting MAINTAINERS: Update s390 virtio-ccw s390/kexec: add __GFP_NORETRY to KEXEC_CONTROL_MEMORY_GFP s390/Kconfig.debug: fix indentation s390/Kconfig: fix indentation s390/perf: obtain sie_block from the right address s390: generate register offsets into pt_regs automatically s390: simplify early program check handler s390/crypto: fix scatterwalk_unmap() callers in AES-GCM commit 12d6c18cfa708e954a7de27dd76cf45054c8855a Author: Evan Quan Date: Mon May 30 14:58:08 2022 +0800 drm/amdgpu: suppress the compile warning about 64 bit type Suppress the compile warning below: drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:1292 gfx_v11_0_rlc_backdoor_autoload_copy_ucode() warn: should '1 << id' be a 64 bit type? Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Evan Quan Reviewed-by: Guchun Chen Acked-by: Christian König Signed-off-by: Alex Deucher commit 4513edf74cc82c15bc1cefc2ab62ff25fe67028e Author: Evan Quan Date: Mon May 30 11:37:07 2022 +0800 drm/amd/pm: suppress compile warnings about possible unaligned accesses Suppress the following compile warnings: >> drivers/gpu/drm/amd/amdgpu/../pm/swsmu/inc/smu_v11_0_pptable.h:163:17: warning: field smc_pptable within 'struct smu_11_0_powerplay_table' is less aligned than 'PPTable_t' and is usually due to 'struct smu_11_0_powerplay_table' being packed, which can lead to unaligned accesses [-Wunaligned-access] PPTable_t smc_pptable; //PPTable_t in smu11_driver_if.h ^ 1 warning generated. -- >> drivers/gpu/drm/amd/amdgpu/../pm/swsmu/inc/smu_v11_0_7_pptable.h:193:17: warning: field smc_pptable within 'struct smu_11_0_7_powerplay_table' is less aligned than 'PPTable_t' and is usually due to 'struct smu_11_0_7_powerplay_table' being packed, which can lead to unaligned accesses [-Wunaligned-access] PPTable_t smc_pptable; //PPTable_t in smu11_driver_if.h ^ 1 warning generated. -- >> drivers/gpu/drm/amd/amdgpu/../pm/swsmu/inc/smu_v13_0_pptable.h:161:12: warning: field smc_pptable within 'struct smu_13_0_powerplay_table' is less aligned than 'PPTable_t' and is usually due to 'struct smu_13_0_powerplay_table' being packed, which can lead to unaligned accesses [-Wunaligned-access] Signed-off-by: Evan Quan Reported-by: kernel test robot Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 88467db6e2f46a2e79b1b67ce6873c284e4cf417 Author: Philip Yang Date: Fri Jun 3 09:19:34 2022 -0400 drm/amdkfd: Fix partial migration bugs Migration range from system memory to VRAM, if system page can not be locked or unmapped, we do partial migration and leave some pages in system memory. Several bugs found to copy pages and update GPU mapping for this situation: 1. copy to vram should use migrate->npage which is total pages of range as npages, not migrate->cpages which is number of pages can be migrated. 2. After partial copy, set VRAM res cursor as j + 1, j is number of system pages copied plus 1 page to skip copy. 3. copy to ram, should collect all continuous VRAM pages and copy together. 4. Call amdgpu_vm_update_range, should pass in offset as bytes, not as number of pages. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 93ce7948e38ffe6f9b4fd403c94c098bd892a5ff Merge: 9be4cbd09da82 75ed63d919400 Author: Linus Torvalds Date: Fri Jun 3 13:39:30 2022 -0700 Merge tag 'efi-next-for-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull more EFI updates from Ard Biesheuvel: "Follow-up tweaks for EFI changes - they mostly address issues introduced this merge window, except for Heinrich's patch: - fix new DXE service invocations for mixed mode - use correct Kconfig symbol when setting PE header flag - clean up the drivers/firmware/efi Kconfig dependencies so that features that depend on CONFIG_EFI are hidden from the UI when the symbol is not enabled. Also included is a RISC-V bugfix from Heinrich to avoid read-write mappings of read-only firmware regions in the EFI page tables" * tag 'efi-next-for-v5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: clean up Kconfig dependencies on CONFIG_EFI efi/x86: libstub: Make DXE calls mixed mode safe efi: x86: Fix config name for setting the NX-compatibility flag in the PE header riscv: read-only pages should not be writable commit 4fac4fcf4500bce515b0f32195e7bb86aa0246c6 Author: Lang Yu Date: Tue May 31 09:19:43 2022 +0800 drm/amdkfd: add pinned BOs to kfd_bo_list The kfd_bo_list is used to restore process BOs after evictions. As page tables could be destroyed during evictions, we should also update pinned BOs' page tables during restoring to make sure they are valid. So for pinned BOs, 1, Validate them and update their page tables. 2, Don't add eviction fence for them. v2: - Don't handle pinned ones specially in BO validation.(Felix) Signed-off-by: Lang Yu Acked-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 4d1e5f12b7a0d2ade73003d2522a23b4559c7e02 Author: Philip Yang Date: Wed Jun 1 19:02:45 2022 -0400 drm/amdgpu: Update PDEs flush TLB if PTB/PDB moved Flush TLBs when existing PDEs are updated because a PTB or PDB moved, but avoids unnecessary TLB flushes when new PDBs or PTBs are added to the page table, which commonly happens when memory is mapped for the first time. Suggested-by: Christian König Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 371017309a9f1725bfd3283afe61efa4ac34d30c Author: Sunil Khatri Date: Mon May 30 23:24:09 2022 +0530 drm/amdgpu: enable tmz by default for GC 10.3.7 Add IP GC 10.3.7 in the list of target to have tmz enabled by default. Signed-off-by: Sunil Khatri Reviewed-by: Alexander Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit 7c4f4f197e0c5c93a70329627f17fcc5883f3593 Author: Mario Limonciello Date: Tue May 31 18:56:41 2022 -0500 drm/amdkfd: Add GC 10.3.6 and 10.3.7 KFD definitions Loading amdgpu on GC 10.3.7 shows an ERR level message: `kfd kfd: amdgpu: GC IP 0a0307 not supported in kfd` Add these targets to match yellow carp structures. Reported-by: David Chang Reviewed-by: Felix Kuehling Tested-by: Jesse(Jie) Zhang Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.18.x commit 1bcca2b1bd67f3c0e5c3a88ed16c6389f01a5b31 Author: Zhengjun Xing Date: Sat May 28 17:59:33 2022 +0800 perf vendor events intel: Update metrics for Alderlake Update JSON metrics for Alderlake to perf. It included both P-core and E-core metrics. P-core metrics based on TMA 4.4 (TMA_Metrics-full.csv) E-core metrics based on E-core TMA 2.0 (E-core_TMA_Metrics.csv) https://download.01.org/perfmon/ Signed-off-by: Zhengjun Xing Tested-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220528095933.1784141-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 122657820fe041e0917c04d53bbbc81aede53a5a Author: Zhengjun Xing Date: Sat May 28 17:59:32 2022 +0800 perf vendor events intel: Add metrics for Sapphirerapids Add JSON metrics for Sapphirerapids to perf. Based on TMA4.4 metrics. https://download.01.org/perfmon/TMA_Metrics-full.csv Signed-off-by: Zhengjun Xing Tested-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220528095933.1784141-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b24192a17337abbf3f44aaa75e15df14a2d0016e Author: Leo Yan Date: Mon May 30 16:42:53 2022 +0800 perf c2c: Fix sorting in percent_rmt_hitm_cmp() The function percent_rmt_hitm_cmp() wrongly uses local HITMs for sorting remote HITMs. Since this function is to sort cache lines for remote HITMs, this patch changes to use 'rmt_hitm' field for correct sorting. Fixes: 9cb3500afc0980c5 ("perf c2c report: Add hitm/store percent related sort keys") Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Joe Mario Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220530084253.750190-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 62e6eb8d5454401bc38b6eba35bab738b63a478b Author: Leo Yan Date: Mon May 30 16:36:45 2022 +0800 perf mem: Trace physical address for Arm SPE events Currently, Arm SPE events don't trace physical address, therefore, the field 'phys_addr' is always zero in synthesized memory samples. This leads to perf c2c tool cannot locate the memory node for samples. This patch enables configuration 'pa_enable' for Arm SPE events, so the physical address packet can be traced, finally this can allow perf c2c tool to locate properly for memory node. Signed-off-by: Leo Yan Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: German Gomez Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mike Leach Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220530083645.253432-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 882f54243a45ed9cc539b6bfc2ea9df331c6c6b2 Author: Thomas Richter Date: Tue May 31 11:27:06 2022 +0200 perf list: Update event description for IBM zEC12/zBC12 to latest level Update IBM zEC12/zBC12 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-7-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit dfeab63acd977f8f86064f88d82860c2d79a0f6e Author: Thomas Richter Date: Tue May 31 11:27:05 2022 +0200 perf list: Update event description for IBM z196/z114 to latest level Update IBM z196/z114 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-6-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit d1833463dd132b3ff83dfab76c0249fcf46d1656 Author: Thomas Richter Date: Tue May 31 11:27:04 2022 +0200 perf list: Update event description for IBM z15 to latest level Update IBM z15 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-5-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit d786bdf2a70545a868cd0b06b5603cd5a5fec011 Author: Thomas Richter Date: Tue May 31 11:27:03 2022 +0200 perf list: Update event description for IBM z14 to latest level Update IBM z14 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-4-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit e9c26fd6401d9af297faaffd40f1c9fd75739df2 Author: Thomas Richter Date: Tue May 31 11:27:02 2022 +0200 perf list: Update event description for IBM z13 to latest level Update IBM z13 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-3-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit f71a261acd1d854391a3a972e9c2429e4f74ca01 Author: Thomas Richter Date: Tue May 31 11:27:01 2022 +0200 perf list: Update event description for IBM z10 to latest level Update IBM z10 event counter description to the latest level as described in the documents 1. SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities." released on May, 2022 for the following counter sets: * Basic counter set * Problem counter set * Crypto counter set 2. SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 for the following counter sets: * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-2-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit 7f76b31130680fb322b3c28563e50f1679140526 Author: Thomas Richter Date: Tue May 31 11:27:00 2022 +0200 perf list: Add IBM z16 event description for s390 Update IBM z16 counter description using document SA23-2260-07: "The Load-Program-Parameter and the CPU-Measurement Facilities" released in May, 2022, to include counter definitions for IBM z16 counter sets: * Basic counter set * Problem/user counter set * Crypto counter set Use document SA23-2261-07: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15 and z16" released on April 29, 2022 to include counter definitions for IBM z16 * Extended counter set * MT-Diagnostic counter set Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220531092706.1931503-1-tmricht@linux.ibm.com Cc: acme@kernel.org Cc: gor@linux.ibm.com Cc: hca@linux.ibm.com Cc: svens@linux.ibm.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit 151e7d75036b4e2ac0f33730bc1a5b3ff424d9a7 Author: Zhengjun Xing Date: Thu Jun 2 23:36:03 2022 +0800 perf record: Support sample-read topdown metric group for hybrid platforms With the hardware TopDown metrics feature, the sample-read feature should be supported for a TopDown group, e.g., sample a non-topdown event and read a Topdown metric group. But the current perf record code errors are out. For a TopDown metric group,the slots event must be the leader of the group, but the leader slots event doesn't support sampling. To support sample-read the TopDown metric group, uses the 2nd event of the group as the "leader" for the purposes of sampling. Only the platform with the TopDown metric feature supports sample-read the topdown group. In commit acb65150a47c ("perf record: Support sample-read topdown metric group"), it adds arch_topdown_sample_read() to indicate whether the TopDown group supports sample-read, it should only work on the non-hybrid systems, this patch extends the support for hybrid platforms. Before: # ./perf record -e "{cpu_core/slots/,cpu_core/cycles/,cpu_core/topdown-retiring/}:S" -a sleep 1 Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (cpu_core/topdown-retiring/). /bin/dmesg | grep -i perf may provide additional information. After: # ./perf record -e "{cpu_core/slots/,cpu_core/cycles/,cpu_core/topdown-retiring/}:S" -a sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.238 MB perf.data (369 samples) ] Fixes: acb65150a47c2bae ("perf record: Support sample-read topdown metric group") Reviewed-by: Kan Liang Signed-off-by: Zhengjun Xing Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220602153603.1884710-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 2762c488cdc129aaddeb9a3b81aafd9023f1649d Author: Namhyung Kim Date: Tue May 31 23:58:42 2022 -0700 perf lock: Change to synthesize task events With -t/--threads option, it needs to display task names so synthesize task related events at the beginning. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Waiman Long Cc: Will Deacon Fixes: 7c3bcbdf449f ("perf lock: Add -t/--thread option for report") Link: http://lore.kernel.org/lkml/20220601065846.456965-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit dc2cf4ca866f571590b65f5e4de06b8c9a302808 Author: Fangrui Song Date: Fri May 27 11:20:39 2022 -0700 perf unwind: Fix segbase for ld.lld linked objects segbase is the address of .eh_frame_hdr and table_data is segbase plus the header size. find_proc_info computes segbase as `map->start + segbase - map->pgoff` which is wrong when * .eh_frame_hdr and .text are in different PT_LOAD program headers * and their p_vaddr difference does not equal their p_offset difference Since 10.0, ld.lld's default --rosegment -z noseparate-code layout has such R and RX PT_LOAD program headers. ld.lld (default) => perf report fails to unwind `perf record --call-graph dwarf` recorded data ld.lld --no-rosegment => ok (trivial, no R PT_LOAD) ld.lld -z separate-code => ok but by luck: there are two PT_LOAD but their p_vaddr difference equals p_offset difference ld.bfd -z noseparate-code => ok (trivial, no R PT_LOAD) ld.bfd -z separate-code (default for Linux/x86) => ok but by luck: there are two PT_LOAD but their p_vaddr difference equals p_offset difference To fix the issue, compute segbase as dso's base address plus PT_GNU_EH_FRAME's p_vaddr. The base address is computed by iterating over all dso-associated maps and then subtract the first PT_LOAD p_vaddr (the minimum guaranteed by generic ABI) from the minimum address. In libunwind, find_proc_info transitively called by unw_step is cached, so the iteration overhead is acceptable. Reported-by: Sebastian Ullrich Reviewed-by: Ian Rogers Signed-off-by: Fangrui Song Cc: Ingo Molnar Cc: Peter Zijlstra Cc: llvm@lists.linux.dev Link: https://github.com/ClangBuiltLinux/linux/issues/1646 Link: https://lore.kernel.org/r/20220527182039.673248-1-maskray@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4f52ca135861e92a271262eefc0f040513d266d4 Author: German Gomez Date: Mon Feb 28 16:56:54 2022 +0000 perf test arm-spe: Check if perf-record hangs when recording workload with forks Add shell test to check if perf-record hangs when recording an arm_spe event with forks. The test FAILS if the Kernel is not patched with Commit 961c391217 ("perf: Always wake the parent event"). Unpatched Kernel: $ perf test -v 90 90: Check Arm SPE doesn't hang when there are forks --- start --- test child forked, pid 14232 Recording workload with fork Log lines = 90 /tmp/__perf_test.stderr.0Nu0U Log lines after 1 second = 90 /tmp/__perf_test.stderr.0Nu0U SPE hang test: FAIL test child finished with -1 ---- end ---- Check Arm SPE trace data in workload with forks: FAILED! Patched Kernel: $ perf test -v 90 90: Check Arm SPE doesn't hang when there are forks --- start --- test child forked, pid 2930 Compiling test program... Recording workload... Log lines = 478 /tmp/__perf_test.log.026AI Log lines after 1 second = 557 /tmp/__perf_test.log.026AI SPE hang test: PASS Cleaning up files... test child finished with 0 ---- end ---- Check Arm SPE trace data in workload with forks: Ok Reviewed-by: James Clark Reviewed-by: Leo Yan Signed-off-by: German Gomez Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220228165655.3920-1-german.gomez@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ef605e86821253d16d47a02ce1f766a461614fef Author: Paulo Alcantara Date: Fri Jun 3 16:13:02 2022 -0300 cifs: skip trailing separators of prefix paths During DFS failover, prefix paths may change, so make sure to not leave trailing separators when parsing thew in dfs_cache_get_tgt_share(). The separators of prefix paths are already handled by build_path_from_dentry_optional_prefix(). Consider the following DFS link: //dom/dfs/link: [\srv1\share\dir1, \srv2\share\dir1] Before commit: mount.cifs //dom/dfs/link tree connect to \\srv1\share; prefix_path=dir1 disconnect srv1; failover to srv2 tree connect to \\srv2\share; prefix_path=dir1\ mv foo bar ... SMB2 430 Create Request File: dir1\\foo;GetInfo Request FILE_INFO/SMB2_FILE_ALL_INFO;Close Request SMB2 582 Create Response File: dir1\\foo;GetInfo Response;Close Response SMB2 430 Create Request File: dir1\\bar;GetInfo Request FILE_INFO/SMB2_FILE_ALL_INFO;Close Request SMB2 286 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;GetInfo Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;Close Response, Error: STATUS_OBJECT_NAME_NOT_FOUND SMB2 462 Create Request File: dir1\\foo;SetInfo Request FILE_INFO/SMB2_FILE_RENAME_INFO NewName:dir1\\bar;Close Request SMB2 478 Create Response File: dir1\\foo;SetInfo Response, Error: STATUS_OBJECT_NAME_INVALID;Close Response After commit: mount.cifs //dom/dfs/link tree connect to \\srv1\share; prefix_path=dir1 disconnect srv1; failover to srv2 tree connect to \\srv2\share; prefix_path=dir1 mv foo bar ... SMB2 430 Create Request File: dir1\foo;GetInfo Request FILE_INFO/SMB2_FILE_ALL_INFO;Close Request SMB2 582 Create Response File: dir1\foo;GetInfo Response;Close Response SMB2 430 Create Request File: dir1\bar;GetInfo Request FILE_INFO/SMB2_FILE_ALL_INFO;Close Request SMB2 286 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;GetInfo Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;Close Response, Error: STATUS_OBJECT_NAME_NOT_FOUND SMB2 462 Create Request File: dir1\foo;SetInfo Request FILE_INFO/SMB2_FILE_RENAME_INFO NewName:dir1\bar;Close Request SMB2 478 Create Response File: dir1\foo;SetInfo Response;Close Response Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 8db43088ef16007f5e5b285d8c78c225a88083d6 Author: Ian Rogers Date: Thu Jun 2 21:57:44 2022 -0700 perf docs: Correct typo of event_sources The sysfs directory is called event_source. Before: $ ls -la /sys/bus/event_sources/devices/cpu/format/ ls: cannot access '/sys/bus/event_sources/devices/cpu/format/': No such file or directory $ After: $ ls -la /sys/bus/event_source/devices/cpu/format/ total 0 drwxr-xr-x. 2 root root 0 Jun 2 15:36 . drwxr-xr-x. 6 root root 0 Jun 2 15:35 .. -r--r--r--. 1 root root 4096 Jun 2 15:36 any -r--r--r--. 1 root root 4096 Jun 2 15:36 cmask -r--r--r--. 1 root root 4096 Jun 2 15:36 edge -r--r--r--. 1 root root 4096 Jun 2 15:36 event -r--r--r--. 1 root root 4096 Jun 2 15:36 frontend -r--r--r--. 1 root root 4096 Jun 2 15:36 inv -r--r--r--. 1 root root 4096 Jun 2 15:36 ldlat -r--r--r--. 1 root root 4096 Jun 2 15:36 offcore_rsp -r--r--r--. 1 root root 4096 Jun 2 15:36 pc -r--r--r--. 1 root root 4096 Jun 2 15:36 umask $ Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Alyssa Ross Cc: German Gomez Cc: Ingo Molnar Cc: Jin Yao Cc: Jiri Olsa Cc: Joshua Martinez Cc: Kan Liang Cc: Like Xu Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20220603045744.2815559-1-irogers@google.com Reported-by: Kevin Nomura Signed-off-by: Arnaldo Carvalho de Melo commit e69a5c010246ca6a87c4e6f13d0a291954bdece8 Author: Zhengjun Xing Date: Wed Jun 1 23:25:44 2022 +0800 perf evlist: Extend arch_evsel__must_be_in_group to support hybrid systems For the hybrid system, the "slots" event changes to "cpu_core/slots/", need extend API arch_evsel__must_be_in_group() to support hybrid systems. In the origin code, for hybrid system event "cpu_core/slots/", the output of the API arch_evsel__must_be_in_group() is "false" (in fact,it should be "true"). Currently only one API evsel__remove_from_group() calls it. In evsel__remove_from_group(), it adds the second condition to check, so the output of evsel__remove_from_group() still is correct. That's the reason why there isn't an instant error. I'd like to fix the issue found in API arch_evsel__must_be_in_group() in case someone else using the function in the other place. Fixes: d98079c05b5a ("perf evlist: Keep topdown counters in weak group") Signed-off-by: Zhengjun Xing Reviewed-by: Kan Liang Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20220601152544.1842447-1-zhengjun.xing@linux.intel.com Cc: peterz@infradead.org Cc: adrian.hunter@intel.com Cc: alexander.shishkin@intel.com Cc: acme@kernel.org Cc: ak@linux.intel.com Cc: jolsa@redhat.com Cc: mingo@redhat.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org commit 9be4cbd09da820a20d400670a45fc1571f6a13b8 Author: Saravana Kannan Date: Fri Jun 3 13:31:38 2022 +0200 driver core: Set default deferred_probe_timeout back to 0. Since we had to effectively reverted commit 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") in an earlier patch, a non-zero deferred_probe_timeout will break NFS rootfs mounting [1] again. So, set the default back to zero until we can fix that. [1] - https://lore.kernel.org/lkml/TYAPR01MB45443DF63B9EF29054F7C41FD8C60@TYAPR01MB4544.jpnprd01.prod.outlook.com/ Fixes: 2b28a1a84a0e ("driver core: Extend deferred probe timeout on driver registration") Cc: Mark Brown Cc: Rob Herring Reported-by: Nathan Chancellor Reported-by: Sebastian Andrzej Siewior Tested-by: Geert Uytterhoeven Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220526034609.480766-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 5ee76c256e928455212ab759c51d198fedbe7523 Author: Saravana Kannan Date: Fri Jun 3 13:31:37 2022 +0200 driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Mounting NFS rootfs was timing out when deferred_probe_timeout was non-zero [1]. This was because ip_auto_config() initcall times out waiting for the network interfaces to show up when deferred_probe_timeout was non-zero. While ip_auto_config() calls wait_for_device_probe() to make sure any currently running deferred probe work or asynchronous probe finishes, that wasn't sufficient to account for devices being deferred until deferred_probe_timeout. Commit 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") tried to fix that by making sure wait_for_device_probe() waits for deferred_probe_timeout to expire before returning. However, if wait_for_device_probe() is called from the kernel_init() context: - Before deferred_probe_initcall() [2], it causes the boot process to hang due to a deadlock. - After deferred_probe_initcall() [3], it blocks kernel_init() from continuing till deferred_probe_timeout expires and beats the point of deferred_probe_timeout that's trying to wait for userspace to load modules. Neither of this is good. So revert the changes to wait_for_device_probe(). [1] - https://lore.kernel.org/lkml/TYAPR01MB45443DF63B9EF29054F7C41FD8C60@TYAPR01MB4544.jpnprd01.prod.outlook.com/ [2] - https://lore.kernel.org/lkml/YowHNo4sBjr9ijZr@dev-arch.thelio-3990X/ [3] - https://lore.kernel.org/lkml/Yo3WvGnNk3LvLb7R@linutronix.de/ Fixes: 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") Cc: John Stultz Cc: "David S. Miller" Cc: Alexey Kuznetsov Cc: Hideaki YOSHIFUJI Cc: Jakub Kicinski Cc: Rob Herring Cc: Geert Uytterhoeven Cc: Yoshihiro Shimoda Cc: Robin Murphy Cc: Andy Shevchenko Cc: Sudeep Holla Cc: Andy Shevchenko Cc: Naresh Kamboju Cc: Basil Eljuse Cc: Ferry Toth Cc: Arnd Bergmann Cc: Anders Roxell Cc: linux-pm@vger.kernel.org Reported-by: Nathan Chancellor Reported-by: Sebastian Andrzej Siewior Tested-by: Geert Uytterhoeven Acked-by: John Stultz Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220526034609.480766-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman Reviewed-by: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit 7036440eab3e2d47a775d4616909f8235488d714 Author: Arnd Bergmann Date: Mon May 30 14:46:17 2022 +0200 ARM: omap1: enable multiplatform With all the header files out of the way, and the clock driver converted to the common framework, nothing stops us from building OMAP together with the other platforms. As usual, the decompressor support is a victim here, and is only available when CONFIG_DEBUG_LL is configured for the particular board. Acked-by: Tony Lindgren Signed-off-by: Arnd Bergmann commit c73b9099da4fb5703abaa804a0377850eea66cb5 Author: Janusz Krzysztofik Date: Sun Apr 10 15:07:57 2022 +0200 ARM: OMAP1: clock: Convert to CCF OMAP1 still uses its own implementation of standard clock API defined in include/linux/clk.h. Internals of that implementation are not visible outside OMAP1 directory. As a consequence, device drivers are not able to register clocks potentially provided by peripheral devices. Drop OMAP1 implementation of the clock API and enable common clock framework. Modify the remaining low level code to be compatible with clock provider API and register the clocks with CCF. Move initialisation of clocks to omap1_timer_init() to avoid memory allocation issues at early setup phase from where omap1_init_early() is called. Register the clocks after initialization of clock I/O registers, local clock pointers used by OMAP1 clock ops, and local .rate fields of clocks with no local implementation of .recalc ops, so CCF structures are populated with correct data during clock registration. Instead of enabling some of the registered clocks, flag them for CCF as critical. Introduce .is_enabled op using code that verifies hardware status of clock enablement, split out from implementation of .disable_unused op, so the latter is actually called by CCF for not requested but hardware enabled clocks. Add .round_rate ops where missing so .set_rate ops are called by CCF as expected. Since CCF allows parallel execution of .enable/.disable and .set_rate ops, protect registers shared among those groups of ops from concurrent access with spinlocks. Drop local debugfs support in favor of that provided by CCF. v2: flag tc2_ck as CLK_IS_CRITICAL (Aaro) v3: rebase on top of soc/omap1-multiplatform-5.18, - drop no longer needed includes from arch/arm/mach-omap1/io.c Signed-off-by: Janusz Krzysztofik Acked-by: Tony Lindgren Signed-off-by: Arnd Bergmann commit 500a434fc593f1fdb274c0e6fe09a0b9c0711a4b Merge: 6f9b5ed8caddf b232b02bf3c20 Author: Linus Torvalds Date: Fri Jun 3 11:48:47 2022 -0700 Merge tag 'driver-core-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the set of driver core changes for 5.19-rc1. Lots of tiny driver core changes and cleanups happened this cycle, but the two major things are: - firmware_loader reorganization and additions including the ability to have XZ compressed firmware images and the ability for userspace to initiate the firmware load when it needs to, instead of being always initiated by the kernel. FPGA devices specifically want this ability to have their firmware changed over the lifetime of the system boot, and this allows them to work without having to come up with yet-another-custom-uapi interface for loading firmware for them. - physical location support added to sysfs so that devices that know this information, can tell userspace where they are located in a common way. Some ACPI devices already support this today, and more bus types should support this in the future. Smaller changes include: - driver_override api cleanups and fixes - error path cleanups and fixes - get_abi script fixes - deferred probe timeout changes. It's that last change that I'm the most worried about. It has been reported to cause boot problems for a number of systems, and I have a tested patch series that resolves this issue. But I didn't get it merged into my tree before 5.18-final came out, so it has not gotten any linux-next testing. I'll send the fixup patches (there are 2) as a follow-on series to this pull request. All have been tested in linux-next for weeks, with no reported issues other than the above-mentioned boot time-outs" * tag 'driver-core-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (55 commits) driver core: fix deadlock in __device_attach kernfs: Separate kernfs_pr_cont_buf and rename_lock. topology: Remove unused cpu_cluster_mask() driver core: Extend deferred probe timeout on driver registration MAINTAINERS: add Russ Weight as a firmware loader maintainer driver: base: fix UAF when driver_attach failed test_firmware: fix end of loop test in upload_read_show() driver core: location: Add "back" as a possible output for panel driver core: location: Free struct acpi_pld_info *pld driver core: Add "*" wildcard support to driver_async_probe cmdline param driver core: location: Check for allocations failure arch_topology: Trace the update thermal pressure kernfs: Rename kernfs_put_open_node to kernfs_unlink_open_file. export: fix string handling of namespace in EXPORT_SYMBOL_NS rpmsg: use local 'dev' variable rpmsg: Fix calling device_lock() on non-initialized device firmware_loader: describe 'module' parameter of firmware_upload_register() firmware_loader: Move definitions from sysfs_upload.h to sysfs.h firmware_loader: Fix configs for sysfs split selftests: firmware: Add firmware upload selftests ... commit 6f9b5ed8caddfbc94af8307c557ed57a8ec5c65c Merge: 54c2cc79194c9 90de6805267f8 Author: Linus Torvalds Date: Fri Jun 3 11:36:34 2022 -0700 Merge tag 'char-misc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / other smaller driver subsystem updates from Greg KH: "Here is the large set of char, misc, and other driver subsystem updates for 5.19-rc1. The merge request for this has been delayed as I wanted to get lots of linux-next testing due to some late arrivals of changes for the habannalabs driver. Highlights of this merge are: - habanalabs driver updates for new hardware types and fixes and other updates - IIO driver tree merge which includes loads of new IIO drivers and cleanups and additions - PHY driver tree merge with new drivers and small updates to existing ones - interconnect driver tree merge with fixes and updates - soundwire driver tree merge with some small fixes - coresight driver tree merge with small fixes and updates - mhi bus driver tree merge with lots of updates and new device support - firmware driver updates - fpga driver updates - lkdtm driver updates (with a merge conflict, more on that below) - extcon driver tree merge with small updates - lots of other tiny driver updates and fixes and cleanups, full details in the shortlog. All of these have been in linux-next for almost 2 weeks with no reported problems" * tag 'char-misc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (387 commits) habanalabs: use separate structure info for each error collect data habanalabs: fix missing handle shift during mmap habanalabs: remove hdev from hl_ctx_get args habanalabs: do MMU prefetch as deferred work habanalabs: order memory manager messages habanalabs: return -EFAULT on copy_to_user error habanalabs: use NULL for eventfd habanalabs: update firmware header habanalabs: add support for notification via eventfd habanalabs: add topic to memory manager buffer habanalabs: handle race in driver fini habanalabs: add device memory scrub ability through debugfs habanalabs: use unified memory manager for CB flow habanalabs: unified memory manager new code for CB flow habanalabs/gaudi: set arbitration timeout to a high value habanalabs: add put by handle method to memory manager habanalabs: hide memory manager page shift habanalabs: Add separate poll interval value for protocol habanalabs: use get_task_pid() to take PID habanalabs: add prefetch flag to the MAP operation ... commit 54c2cc79194c961a213c1d375fe3aa4165664cc4 Merge: 932c2989b5900 97fa5887cf283 Author: Linus Torvalds Date: Fri Jun 3 11:17:49 2022 -0700 Merge tag 'usb-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the "big" set of USB and Thunderbolt driver changes for 5.18-rc1. For the most part it's been a quiet development cycle for the USB core, but there are the usual "hot spots" of development activity. Included in here are: - Thunderbolt driver updates: - fixes for devices without displayport adapters - lane bonding support and improvements - other minor changes based on device testing - dwc3 gadget driver changes. It seems this driver will never be finished given that the IP core is showing up in zillions of new devices and each implementation decides to do something different with it... - uvc gadget driver updates as more devices start to use and rely on this hardware as well - usb_maxpacket() api changes to remove an unneeded and unused parameter. - usb-serial driver device id updates and small cleanups - typec cleanups and fixes based on device testing - device tree updates for usb properties - lots of other small fixes and driver updates. All of these have been in linux-next for weeks with no reported problems" * tag 'usb-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (154 commits) USB: new quirk for Dell Gen 2 devices usb: dwc3: core: Add error log when core soft reset failed usb: dwc3: gadget: Move null pinter check to proper place usb: hub: Simplify error and success path in port_over_current_notify usb: cdns3: allocate TX FIFO size according to composite EP number usb: dwc3: Fix ep0 handling when getting reset while doing control transfer usb: Probe EHCI, OHCI controllers asynchronously usb: isp1760: Fix out-of-bounds array access xhci: Don't defer primary roothub registration if there is only one roothub USB: serial: option: add Quectel BG95 modem USB: serial: pl2303: fix type detection for odd device xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI xhci: Remove quirk for over 10 year old evaluation hardware xhci: prevent U2 link power state if Intel tier policy prevented U1 xhci: use generic command timer for stop endpoint commands. usb: host: xhci-plat: omit shared hcd if either root hub has no ports usb: host: xhci-plat: prepare operation w/o shared hcd usb: host: xhci-plat: create shared hcd after having added main hcd xhci: prepare for operation w/o shared hcd xhci: factor out parts of xhci_gen_setup() ... commit 932c2989b59008e530ffcc7c7e6ef507a28b28ca Merge: 4ad680f083ec3 25e02ba60f0fb Author: Linus Torvalds Date: Fri Jun 3 11:08:40 2022 -0700 Merge tag 'tty-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty and serial driver updates from Greg KH: "Here is the big set of tty and serial driver updates for 5.19-rc1. Lots of tiny cleanups in here, the major stuff is: - termbit cleanups and unification by Ilpo. A much needed change that goes a long way to making things simpler for all of the different arches - tty documentation cleanups and movements to their own place in the documentation tree - old tty driver cleanups and fixes from Jiri to bring some existing drivers into the modern world - RS485 cleanups and unifications to make it easier for individual drivers to support this mode instead of having to duplicate logic in each driver - Lots of 8250 driver updates and additions - new device id additions - n_gsm continued fixes and cleanups - other minor serial driver updates and cleanups All of these have been in linux-next for weeks with no reported issues" * tag 'tty-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (166 commits) tty: Rework receive flow control char logic pcmcia: synclink_cs: Don't allow CS5-6 serial: stm32-usart: Correct CSIZE, bits, and parity serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: sifive: Sanitize CSIZE and c_iflag serial: sh-sci: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: digicolor-usart: Don't allow CS5-6 serial: uartlite: Fix BRKINT clearing serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE serial: core: Do stop_rx in suspend path for console if console_suspend is disabled tty: serial: qcom-geni-serial: Remove uart frequency table. Instead, find suitable frequency with call to clk_round_rate. dt-bindings: serial: renesas,em-uart: Add RZ/V2M clock to access the registers serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" serial: msm_serial: disable interrupts in __msm_console_write() serial: meson: acquire port->lock in startup() serial: 8250_dw: Use dev_err_probe() serial: 8250_dw: Use devm_add_action_or_reset() ... commit 4ad680f083ec360e0991c453e18a38ed9ae500d7 Merge: 04d93b2b8bc7a 6a31a95135da0 Author: Linus Torvalds Date: Fri Jun 3 10:44:43 2022 -0700 Merge tag 'staging-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver updates for 5.19-rc1. Lots of forward progress happened this development cycle, one driver (wfx wireless driver) got merged into the real portion of the kernel, and another one (unisys) was removed as no one is around anymore to take care of it and no one has the hardware. Combined with loads of tiny driver cleanups overall we removed 13k lines of code from the tree, a nice improvement. Other than the wfx and unisys driver changes the major points of this merge is: - r8188eu driver cleanups. So many cleanups. It's amazing just how many things have been cleaned up here, and yet, how many remain to go. Lots of work happened here, and it doesn't look to slow down any time soon. - other wifi driver cleanups. Not as many as the r8188eu driver, but still pretty impressive from a janitorial point of view. - bcm2853 driver cleanups - other very minor driver cleanups All of these have been in the linux-next tree for weeks with no reported issues" * tag 'staging-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (363 commits) staging: r8188eu: remove include/rtw_debug.h staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() staging: r8188eu: delete rtw_wx_read/write32() staging: r8188eu: Remove multiple assignments staging: r8188eu: add check for kzalloc staging: r8188eu: fix warnings in rtw_wlan_util staging: r8188eu: fix warnings in rtw_pwrctrl staging: r8188eu: fix warnings in rtw_p2p staging: rtl8712: fix uninit-value in r871xu_drv_init() staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: add error handler in r8712_usbctrl_vendorreq() staging: r8188eu: remove _drv_ defines from include/rtw_debug.h staging: vc04_services: remove unused macro staging: rtl8192u: remove null check after call container_of() staging: rtl8192e: remove null check after call container_of() staging: ks7010: remove null check after call container_of() staging: r8188eu: remove HW_VAR_AC_PARAM_BE from SetHwReg8188EU() staging: r8188eu: assoc_rsp and assoc_rsp_len are not used staging: r8188eu: last_rx_mgnt_pkts is set but not used staging: r8188eu: simplify error handling in recv_func_prehandle ... commit 04d93b2b8bc7a68ec45a6a156f34a611ede5aa60 Merge: 78c6499c92090 53c83d6d8e399 Author: Linus Torvalds Date: Fri Jun 3 10:34:34 2022 -0700 Merge tag 'spdx-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX updates from Greg KH: "Here are some SPDX license marker changes. The SPDX-labeling effort has started to pick up again, so here are some changes for various parts of the tree that are related to this effort. Included in here are: - freevxfs license updates - spihash.c license cleanups - spdxcheck script updates to make things easier to work with going forward All of the license updates came from the original authors/copyright holders of the code involved. All of these have been in linux-next for weeks with no reported issues" * tag 'spdx-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: siphash: add SPDX tags as sole licensing authority scripts/spdxcheck: Exclude top-level README scripts/spdxcheck: Exclude MAINTAINERS/CREDITS scripts/spdxcheck: Exclude config directories scripts/spdxcheck: Put excluded files and directories into a separate file scripts/spdxcheck: Add option to display files without SPDX scripts/spdxcheck: Add [sub]directory statistics scripts/spdxcheck: Add directory statistics scripts/spdxcheck: Add percentage to statistics freevxfs: relicense to GPLv2 only commit 78c6499c92090d0fd1ddd1684fc3a5dc41d98c92 Merge: 72fbbc3d0e3e3 aacae8c469f9c Author: Linus Torvalds Date: Fri Jun 3 10:25:56 2022 -0700 Merge tag 'for-5.19/drivers-2022-06-02' of git://git.kernel.dk/linux-block Pull more block driver updates from Jens Axboe: "A collection of stragglers that were late on sending in their changes and just followup fixes. - NVMe fixes pull request via Christoph: - set controller enable bit in a separate write (Niklas Cassel) - disable namespace identifiers for the MAXIO MAP1001 (Christoph) - fix a comment typo (Julia Lawall)" - MD fixes pull request via Song: - Remove uses of bdevname (Christoph Hellwig) - Bug fixes (Guoqing Jiang, and Xiao Ni) - bcache fixes series (Coly) - null_blk zoned write fix (Damien) - nbd fixes (Yu, Zhang) - Fix for loop partition scanning (Christoph)" * tag 'for-5.19/drivers-2022-06-02' of git://git.kernel.dk/linux-block: (23 commits) block: null_blk: Fix null_zone_write() nvmet: fix typo in comment nvme: set controller enable bit in a separate write nvme-pci: disable namespace identifiers for the MAXIO MAP1001 bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() nbd: use pr_err to output error message nbd: fix possible overflow on 'first_minor' in nbd_dev_add() nbd: fix io hung while disconnecting device nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed nbd: fix race between nbd_alloc_config() and module removal nbd: call genl_unregister_family() first in nbd_cleanup() md: bcache: check the return value of kzalloc() in detached_dev_do_request() bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() block, loop: support partitions without scanning bcache: avoid journal no-space deadlock by reserving 1 journal bucket bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: improve multithreaded bch_sectors_dirty_init() bcache: improve multithreaded bch_btree_check() md: fix double free of io_acct_set bioset md: Don't set mddev private to NULL in raid0 pers->free ... commit 72fbbc3d0e3e3117c29a73d0b4d928dc00ed99ce Merge: 34845d92bca52 e2e530867245d Author: Linus Torvalds Date: Fri Jun 3 10:21:43 2022 -0700 Merge tag 'for-5.19/block-exec-2022-06-02' of git://git.kernel.dk/linux-block Pull block request execute cleanups from Jens Axboe: "This change was advertised in the initial core block pull request, but didn't actually make that branch as we deferred it to a post-merge pull request to avoid a bunch of cross branch issues. This series cleans up the block execute path quite nicely" * tag 'for-5.19/block-exec-2022-06-02' of git://git.kernel.dk/linux-block: blk-mq: remove the done argument to blk_execute_rq_nowait blk-mq: avoid a mess of casts for blk_end_sync_rq blk-mq: remove __blk_execute_rq_nowait commit 34845d92bca527b5c2cf8b2293b71b9c746c79ca Merge: 5ac8bdb9ad473 41e46b3c2aa24 Author: Linus Torvalds Date: Fri Jun 3 10:14:48 2022 -0700 Merge tag 'for-5.19/block-2022-06-02' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Just a collection of fixes that have been queued up since the initial merge window pull request, the majority of which are targeted for stable as well. One bio_set fix that fixes an issue with the dm adoption of cached bio structs that got introduced in this merge window" * tag 'for-5.19/block-2022-06-02' of git://git.kernel.dk/linux-block: block: Fix potential deadlock in blk_ia_range_sysfs_show() block: fix bio_clone_blkg_association() to associate with proper blkcg_gq block: remove useless BUG_ON() in blk_mq_put_tag() blk-mq: do not update io_ticks with passthrough requests block: make bioset_exit() fully resilient against being called twice block: use bio_queue_enter instead of blk_queue_enter in bio_poll block: document BLK_STS_AGAIN usage block: take destination bvec offsets into account in bio_copy_data_iter blk-iolatency: Fix inflight count imbalances and IO hangs on offline blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx commit 5ac8bdb9ad47334a9590e29daf7e4149b0a34729 Merge: 6e5f6a86915d6 9cae36a094e7e Author: Linus Torvalds Date: Fri Jun 3 10:10:38 2022 -0700 Merge tag 'io_uring-5.19-2022-06-02' of git://git.kernel.dk/linux-block Pull more io_uring updates from Jens Axboe: - A small series with some prep patches for the upcoming 5.20 split of the io_uring.c file. No functional changes here, just minor bits that are nice to get out of the way now (me) - Fix for a memory leak in high numbered provided buffer groups, introduced in the merge window (me) - Wire up the new socket opcode for allocated direct descriptors, making it consistent with the other opcodes that can instantiate a descriptor (me) - Fix for the inflight tracking, should go into 5.18-stable as well (me) - Fix for a deadlock for io-wq offloaded file slot allocations (Pavel) - Direct descriptor failure fput leak fix (Xiaoguang) - Fix for the direct descriptor allocation hinting in case of unsuccessful install (Xiaoguang) * tag 'io_uring-5.19-2022-06-02' of git://git.kernel.dk/linux-block: io_uring: reinstate the inflight tracking io_uring: fix deadlock on iowq file slot alloc io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots io_uring: defer alloc_hint update to io_file_bitmap_set() io_uring: ensure fput() called correspondingly when direct install fails io_uring: wire up allocated direct descriptors for socket io_uring: fix a memory leak of buffer group list on exit io_uring: move shutdown under the general net section io_uring: unify calling convention for async prep handling io_uring: add io_op_defs 'def' pointer in req init and issue io_uring: make prep and issue side of req handlers named consistently io_uring: make timeout prep handlers consistent with other prep handlers commit 6e5f6a86915d65210e90acac0402e6f37e21fc7b Merge: 6f6ebb9899861 bd8bb9aed56b1 Author: Linus Torvalds Date: Fri Jun 3 10:02:52 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "vhost,virtio and vdpa features, fixes, and cleanups: - mac vlan filter and stats support in mlx5 vdpa - irq hardening in virtio - performance improvements in virtio crypto - polling i/o support in virtio blk - ASID support in vhost - fixes, cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (64 commits) vdpa: ifcvf: set pci driver data in probe vdpa/mlx5: Add RX MAC VLAN filter support vdpa/mlx5: Remove flow counter from steering vhost: rename vhost_work_dev_flush vhost-test: drop flush after vhost_dev_cleanup vhost-scsi: drop flush after vhost_dev_cleanup vhost_vsock: simplify vhost_vsock_flush() vhost_test: remove vhost_test_flush_vq() vhost_net: get rid of vhost_net_flush_vq() and extra flush calls vhost: flush dev once during vhost_dev_stop vhost: get rid of vhost_poll_flush() wrapper vhost-vdpa: return -EFAULT on copy_to_user() failure vdpasim: Off by one in vdpasim_set_group_asid() virtio: Directly use ida_alloc()/free() virtio: use WARN_ON() to warning illegal status value virtio: harden vring IRQ virtio: allow to unbreak virtqueue virtio-ccw: implement synchronize_cbs() virtio-mmio: implement synchronize_cbs() virtio-pci: implement synchronize_cbs() ... commit 6f6ebb9899861c8a4e49cc7d9796d024f731b512 Merge: ab18b7b36a82b 672362cbe6df0 Author: Linus Torvalds Date: Fri Jun 3 09:56:53 2022 -0700 Merge tag 'sound-fix-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes for 5.19 merge window. Nothing particular stands out, as most changes are device-specific fixes and quirks" * tag 'sound-fix-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: selftests: alsa: Handle pkg-config failure more gracefully ALSA: usb-audio: Optimize TEAC clock quirk ASoC: da7219: cancel AAD related work earlier for jack removal ASoC: da7219: Fix pole orientation detection on certain headsets ASoC: Intel: avs: Fix build error on arc, m68k and sparc ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS ALSA: hda/via: Delete does not require return ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop ASoC: Intel: common: fix typo for tplg naming ALSA: usb-audio: Cancel pending work at closing a MIDI substream ALSA: usb-audio: Add mixer mapping for Gigabyte B450/550 Mobos ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM ASoC: SOF: amd: Fixed Build error ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition ASoC: soc-pcm: fix BE transition for TRIGGER_START commit 987cf300e76d30b1bdad88d2a662b948ead6fb21 Author: Rob Herring Date: Wed May 25 15:59:08 2022 -0500 dt-bindings: mtd: spi-nand: Add spi-peripheral-props.yaml reference SPI peripheral device bindings need to reference spi-peripheral-props.yaml in order to use various SPI controller specific properties. Otherwise, the unevaluatedProperties check will reject any controller specific properties. Signed-off-by: Rob Herring Reviewed-by: Pratyush Yadav Link: https://lore.kernel.org/r/20220525205909.2486153-1-robh@kernel.org commit ab18b7b36a82b1900687c5718f7d46f0d8e77d86 Merge: 50fd82b3a9a93 404204340c0dc Author: Linus Torvalds Date: Fri Jun 3 09:49:29 2022 -0700 Merge tag 'drm-next-2022-06-03-1' of git://anongit.freedesktop.org/drm/drm Pull more drm updates from Dave Airlie: "This is mostly regular fixes, msm and amdgpu. There is a tegra patch that is bit of prep work for a 5.20 feature to avoid some inter-tree syncs, and a couple of late addition amdgpu uAPI changes but best to get those in early, and the userspace pieces are ready. msm: - Limiting WB modes to max sspp linewidth - Fixing the supported rotations to add 180 back for IGT - Fix to handle pm_runtime_get_sync() errors to avoid unclocked access in the bind() path for dpu driver - Fix the irq_free() without request issue which was a big-time hitter in the CI-runs. amdgpu: - Update fdinfo to the common drm format - uapi: - Add VM_NOALLOC GPUVM attribute to prevent buffers for going into the MALL - Add AMDGPU_GEM_CREATE_DISCARDABLE flag to create buffers that can be discarded on eviction - Mesa code which uses these: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16466 - Link training fixes - DPIA fixes - Misc code cleanups - Aux fixes - Hotplug fixes - More FP clean up - Misc GFX9/10 fixes - Fix a possible memory leak in SMU shutdown - SMU 13 updates - RAS fixes - TMZ fixes - GC 11 updates - SMU 11 metrics fixes - Fix coverage blend mode for overlay plane - Note DDR vs LPDDR memory - Fuzz fix for CS IOCTL - Add new PCI DID amdkfd: - Clean up hive setup - Misc fixes tegra: - add some prelim 5.20 work to avoid inter-tree mess" * tag 'drm-next-2022-06-03-1' of git://anongit.freedesktop.org/drm/drm: (57 commits) drm/msm/dpu: Move min BW request and full BW disable back to mdss drm/msm/dpu: Fix pointer dereferenced before checking drm/msm/dpu: Remove unused code drm/msm/disp/dpu1: remove superfluous init drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl() gpu: host1x: Add context bus drm/amdgpu: add drm-client-id to fdinfo v2 drm/amdgpu: Convert to common fdinfo format v5 drm/amdgpu: bump minor version number drm/amdgpu: add AMDGPU_VM_NOALLOC v2 drm/amdgpu: add AMDGPU_GEM_CREATE_DISCARDABLE drm/amdgpu: add beige goby PCI ID drm/amd/pm: Return auto perf level, if unsupported drm/amdkfd: fix typo in comment drm/amdgpu/gfx: fix typos in comments drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/amdgpu: differentiate between LP and non-LP DDR memory drm/amdgpu: Resolve pcie_bif RAS recovery bug drm/amdgpu: clean up asd on the ta_firmware_header_v2_0 drm/amdgpu/discovery: validate VCN and SDMA instances ... commit e1dff7f133caffdba28531cddf272d0737c990bf Author: Rob Herring Date: Wed May 25 16:01:40 2022 -0500 dt-bindings: memory-controllers: ingenic: Split out child node properties Binding schemas which define child node properties such as memory controllers with timing properties need a separate schema which can be referenced from child device schemas. This is necessary for unevaluatedProperties checks to work properly. Move the ingenic,nemc child properties to its own file and reference from ingenic,nand.yaml which describes a child NAND controller. Signed-off-by: Rob Herring Acked-by: Paul Cercueil Link: https://lore.kernel.org/r/20220525210140.2489866-1-robh@kernel.org commit bbba69ef4795c43fd28238be013588b7f7138bab Author: Rob Herring Date: Tue May 31 17:01:18 2022 -0500 dt-bindings: net/dsa: Add spi-peripheral-props.yaml references SPI peripheral device bindings need to reference spi-peripheral-props.yaml in order to use various SPI controller specific properties. Otherwise, the unevaluatedProperties check will reject any controller specific properties. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220531220122.2412711-1-robh@kernel.org commit 0dfe54071d7c828a02917b595456bfde1afdddc9 Author: Kees Cook Date: Wed May 18 13:52:23 2022 -0700 nodemask: Fix return values to be unsigned The nodemask routines had mixed return values that provided potentially signed return values that could never happen. This was leading to the compiler getting confusing about the range of possible return values (it was thinking things could be negative where they could not be). Fix all the nodemask routines that should be returning unsigned (or bool) values. Silences: mm/swapfile.c: In function ‘setup_swap_info’: mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds] 2291 | p->avail_lists[i].prio = 1; | ~~~~~~~~~~~~~~^~~ In file included from mm/swapfile.c:16: ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’ 292 | struct plist_node avail_lists[]; /* | ^~~~~~~~~~~ Reported-by: Christophe de Dinechin Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/ Cc: Alexey Dobriyan Cc: Yury Norov Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Andrew Morton Cc: Zhen Lei Signed-off-by: Kees Cook Signed-off-by: Yury Norov commit 005f17007f47495dbbb659aa5db7e581065d16e7 Author: Kees Cook Date: Wed May 18 13:52:22 2022 -0700 bitmap: Fix return values to be unsigned Both nodemask and bitmap routines had mixed return values that provided potentially signed return values that could never happen. This was leading to the compiler getting confusing about the range of possible return values (it was thinking things could be negative where they could not be). In preparation for fixing nodemask, fix all the bitmap routines that should be returning unsigned (or bool) values. Cc: Yury Norov Cc: Rasmus Villemoes Cc: Christophe de Dinechin Cc: Alexey Dobriyan Cc: Andy Shevchenko Cc: Andrew Morton Cc: Zhen Lei Signed-off-by: Kees Cook Signed-off-by: Yury Norov commit d603fd8dd35f6028bb09cd2e9ec6557c4bc0dd95 Author: Yury Norov Date: Mon May 9 18:54:23 2022 -0700 KVM: x86: hyper-v: replace bitmap_weight() with hweight64() kvm_hv_flush_tlb() applies bitmap API to a u64 variable valid_bank_mask. Since valid_bank_mask has a fixed size, we can use hweight64() and avoid excessive bloating. CC: Borislav Petkov CC: Dave Hansen CC: H. Peter Anvin CC: Ingo Molnar CC: Jim Mattson CC: Joerg Roedel CC: Paolo Bonzini CC: Sean Christopherson CC: Thomas Gleixner CC: Vitaly Kuznetsov CC: Wanpeng Li CC: kvm@vger.kernel.org CC: linux-kernel@vger.kernel.org CC: x86@kernel.org Acked-by: Vitaly Kuznetsov Signed-off-by: Yury Norov commit a7ef9b455c7ca8f07a5b4bd967a3c39c7434d43f Author: Yury Norov Date: Thu May 19 10:15:04 2022 -0700 KVM: x86: hyper-v: fix type of valid_bank_mask In kvm_hv_flush_tlb(), valid_bank_mask is declared as unsigned long, but is used as u64, which is wrong for i386, and has been spotted by LKP after applying "KVM: x86: hyper-v: replace bitmap_weight() with hweight64()" https://lore.kernel.org/lkml/20220510154750.212913-12-yury.norov@gmail.com/ But it's wrong even without that patch because now bitmap_weight() dereferences a word after valid_bank_mask on i386. >> include/asm-generic/bitops/const_hweight.h:21:76: warning: right shift count >= width of type +[-Wshift-count-overflow] 21 | #define __const_hweight64(w) (__const_hweight32(w) + __const_hweight32((w) >> 32)) | ^~ include/asm-generic/bitops/const_hweight.h:10:16: note: in definition of macro '__const_hweight8' 10 | ((!!((w) & (1ULL << 0))) + \ | ^ include/asm-generic/bitops/const_hweight.h:20:31: note: in expansion of macro '__const_hweight16' 20 | #define __const_hweight32(w) (__const_hweight16(w) + __const_hweight16((w) >> 16)) | ^~~~~~~~~~~~~~~~~ include/asm-generic/bitops/const_hweight.h:21:54: note: in expansion of macro '__const_hweight32' 21 | #define __const_hweight64(w) (__const_hweight32(w) + __const_hweight32((w) >> 32)) | ^~~~~~~~~~~~~~~~~ include/asm-generic/bitops/const_hweight.h:29:49: note: in expansion of macro '__const_hweight64' 29 | #define hweight64(w) (__builtin_constant_p(w) ? __const_hweight64(w) : __arch_hweight64(w)) | ^~~~~~~~~~~~~~~~~ arch/x86/kvm/hyperv.c:1983:36: note: in expansion of macro 'hweight64' 1983 | if (hc->var_cnt != hweight64(valid_bank_mask)) | ^~~~~~~~~ CC: Borislav Petkov CC: Dave Hansen CC: H. Peter Anvin CC: Ingo Molnar CC: Jim Mattson CC: Joerg Roedel CC: Paolo Bonzini CC: Sean Christopherson CC: Thomas Gleixner CC: Vitaly Kuznetsov CC: Wanpeng Li CC: kvm@vger.kernel.org CC: linux-kernel@vger.kernel.org CC: x86@kernel.org Reported-by: kernel test robot Signed-off-by: Yury Norov Message-Id: <20220519171504.1238724-1-yury.norov@gmail.com> Signed-off-by: Paolo Bonzini commit a570e68fabec2f209d94abaabca8aab419437dab Author: Yury Norov Date: Fri May 6 21:08:10 2022 -0700 ia64: cleanup remove_siblinginfo() remove_siblinginfo() initialises variable 'last', but never uses it. Drop unneeded code. CC: Ingo Molnar CC: Peter Zijlstra CC: Valentin Schneider CC: linux-ia64@vger.kernel.org CC: linux-kernel@vger.kernel.org Signed-off-by: Yury Norov Acked-by: Andrew Morton commit 525d6515604eb1373ce5e6372a6b6640953b2d6a Author: Yury Norov Date: Thu Apr 28 13:51:16 2022 -0700 drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate The smu_v1X_0_set_allowed_mask() uses bitmap_copy() to convert bitmap to 32-bit array. This may be wrong due to endiannes issues. Fix it by switching to bitmap_{from,to}_arr32. CC: Alexander Gordeev CC: Andy Shevchenko CC: Christian Borntraeger CC: Claudio Imbrenda CC: David Hildenbrand CC: Heiko Carstens CC: Janosch Frank CC: Rasmus Villemoes CC: Sven Schnelle CC: Vasily Gorbik Signed-off-by: Yury Norov commit da0f8e957be95fbc50f751887f9250cbb8fba980 Author: Yury Norov Date: Thu Apr 28 13:51:15 2022 -0700 KVM: s390: replace bitmap_copy with bitmap_{from,to}_arr64 where appropriate Copying bitmaps from/to 64-bit arrays with bitmap_copy is not safe on 32-bit BE machines. Use designated functions instead. CC: Alexander Gordeev CC: Andy Shevchenko CC: Christian Borntraeger CC: Claudio Imbrenda CC: David Hildenbrand CC: Heiko Carstens CC: Janosch Frank CC: Rasmus Villemoes CC: Sven Schnelle CC: Vasily Gorbik Signed-off-by: Yury Norov Reviewed-by: David Hildenbrand commit 2c523550b9924f98299414253d8a1fef7c60ef2d Author: Yury Norov Date: Thu Apr 28 13:51:14 2022 -0700 lib/bitmap: add test for bitmap_{from,to}_arr64 Test newly added bitmap_{from,to}_arr64() functions similarly to already existing bitmap_{from,to}_arr32() tests. CC: Alexander Gordeev CC: Andy Shevchenko CC: Christian Borntraeger CC: Claudio Imbrenda CC: David Hildenbrand CC: Heiko Carstens CC: Janosch Frank CC: Rasmus Villemoes CC: Sven Schnelle CC: Vasily Gorbik Signed-off-by: Yury Norov commit 0a97953fd2210d0ac8eb5c76f8bd08fb53b6d3d6 Author: Yury Norov Date: Thu Apr 28 13:51:13 2022 -0700 lib: add bitmap_{from,to}_arr64 Manipulating 64-bit arrays with bitmap functions is potentially dangerous because on 32-bit BE machines the order of halfwords doesn't match. Another issue is that compiler may throw a warning about out-of-boundary access. This patch adds bitmap_{from,to}_arr64 functions in addition to existing bitmap_{from,to}_arr32. CC: Alexander Gordeev CC: Andy Shevchenko CC: Christian Borntraeger CC: Claudio Imbrenda CC: David Hildenbrand CC: Heiko Carstens CC: Janosch Frank CC: Rasmus Villemoes CC: Sven Schnelle CC: Vasily Gorbik Signed-off-by: Yury Norov commit e041e0ac53dd52d2d201aa87edc3adaca1085299 Author: Yury Norov Date: Thu Apr 28 13:51:12 2022 -0700 lib/bitmap: extend comment for bitmap_(from,to)_arr32() On LE systems bitmaps are naturally ordered, therefore we can potentially use bitmap_copy routines when converting from 32-bit arrays, even if host system is 64-bit. But it may lead to out-of-bond access due to unsafe typecast, and the bitmap_(from,to)_arr32 comment doesn't explain that clearly CC: Alexander Gordeev CC: Andy Shevchenko CC: Christian Borntraeger CC: Claudio Imbrenda CC: David Hildenbrand CC: Heiko Carstens CC: Janosch Frank CC: Rasmus Villemoes CC: Sven Schnelle CC: Vasily Gorbik Signed-off-by: Yury Norov commit 6d7131bd52b3e0dd068a0067e5584b3f36cf17eb Author: Anna-Maria Behnsen Date: Mon Apr 11 17:05:55 2022 +0200 include/linux/find: Fix documentation The order of the arguments in function documentation doesn't fit the implementation. Change the documentation so that it corresponds to the code. This prevent people to get confused when reading the documentation. Signed-off-by: Anna-Maria Behnsen Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit 430cd4a28d7321d1e37b030a3793757077cc4f3c Author: Mauro Carvalho Chehab Date: Sat Mar 26 11:41:46 2022 +0100 lib/bitmap.c make bitmap_print_bitmask_to_buf parseable The documentation of such function is not on a proper ReST format, as reported by Sphinx: Documentation/core-api/kernel-api:81: ./lib/bitmap.c:532: WARNING: Unexpected indentation. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:526: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:532: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:532: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:533: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:536: WARNING: Definition list ends without a blank line; unexpected unindent. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:542: WARNING: Unexpected indentation. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:536: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:536: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:543: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:552: WARNING: Unexpected indentation. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:545: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:545: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:552: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:552: WARNING: Inline emphasis start-string without end-string. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:554: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:556: WARNING: Definition list ends without a blank line; unexpected unindent. Documentation/core-api/kernel-api:81: ./lib/bitmap.c:580: WARNING: Unexpected indentation. So, the produced output at: https://www.kernel.org/doc/html/latest/core-api/kernel-api.html?#c.bitmap_print_bitmask_to_buf is broken. Fix it by adding spaces and marking the literal blocks. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit c6bc5a3ce22c894b45f29d1b1fcf2daf287f10da Author: Yury Norov Date: Sun Jan 23 10:39:25 2022 -0800 MAINTAINERS: add cpumask and nodemask files to BITMAP_API cpumask and nodemask APIs are thin wrappers around basic bitmap API, and corresponding files are not formally maintained. This patch adds them to BITMAP_API section, so that bitmap folks would have closer look at it. Signed-off-by: Yury Norov commit dcf23cca930d1a60f7cd6b3a245a5081d77b8081 Author: Yury Norov Date: Sun Jan 23 10:38:57 2022 -0800 arch/x86: replace nodes_weight with nodes_empty where appropriate mm code calls nodes_weight() to check if any bit of a given nodemask is set. We can do it more efficiently with nodes_empty() because nodes_empty() stops traversing the nodemask as soon as it finds first set bit, while nodes_weight() counts all bits unconditionally. Signed-off-by: Yury Norov commit b55032f1067a02c7f80943dd118060952e8bd7ac Author: Yury Norov Date: Sun Jan 23 10:38:56 2022 -0800 mm/vmstat: replace cpumask_weight with cpumask_empty where appropriate mm/vmstat.c code calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov Acked-by: Mike Rapoport commit 95e3a97387d6c396172f944b45bd515c7d1e8bc2 Author: Yury Norov Date: Sun Jan 23 10:38:55 2022 -0800 clocksource: replace cpumask_weight with cpumask_empty in clocksource.c clocksource_verify_percpu() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov commit 99248e351a2712154d1120ab003d89635c4e8e72 Author: Yury Norov Date: Sun Jan 23 10:38:51 2022 -0800 genirq/affinity: replace cpumask_weight with cpumask_empty where appropriate __irq_build_affinity_masks() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov commit d72002ae67adb1c665e43970685b16645023d639 Author: Yury Norov Date: Sun Jan 23 10:38:50 2022 -0800 irq: mips: replace cpumask_weight with cpumask_empty where appropriate bcm6345_l1_of_init() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov Acked-by: Florian Fainelli commit a37e94fe7c428ff4663f22966e142e7610ed049d Author: Yury Norov Date: Sun Jan 23 10:38:48 2022 -0800 drm/i915/pmu: replace cpumask_weight with cpumask_empty where appropriate i915_pmu_cpu_online() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov Reviewed-by: Tvrtko Ursulin commit 4aec74bccf5d047347bdfef3638e3031dd75c0a0 Author: Yury Norov Date: Sun Jan 23 10:38:46 2022 -0800 arch/x86: replace cpumask_weight with cpumask_empty where appropriate In some cases, arch/x86 code calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov Reviewed-by: Steve Wahl commit b6dad11d9cb105681abbfc3d57aae4b21bd0c8c4 Author: Yury Norov Date: Sun Jan 23 10:38:45 2022 -0800 arch/ia64: replace cpumask_weight with cpumask_empty where appropriate setup_arch() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov commit 71c1a517e3da992fbbafb5c0b82a87c7eafc3383 Author: Yury Norov Date: Sun Jan 23 10:38:44 2022 -0800 arch/alpha: replace cpumask_weight with cpumask_empty where appropriate common_shutdown_1() calls cpumask_weight() to check if any bit of a given cpumask is set. We can do it more efficiently with cpumask_empty() because cpumask_empty() stops traversing the cpumask as soon as it finds first set bit, while cpumask_weight() counts all bits unconditionally. Signed-off-by: Yury Norov commit 8f51558e8015c1994aee2d8747a60cdcb47aeecd Author: Yury Norov Date: Sun May 8 07:49:50 2022 -0700 risc-v: replace bitmap_weight with bitmap_empty in riscv_fill_hwcap() bitmap_empty() is better than bitmap_weight() because it may return earlier, and improves on readability. CC: Albert Ou CC: Anup Patel CC: Atish Patra CC: Jisheng Zhang CC: Palmer Dabbelt CC: Paul Walmsley CC: Tsukasa OI CC: linux-riscv@lists.infradead.org CC: linux-kernel@vger.kernel.org Signed-off-by: Yury Norov Reviewed-by: Anup Patel commit 8be4493119b0aedf7dd61e1ca520fb398537b53e Author: Huacai Chen Date: Tue May 31 18:04:12 2022 +0800 MAINTAINERS: Add maintainer information for LoongArch Add the maintainer information for the LoongArch (LA or LArch for short) architecture. Reviewed-by: Guo Ren Reviewed-by: Jiaxun Yang Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 9e8536e261165db0795bebaaa0aa92b8ba35f3e3 Author: Huacai Chen Date: Tue May 31 18:04:12 2022 +0800 LoongArch: Add Loongson-3 default config file Add a default config file for LoongArch-based Loongson-3 platform. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit d4b6f1562a3c3284adcef81d6e4f183d7d34b8a9 Author: Huacai Chen Date: Tue May 31 18:04:12 2022 +0800 LoongArch: Add Non-Uniform Memory Access (NUMA) support Add Non-Uniform Memory Access (NUMA) support for LoongArch. LoongArch has 48-bit physical address, but the HyperTransport I/O bus only support 40-bit address, so we need a custom phys_to_dma() and dma_to_phys() to extract the 4-bit node id (bit 44~47) from Loongson-3's 48-bit physical address space and embed it into 40-bit. In the 40-bit dma address, node id offset can be read from the LS7A_DMA_CFG register. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 46859ac8af52ae599e1b51992ddef3eb43f295fc Author: Huacai Chen Date: Tue May 31 18:04:12 2022 +0800 LoongArch: Add multi-processor (SMP) support LoongArch-based procesors have 4, 8 or 16 cores per package. This patch adds multi-processor (SMP) support for LoongArch. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit c6b99bed6b8f3255bd2f65a8e606352e0e638ad0 Author: Huacai Chen Date: Tue May 31 18:04:12 2022 +0800 LoongArch: Add VDSO and VSYSCALL support Add VDSO and VSYSCALL support (sigreturn, gettimeofday and its friends) for LoongArch. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 559671e04a33b183b6e65fd585ab2e2a0578208b Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add some library functions Add some library functions for LoongArch, including: delay, memset, memcpy, memmove, copy_user, strncpy_user, strnlen_user and tlb dump functions. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 7153c3cbb5b9b99755659b97861fd4fc909ed86f Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add misc common routines Add some misc common routines for LoongArch, including: asm-offsets routines, futex functions, i/o memory access functions, frame-buffer functions, procfs information display, etc. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit fcdfe9d22bed08409968a751e93112f742208be6 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add ELF and module support Add ELF-related definition and module relocation code for basic LoongArch support. Cc: Jessica Yu Reviewed-by: WANG Xuerui Reviewed-by: Luis Chamberlain Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit b74baf4ad05b5ebe3152592fb2fa80d51681392a Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add signal handling support Add ucontext/sigcontext definition and signal handling support for LoongArch. Cc: Eric Biederman Cc: Al Viro Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit be769645a2aef577f07afdcb4de8fad20b6d57c0 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add system call support Add system call support and related uaccess.h for LoongArch. Q: Why keep _ARCH_WANT_SYS_CLONE definition while there is clone3: A: The latest glibc release has some basic support for clone3 but it is not complete. E.g., pthread_create() and spawni() have converted to use clone3 but fork() will still use clone. Moreover, some seccomp related applications can still not work perfectly with clone3. E.g., Chromium sandbox cannot work at all and there is no solution for it, which is more terrible than the fork() story [1]. [1] https://chromium-review.googlesource.com/c/chromium/src/+/2936184 Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add memory management Add memory management support for LoongArch, including: cache and tlb management, page fault handling and ioremap/mmap support. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 803b0fc5c3f2baa6e54978cd576407896f789b08 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add process management Add process management support for LoongArch, including: thread info definition, context switch and process tracing. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 0603839b18f4fb3bffa82515efcf5b02084505ef Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add exception/interrupt handling Add the exception and interrupt handling machanism for basic LoongArch support. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 628c3bb40e9a8cefc0a6fde28b7b66bfe46d1dc2 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add boot and setup routines Add basic boot, setup and reset routines for LoongArch. Now, LoongArch machines use UEFI-based firmware. The firmware passes configuration information to the kernel via ACPI and DMI/SMBIOS. Currently an existing interface between the kernel and the bootloader is implemented. Kernel gets 2 values from the bootloader, passed in registers a0 and a1; a0 is an "EFI boot flag" distinguishing UEFI and non-UEFI firmware, while a1 is a pointer to an FDT with systable, memmap, cmdline and initrd information. The standard UEFI boot protocol (EFISTUB) will be added later. Cc: linux-efi@vger.kernel.org Cc: Ard Biesheuvel Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Co-developed-by: Yun Liu Signed-off-by: Yun Liu Signed-off-by: Huacai Chen commit b738c106f7355e318ca47a3b981688efe1bc12fb Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add other common headers Add some other common headers for basic LoongArch support. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 5b0b14e550a006b4d093619e7517923872bcc218 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add atomic/locking headers Add common headers (atomic, bitops, barrier and locking) for basic LoongArch support. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit f2ac457a61389b7769aad8295027cbe0f91c5b80 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add CPU definition headers Add common headers (CPU definition and address space layout) for basic LoongArch support. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit fa96b57c149061f71a70bd6582d995f6424fbbf4 Author: Huacai Chen Date: Tue May 31 18:04:11 2022 +0800 LoongArch: Add build infrastructure Add Kbuild, Makefile, Kconfig and link script for LoongArch build infrastructure. Reviewed-by: Guo Ren Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 439057ec3b748b1ff61855d09859f369493e22d8 Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 LoongArch: Add writecombine support for drm LoongArch maintains cache coherency in hardware, but its WUC attribute (Weak-ordered UnCached, which is similar to WC) is out of the scope of cache coherency machanism. This means WUC can only used for write-only memory regions. Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 08145b087e4481458f6075f3af58021a3cf8a940 Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 LoongArch: Add ELF-related definitions Add ELF-related definitions for LoongArch, including: EM_LOONGARCH, KEXEC_ARCH_LOONGARCH, AUDIT_ARCH_LOONGARCH32, AUDIT_ARCH_LOONGARCH64 and NT_LOONGARCH_*. Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit f23b22599f8ec09460077418bca1e331bb715f63 Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 Documentation/zh_CN: Add basic LoongArch documentations Add some basic documentation (zh_CN version) for LoongArch. LoongArch is a new RISC ISA, which is a bit like MIPS or RISC-V. LoongArch includes a reduced 32-bit version (LA32R), a standard 32-bit version (LA32S) and a 64-bit version (LA64). Reviewed-by: Alex Shi Reviewed-by: Yanteng Si Reviewed-by: Guo Ren Reviewed-by: Jiaxun Yang Co-developed-by: WANG Xuerui Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 0ea8ce61cb2c487e818c515f91329fa9972a7155 Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 Documentation: LoongArch: Add basic documentations Add some basic documentation for LoongArch. LoongArch is a new RISC ISA, which is a bit like MIPS or RISC-V. LoongArch includes a reduced 32-bit version (LA32R), a standard 32-bit version (LA32S) and a 64-bit version (LA64). Tested-by: Bagas Sanjaya Reviewed-by: Jiaxun Yang Co-developed-by: WANG Xuerui Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit fa84f89395e0383b94ae2822003d8940fdb24d3c Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 irqchip/loongson-liointc: Fix build error for LoongArch liointc driver is shared by MIPS and LoongArch, this patch adjust the code to fix build error for LoongArch. Acked-by: Marc Zyngier Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 987a3e03c821366b7c62b41b1516138181e51764 Author: Huacai Chen Date: Tue May 31 18:04:10 2022 +0800 irqchip: Adjust Kconfig for Loongson HTVEC will be shared by both MIPS-based and LoongArch-based Loongson processors (not only Loongson-3), so we adjust its description. HTPIC is only used by MIPS-based Loongson, so we add a MIPS dependency. Acked-by: Marc Zyngier Reviewed-by: WANG Xuerui Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 07551992cdab1dcb7a17eeaf46b04913712535e8 Merge: d69a155555c9d fcb3b5a58926d Author: Mark Brown Date: Fri Jun 3 13:25:55 2022 +0200 ASoC: Fixup Cirrus SX control usage Merge series from Charles Keepax : Mostly the usage of the SX controls seems to match the lowest gain value + number of gain levels expected. The one notable exception there being cs53l30 as David noted. However, there are a couple of other places where the minimum value/TLVs are slightly incorrectly specified. commit fcb3b5a58926d16d9a338841b74af06d4c29be15 Author: Charles Keepax Date: Thu Jun 2 17:21:19 2022 +0100 ASoC: cs42l51: Correct minimum value for SX volume control The minimum value for the PGA Volume is given as 0x1A, however the values from there to 0x19 are all the same volume and this is not represented in the TLV structure. The number of volumes given is correct so this leads to all the volumes being shifted. Move the minimum value up to 0x19 to fix this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit a8928ada9b96944cadd8b65d191e33199fd38782 Author: Charles Keepax Date: Thu Jun 2 17:21:18 2022 +0100 ASoC: cs42l56: Correct typo in minimum level for SX volume controls A couple of the SX volume controls specify 0x84 as the lowest volume value, however the correct value from the datasheet is 0x44. The datasheet don't include spaces in the value it displays as binary so this was almost certainly just a typo reading 1000100. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 91e90c712fade0b69cdff7cc6512f6099bd18ae5 Author: Charles Keepax Date: Thu Jun 2 17:21:17 2022 +0100 ASoC: cs42l52: Correct TLV for Bypass Volume The Bypass Volume is accidentally using a -6dB minimum TLV rather than the correct -60dB minimum. Add a new TLV to correct this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7fbd6dd68127927e844912a16741016d432a0737 Author: Charles Keepax Date: Thu Jun 2 17:21:16 2022 +0100 ASoC: cs53l30: Correct number of volume levels on SX controls This driver specified the maximum value rather than the number of volume levels on the SX controls, this is incorrect, so correct them. Reported-by: David Rhodes Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5005a2345825eb8346546d99bfe669f73111b5c5 Author: Charles Keepax Date: Thu Jun 2 17:21:15 2022 +0100 ASoC: cs35l36: Update digital volume TLV The digital volume TLV specifies the step as 0.25dB but the actual step of the control is 0.125dB. Update the TLV to correct this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 8bf5aabf524eec61013e506f764a0b2652dc5665 Author: Charles Keepax Date: Thu Jun 2 17:21:14 2022 +0100 ASoC: cs42l52: Fix TLV scales for mixer controls The datasheet specifies the range of the mixer volumes as between -51.5dB and 12dB with a 0.5dB step. Update the TLVs for this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20220602162119.3393857-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 6ba688364856ad083be537f08e86ba97f433d405 Author: Mikulas Patocka Date: Wed Jun 1 13:18:22 2022 -0400 parisc: fix a crash with multicore scheduler With the kernel 5.18, the system will hang on boot if it is compiled with CONFIG_SCHED_MC. The last printed message is "Brought up 1 node, 1 CPU". The crash happens in sd_init tl->mask (which is cpu_coregroup_mask) returns an empty mask. This happens because cpu_topology[0].core_sibling is empty. Consequently, sd_span is set to an empty mask sd_id = cpumask_first(sd_span) sets sd_id == NR_CPUS (because the mask is empty) sd->shared = *per_cpu_ptr(sdd->sds, sd_id); sets sd->shared to NULL because sd_id is out of range atomic_inc(&sd->shared->ref); crashes without printing anything We can fix it by calling reset_cpu_topology() from init_cpu_topology() - this will initialize the sibling masks on CPUs, so that they're not empty. This patch also removes the variable "dualcores_found", it is useless, because during boot, init_cpu_topology is called before store_cpu_topology. Thus, set_sched_topology(parisc_mc_topology) is never called. We don't need to call it at all because default_topology in kernel/sched/topology.c contains the same items as parisc_mc_topology. Note that we should not call store_cpu_topology() from init_per_cpu() because it is called too early in the kernel initialization process and it results in the message "Failure to register CPU0 device". Before this patch, store_cpu_topology() would exit immediatelly because cpuid_topo->core id was uninitialized and it was 0. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org # v5.18 Signed-off-by: Helge Deller commit 41e46b3c2aa24f755b2ae9ec4ce931ba5f0d8532 Author: Damien Le Moal Date: Fri Jun 3 11:19:05 2022 +0900 block: Fix potential deadlock in blk_ia_range_sysfs_show() When being read, a sysfs attribute is already protected against removal with the kobject node active reference counter. As a result, in blk_ia_range_sysfs_show(), there is no need to take the queue sysfs lock when reading the value of a range attribute. Using the queue sysfs lock in this function creates a potential deadlock situation with the disk removal, something that a lockdep signals with a splat when the device is removed: [ 760.703551] Possible unsafe locking scenario: [ 760.703551] [ 760.703554] CPU0 CPU1 [ 760.703556] ---- ---- [ 760.703558] lock(&q->sysfs_lock); [ 760.703565] lock(kn->active#385); [ 760.703573] lock(&q->sysfs_lock); [ 760.703579] lock(kn->active#385); [ 760.703587] [ 760.703587] *** DEADLOCK *** Solve this by removing the mutex_lock()/mutex_unlock() calls from blk_ia_range_sysfs_show(). Fixes: a2247f19ee1c ("block: Add independent access ranges support") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20220603021905.1441419-1-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit 404204340c0dc54e4b779737201044dcb231f0bf Merge: b8042ff4faa59 597b89d30b42d Author: Dave Airlie Date: Fri Jun 3 11:35:46 2022 +1000 Merge tag 'drm/tegra/for-5.19-prep-work' of https://gitlab.freedesktop.org/drm/tegra into drm-next drm/tegra: Preparatory work for v5.19 This contains a single patch from a series that's ready to go for v5.10 but is also a shared build-time dependency for an IOMMU series that is planned for v5.20. The idea is to take this into v5.19 to fulfill that dependency and remove the need for close coordination for the two series. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20220601100335.3841301-1-thierry.reding@gmail.com commit b8042ff4faa59ed3608beeeddc5d87ce55c62a98 Merge: bf23729c7a5f4 b9364eed9232f Author: Dave Airlie Date: Fri Jun 3 11:19:11 2022 +1000 Merge tag 'msm-next-5.19-fixes-06-01' of https://gitlab.freedesktop.org/abhinavk/msm into drm-next 5.19 fixes for msm-next - Fix to add minimum ICC vote in the msm_mdss pm_resume path to address bootup splats - Fix to avoid dereferencing without checking in WB encoder - Fix to avoid crash during suspend in DP driver by ensuring interrupt mask bits are updated - Remove unused code from dpu_encoder_virt_atomic_check() - Fix to remove redundant init of dsc variable Signed-off-by: Dave Airlie From: Abhinav Kumar Link: https://patchwork.freedesktop.org/patch/msgid/927b201e-a734-a29d-b9fb-b9889e1f7795@quicinc.com commit 61114e734ccb804bc12561ab4020745e02c468c2 Author: Nathan Chancellor Date: Mon May 16 14:45:21 2022 -0700 riscv: Move alternative length validation into subsection After commit 49b290e430d3 ("riscv: prevent compressed instructions in alternatives"), builds with LLVM's integrated assembler fail: In file included from arch/riscv/mm/init.c:10: In file included from ./include/linux/mm.h:29: In file included from ./include/linux/pgtable.h:6: In file included from ./arch/riscv/include/asm/pgtable.h:108: ./arch/riscv/include/asm/tlbflush.h:23:2: error: expected assembly-time absolute expression ALT_FLUSH_TLB_PAGE(__asm__ __volatile__ ("sfence.vma %0" : : "r" (addr) : "memory")); ^ ./arch/riscv/include/asm/errata_list.h:33:5: note: expanded from macro 'ALT_FLUSH_TLB_PAGE' asm(ALTERNATIVE("sfence.vma %0", "sfence.vma", SIFIVE_VENDOR_ID, \ ^ ./arch/riscv/include/asm/alternative-macros.h:187:2: note: expanded from macro 'ALTERNATIVE' _ALTERNATIVE_CFG(old_content, new_content, vendor_id, errata_id, CONFIG_k) ^ ./arch/riscv/include/asm/alternative-macros.h:113:2: note: expanded from macro '_ALTERNATIVE_CFG' __ALTERNATIVE_CFG(old_c, new_c, vendor_id, errata_id, IS_ENABLED(CONFIG_k)) ^ ./arch/riscv/include/asm/alternative-macros.h:110:2: note: expanded from macro '__ALTERNATIVE_CFG' ALT_NEW_CONTENT(vendor_id, errata_id, enable, new_c) ^ ./arch/riscv/include/asm/alternative-macros.h:99:3: note: expanded from macro 'ALT_NEW_CONTENT' ".org . - (889b - 888b) + (887b - 886b)\n" \ ^ :26:6: note: instantiated into assembly here .org . - (889b - 888b) + (887b - 886b) ^ This error happens because LLVM's integrated assembler has a one-pass design, which means it cannot figure out the instruction lengths when the .org directive is outside of the subsection that contains the instructions, which was changed by the .option directives added by the above change. Move the .org directives before the .previous directive so that these directives are always within the same subsection, which resolves the failures and does not introduce any new issues with GNU as. This was done for arm64 in commit 966a0acce2fc ("arm64/alternatives: move length validation inside the subsection") and commit 22315a2296f4 ("arm64: alternatives: Move length validation in alternative_{insn, endif}"). While there is no error from the assembly versions of the macro, they appear to have the same problem so just make the same change there as well so that there are no problems in the future. Link: https://github.com/ClangBuiltLinux/linux/issues/1640 Reported-by: kernel test robot Signed-off-by: Nathan Chancellor Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220516214520.3252074-1-nathan@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 50fd82b3a9a9335df5d50c7ddcb81c81d358c4fc Merge: baf86ac1c9ccb a27e51b45e1bc Author: Linus Torvalds Date: Thu Jun 2 15:36:06 2022 -0700 Merge tag 'docs-5.19-2' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A handful of late-arriving documentation fixes and the addition of an SVG tux logo which, I'm assured, we're going to want" * tag 'docs-5.19-2' of git://git.lwn.net/linux: documentation: Format button_dev as a pointer. docs: add SVG version of the Linux logo docs: move Linux logo into a new `images` folder docs: blockdev: change title to match section content docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 commit baf86ac1c9ccbde281df55a4daeefadec6d2e581 Merge: 09a018176ba24 8cc5b032240ae Author: Linus Torvalds Date: Thu Jun 2 15:32:26 2022 -0700 Merge tag 'asm-generic-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "The header cleanup series from Masahiro Yamada ended up causing some regressions in the ABI because of an ambigous uid_t type. This was only caught after the original patches got merged, but at least the fixes are trivial and hopefully complete" * tag 'asm-generic-fixes-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: binder: fix sender_euid type in uapi header sparc: fix mis-use of __kernel_{uid,gid}_t in uapi/asm/stat.h powerpc: use __kernel_{uid,gid}32_t in uapi/asm/stat.h mips: use __kernel_{uid,gid}32_t in uapi/asm/stat.h commit 09a018176ba246f00d6b6b526047d38dcd2955d3 Merge: 96479c09803b2 9c76d723edd4f Author: Linus Torvalds Date: Thu Jun 2 15:27:44 2022 -0700 Merge tag 'arm-late-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more ARM SoC updates from Arnd Bergmann: "This is the second part of the general SoC updates, containing everything that did not make it in the initial pull request, or that came in as a bugfix later. - Devicetree updates for SoCFPGA, ASPEED, AT91 and Rockchip, including a new machine using an ASPEED BMC. - More DT fixes from Krzysztof Kozlowski across platforms - A new SoC platform for the GXP baseboard management controller, used in current server products from HPE" * tag 'arm-late-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (56 commits) ARM: configs: Enable more audio support for i.MX tee: optee: Pass a pointer to virt_addr_valid() arm64: dts: rockchip: rename Quartz64-A bluetooth gpios arm64: dts: rockchip: add clocks property to cru node rk3368 arm64: dts: rockchip: add clocks property to cru node rk3308 arm64: dts: rockchip: add clocks to rk356x cru ARM: dts: rockchip: add clocks property to cru node rk3228 ARM: dts: rockchip: add clocks property to cru node rk3036 ARM: dts: rockchip: add clocks property to cru node rk3066a/rk3188 ARM: dts: rockchip: add clocks property to cru node rk3288 ARM: dts: rockchip: Remove "amba" bus nodes from rv1108 ARM: dts: rockchip: add clocks property to cru node rv1108 arm64: dts: sprd: use new 'dma-channels' property ARM: dts: da850: use new 'dma-channels' property ARM: dts: pxa: use new 'dma-channels/requests' properties soc: ixp4xx/qmgr: Fix unused match warning ARM: ep93xx: Make ts72xx_register_flash() static ARM: configs: enable support for Kontron KSwitch D10 ep93xx: clock: Do not return the address of the freed memory arm64: dts: intel: add device tree for n6000 ... commit 96479c09803b21d195c95fd4b145cd3a5a591ba0 Merge: 58f9d52ff689a 3d76c9f5e0ee8 Author: Linus Torvalds Date: Thu Jun 2 15:23:54 2022 -0700 Merge tag 'arm-multiplatform-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more ARM multiplatform updates from Arnd Bergmann: "The second part of the multiplatform changes now converts the Intel/Marvell PXA platform along with the rest. The patches went through several rebases before the merge window as bugs were found, so they remained separate. This has to touch a lot of drivers, in particular the touchscreen, pcmcia, sound and clk bits, to detach the driver files from the platform and board specific header files" * tag 'arm-multiplatform-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits) ARM: pxa/mmp: remove traces of plat-pxa ARM: pxa: convert to multiplatform ARM: pxa/sa1100: move I/O space to PCI_IOBASE ARM: pxa: remove support for MTD_XIP ARM: pxa: move mach/*.h to mach-pxa/ ARM: PXA: fix multi-cpu build of xsc3 ARM: pxa: move plat-pxa to drivers/soc/ ARM: mmp: rename pxa_register_device ARM: mmp: remove tavorevb board support ARM: pxa: remove unused mach/bitfield.h ARM: pxa: move clk register definitions to driver ARM: pxa: move smemc register access from clk to platform cpufreq: pxa3: move clk register access to clk driver ARM: pxa: remove get_clk_frequency_khz() ARM: pxa: pcmcia: move smemc configuration back to arch ASoC: pxa: i2s: use normal MMIO accessors ASoC: pxa: ac97: use normal MMIO accessors ASoC: pxa: use pdev resource for FIFO regs Input: wm97xx - get rid of irq_enable method in wm97xx_mach_ops Input: wm97xx - switch to using threaded IRQ ... commit 9c375cfc7395bfed2c2790e3b97c32eefb7b726e Author: Jisheng Zhang Date: Mon May 16 22:32:04 2022 +0800 riscv: mm: init: make pt_ops_set_[early|late|fixmap] static These three functions are only used in init.c, so make them static. Fix W=1 warnings like below: arch/riscv/mm/init.c:721:13: warning: no previous prototype for function 'pt_ops_set_early' [-Wmissing-prototypes] void __init pt_ops_set_early(void) ^ Signed-off-by: Jisheng Zhang Reviewed-by: Anup Patel Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20220516143204.2603-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 2c9e4559773c261900c674a86b8e455911675d71 Author: Pablo Neira Ayuso Date: Wed Jun 1 17:49:36 2022 +0200 netfilter: nf_tables: always initialize flowtable hook list in transaction The hook list is used if nft_trans_flowtable_update(trans) == true. However, initialize this list for other cases for safety reasons. Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Signed-off-by: Pablo Neira Ayuso commit 58f9d52ff689a262bec7f5713c07f5a79e115168 Merge: 73503963b715a 638696efc1472 Author: Linus Torvalds Date: Thu Jun 2 12:50:16 2022 -0700 Merge tag 'net-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf and netfilter. Current release - new code bugs: - af_packet: make sure to pull the MAC header, avoid skb panic in GSO - ptp_clockmatrix: fix inverted logic in is_single_shot() - netfilter: flowtable: fix missing FLOWI_FLAG_ANYSRC flag - dt-bindings: net: adin: fix adi,phy-output-clock description syntax - wifi: iwlwifi: pcie: rename CAUSE macro, avoid MIPS build warning Previous releases - regressions: - Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd - nf_tables: disallow non-stateful expression in sets earlier - nft_limit: clone packet limits' cost value - nf_tables: double hook unregistration in netns path - ping6: fix ping -6 with interface name Previous releases - always broken: - sched: fix memory barriers to prevent skbs from getting stuck in lockless qdiscs - neigh: set lower cap for neigh_managed_work rearming, avoid constantly scheduling the probe work - bpf: fix probe read error on big endian in ___bpf_prog_run() - amt: memory leak and error handling fixes Misc: - ipv6: expand & rename accept_unsolicited_na to accept_untracked_na" * tag 'net-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (80 commits) net/af_packet: make sure to pull mac header net: add debug info to __skb_pull() net: CONFIG_DEBUG_NET depends on CONFIG_NET stmmac: intel: Add RPL-P PCI ID net: stmmac: use dev_err_probe() for reporting mdio bus registration failure tipc: check attribute length for bearer name ice: fix access-beyond-end in the switch code nfp: remove padding in nfp_nfdk_tx_desc ax25: Fix ax25 session cleanup problems net: usb: qmi_wwan: Add support for Cinterion MV31 with new baseline sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels sfc/siena: fix considering that all channels have TX queues socket: Don't use u8 type in uapi socket.h net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6() net: ping6: Fix ping -6 with interface name macsec: fix UAF bug for real_dev octeontx2-af: fix error code in is_valid_offset() wifi: mac80211: fix use-after-free in chanctx code bonding: guard ns_targets by CONFIG_IPV6 tcp: tcp_rtx_synack() can be called from process context ... commit 73503963b715a64a44aa2b1c486114b917a17c73 Author: Saravana Kannan Date: Wed Jun 1 20:56:52 2022 -0700 module: Fix prefix for module.sig_enforce module param Commit cfc1d277891e ("module: Move all into module/") changed the prefix of the module param by moving/renaming files. A later commit also moves the module_param() into a different file, thereby changing the prefix yet again. This would break kernel cmdline compatibility and also userspace compatibility at /sys/module/module/parameters/sig_enforce. So, set the prefix back to "module.". Fixes: cfc1d277891e ("module: Move all into module/") Link: https://lore.kernel.org/lkml/20220602034111.4163292-1-saravanak@google.com/ Cc: Christophe Leroy Cc: Aaron Tomlin Acked-by: Luis Chamberlain Signed-off-by: Saravana Kannan Signed-off-by: Linus Torvalds commit 78c09c0f4df89fabdcfb3e5e53d3196cf67f64ef Author: Cristian Marussi Date: Tue May 24 11:31:49 2022 +0100 kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported On platform where SVE is supported but there are less than 2 VLs available the signal SVE change test should be skipped instead of failing. Reported-by: Andre Przywara Tested-by: Andre Przywara Cc: Mark Brown Signed-off-by: Cristian Marussi Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20220524103149.2802-1-cristian.marussi@arm.com Signed-off-by: Catalin Marinas commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae Author: Stephen Boyd Date: Wed Jun 1 19:21:09 2022 -0700 arm64: Initialize jump labels before setup_machine_fdt() A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because setup_machine_fdt() is called before jump_label_init() during setup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited. static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init() WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : static_key_enable_cpuslocked+0xb0/0xb8 lr : static_key_enable_cpuslocked+0xb0/0xb8 sp : ffffffe51c393cf0 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 Call trace: static_key_enable_cpuslocked+0xb0/0xb8 static_key_enable+0x2c/0x40 crng_set_ready+0x24/0x30 execute_in_process_context+0x80/0x90 _credit_init_bits+0x100/0x154 add_bootloader_randomness+0x64/0x78 early_init_dt_scan_chosen+0x140/0x184 early_init_dt_scan_nodes+0x28/0x4c early_init_dt_scan+0x40/0x44 setup_machine_fdt+0x7c/0x120 setup_arch+0x74/0x1d8 start_kernel+0x84/0x44c __primary_switched+0xc0/0xc8 ---[ end trace 0000000000000000 ]--- random: crng init done Machine model: Google Lazor (rev1 - 2) with LTE Cc: Hsin-Yi Wang Cc: Douglas Anderson Cc: Ard Biesheuvel Cc: Steven Rostedt Cc: Jason A. Donenfeld Cc: Dominik Brodowski Fixes: f5bda35fba61 ("random: use static branch for crng_ready()") Signed-off-by: Stephen Boyd Reviewed-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20220602022109.780348-1-swboyd@chromium.org Signed-off-by: Catalin Marinas commit 189129aecb5302ab65407e965f1037a201b58a07 Author: Xiang wangx Date: Fri Jun 3 02:02:28 2022 +0800 arm64: hibernate: Fix syntax errors in comments Delete the redundant word 'to'. Signed-off-by: Xiang wangx Link: https://lore.kernel.org/r/20220602180228.4259-1-wangxiang@cdjrlc.com Signed-off-by: Catalin Marinas commit c399c85d60a4295bd911d366399a97df2865fb86 Merge: 17d8e3d90b698 833e53a4ffe92 Author: Linus Torvalds Date: Thu Jun 2 12:11:25 2022 -0700 Merge tag 'pci-v5.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci fixes from Bjorn Helgaas: - Revert brcmstb patches that broke booting on Raspberry Pi Compute Module 4 (Bjorn Helgaas) - Fix bridge_d3_blacklist[] error that overwrote the existing Gigabyte X299 entry instead of adding a new one (Bjorn Helgaas) - Update Lorenzo Pieralisi's email address in MAINTAINERS (Lorenzo Pieralisi) * tag 'pci-v5.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: MAINTAINERS: Update Lorenzo Pieralisi's email address PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs" Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators" Revert "PCI: brcmstb: Add control of subdevice voltage regulators" Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend" commit 587b9bfe0668bc997e51af9526a0c7c084d4660f Author: Dmitry Osipenko Date: Wed Jun 1 01:11:02 2022 +0300 kernel/reboot: Use static handler for register_platform_power_off() The register_platform_power_off() fails on m68k platform due to the memory allocation error that happens at a very early boot time when memory allocator isn't available yet. Fix it by using a static sys-off handler for the platform-level power-off handlers. Fixes: f0f7e5265b3b ("m68k: Switch to new sys-off handler API") Reported-by: Geert Uytterhoeven Signed-off-by: Dmitry Osipenko Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Rafael J. Wysocki commit 0c9782e204d3cc5625b9e8bf4e8625d38dfe0139 Author: Kristen Carlson Accardi Date: Fri May 20 10:42:47 2022 -0700 x86/sgx: Set active memcg prior to shmem allocation When the system runs out of enclave memory, SGX can reclaim EPC pages by swapping to normal RAM. These backing pages are allocated via a per-enclave shared memory area. Since SGX allows unlimited over commit on EPC memory, the reclaimer thread can allocate a large number of backing RAM pages in response to EPC memory pressure. When the shared memory backing RAM allocation occurs during the reclaimer thread context, the shared memory is charged to the root memory control group, and the shmem usage of the enclave is not properly accounted for, making cgroups ineffective at limiting the amount of RAM an enclave can consume. For example, when using a cgroup to launch a set of test enclaves, the kernel does not properly account for 50% - 75% of shmem page allocations on average. In the worst case, when nearly all allocations occur during the reclaimer thread, the kernel accounts less than a percent of the amount of shmem used by the enclave's cgroup to the correct cgroup. SGX stores a list of mm_structs that are associated with an enclave. Pick one of them during reclaim and charge that mm's memcg with the shmem allocation. The one that gets picked is arbitrary, but this list almost always only has one mm. The cases where there is more than one mm with different memcg's are not worth considering. Create a new function - sgx_encl_alloc_backing(). This function is used whenever a new backing storage page needs to be allocated. Previously the same function was used for page allocation as well as retrieving a previously allocated page. Prior to backing page allocation, if there is a mm_struct associated with the enclave that is requesting the allocation, it is set as the active memory control group. [ dhansen: - fix merge conflict with ELDU fixes - check against actual ksgxd_tsk, not ->mm ] Cc: stable@vger.kernel.org Signed-off-by: Kristen Carlson Accardi Signed-off-by: Dave Hansen Reviewed-by: Shakeel Butt Acked-by: Roman Gushchin Link: https://lkml.kernel.org/r/20220520174248.4918-1-kristen@linux.intel.com commit 638696efc14729759c1d735e19e87606450b80a8 Merge: 83450bbafebda e9d3f80935b66 Author: Jakub Kicinski Date: Thu Jun 2 10:15:07 2022 -0700 Merge branch 'net-af_packet-be-careful-when-expanding-mac-header-size' Eric Dumazet says: ==================== net: af_packet: be careful when expanding mac header size A recent regression in af_packet needed a preliminary debug patch, which will presumably be useful for next bugs hunting. The af_packet fix is to make sure MAC headers are contained in skb linear part, as GSO stack requests. v2: CONFIG_DEBUG_NET depends on CONFIG_NET to avoid compile errors found by kernel bots. ==================== Link: https://lore.kernel.org/r/20220602161859.2546399-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit e9d3f80935b6607dcdc5682b00b1d4b28e0a0c5d Author: Eric Dumazet Date: Thu Jun 2 09:18:59 2022 -0700 net/af_packet: make sure to pull mac header GSO assumes skb->head contains link layer headers. tun device in some case can provide base 14 bytes, regardless of VLAN being used or not. After blamed commit, we can end up setting a network header offset of 18+, we better pull the missing bytes to avoid a posible crash in GSO. syzbot report was: kernel BUG at include/linux/skbuff.h:2699! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 3601 Comm: syz-executor210 Not tainted 5.18.0-syzkaller-11338-g2c5ca23f7414 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__skb_pull include/linux/skbuff.h:2699 [inline] RIP: 0010:skb_mac_gso_segment+0x48f/0x530 net/core/gro.c:136 Code: 00 48 c7 c7 00 96 d4 8a c6 05 cb d3 45 06 01 e8 26 bb d0 01 e9 2f fd ff ff 49 c7 c4 ea ff ff ff e9 f1 fe ff ff e8 91 84 19 fa <0f> 0b 48 89 df e8 97 44 66 fa e9 7f fd ff ff e8 ad 44 66 fa e9 48 RSP: 0018:ffffc90002e2f4b8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000000000 RDX: ffff88805bb58000 RSI: ffffffff8760ed0f RDI: 0000000000000004 RBP: 0000000000005dbc R08: 0000000000000004 R09: 0000000000000fe0 R10: 0000000000000fe4 R11: 0000000000000000 R12: 0000000000000fe0 R13: ffff88807194d780 R14: 1ffff920005c5e9b R15: 0000000000000012 FS: 000055555730f300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200015c0 CR3: 0000000071ff8000 CR4: 0000000000350ee0 Call Trace: __skb_gso_segment+0x327/0x6e0 net/core/dev.c:3411 skb_gso_segment include/linux/netdevice.h:4749 [inline] validate_xmit_skb+0x6bc/0xf10 net/core/dev.c:3669 validate_xmit_skb_list+0xbc/0x120 net/core/dev.c:3719 sch_direct_xmit+0x3d1/0xbe0 net/sched/sch_generic.c:327 __dev_xmit_skb net/core/dev.c:3815 [inline] __dev_queue_xmit+0x14a1/0x3a00 net/core/dev.c:4219 packet_snd net/packet/af_packet.c:3071 [inline] packet_sendmsg+0x21cb/0x5550 net/packet/af_packet.c:3102 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f4b95da06c9 Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd7defc4c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ffd7defc4f0 RCX: 00007f4b95da06c9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 RBP: 0000000000000003 R08: bb1414ac00000050 R09: bb1414ac00000050 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd7defc4e0 R14: 00007ffd7defc4d8 R15: 00007ffd7defc4d4 Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Hangbin Liu Acked-by: Willem de Bruijn Cc: Michael S. Tsirkin Signed-off-by: Jakub Kicinski commit 22296a5c0cd35aaf62e1af3266f82cdf6b0b9b78 Author: Eric Dumazet Date: Thu Jun 2 09:18:58 2022 -0700 net: add debug info to __skb_pull() While analyzing yet another syzbot report, I found the following patch very useful. It allows to better understand what went wrong. This debug info is only enabled if CONFIG_DEBUG_NET=y, which is the case for syzbot builds. Signed-off-by: Eric Dumazet Acked-by: Willem de Bruijn Signed-off-by: Jakub Kicinski commit eb0b39efb7d908e3950f6f76ee6e3cecb86ec489 Author: Eric Dumazet Date: Thu Jun 2 09:18:57 2022 -0700 net: CONFIG_DEBUG_NET depends on CONFIG_NET It makes little sense to debug networking stacks if networking is not compiled in. Signed-off-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 83450bbafebdaf90818e77ee368202f03d056cd7 Author: Michael Sit Wei Hong Date: Thu Jun 2 15:35:07 2022 +0800 stmmac: intel: Add RPL-P PCI ID Add PCI ID for Ethernet TSN Controller on RPL-P. Signed-off-by: Michael Sit Wei Hong Link: https://lore.kernel.org/r/20220602073507.3955721-1-michael.wei.hong.sit@intel.com Signed-off-by: Jakub Kicinski commit 839612d23ffd933174db911ce56dc3f3ca883ec5 Author: Rasmus Villemoes Date: Thu Jun 2 09:48:40 2022 +0200 net: stmmac: use dev_err_probe() for reporting mdio bus registration failure I have a board where these two lines are always printed during boot: imx-dwmac 30bf0000.ethernet: Cannot register the MDIO bus imx-dwmac 30bf0000.ethernet: stmmac_dvr_probe: MDIO bus (id: 1) registration failed It's perfectly fine, and the device is successfully (and silently, as far as the console goes) probed later. Use dev_err_probe() instead, which will demote these messages to debug level (thus removing the alarming messages from the console) when the error is -EPROBE_DEFER, and also has the advantage of including the error code if/when it happens to be something other than -EPROBE_DEFER. While here, add the missing \n to one of the format strings. Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20220602074840.1143360-1-linux@rasmusvillemoes.dk Signed-off-by: Jakub Kicinski commit 7f36f798f89bf32c0164049cb0e3fd1af613d0bb Author: Hoang Le Date: Thu Jun 2 13:30:53 2022 +0700 tipc: check attribute length for bearer name syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline] BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725 string_nocheck lib/vsprintf.c:644 [inline] string+0x4f9/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283 vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50 _printk+0x18d/0x1cf kernel/printk/printk.c:2293 tipc_enable_bearer net/tipc/bearer.c:371 [inline] __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033 tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline] - Do sanity check the attribute length for TIPC_NLA_BEARER_NAME. - Do not use 'illegal name' in printing message. Reported-by: syzbot+e820fdc8ce362f2dea51@syzkaller.appspotmail.com Fixes: cb30a63384bc ("tipc: refactor function tipc_enable_bearer()") Acked-by: Jon Maloy Signed-off-by: Hoang Le Link: https://lore.kernel.org/r/20220602063053.5892-1-hoang.h.le@dektech.com.au Signed-off-by: Jakub Kicinski commit f012e95b377c73c0283f009823c633104dedb337 Author: Chuck Lever Date: Wed Jun 1 12:46:52 2022 -0400 SUNRPC: Trap RDMA segment overflows Prevent svc_rdma_build_writes() from walking off the end of a Write chunk's segment array. Caught with KASAN. The test that this fix replaces is invalid, and might have been left over from an earlier prototype of the PCL work. Fixes: 7a1cbfa18059 ("svcrdma: Use parsed chunk lists to construct RDMA Writes") Signed-off-by: Chuck Lever commit b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01 Author: Chuck Lever Date: Tue May 31 19:49:01 2022 -0400 NFSD: Fix potential use-after-free in nfsd_file_put() nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref(). Suggested-by: Trond Myklebust Fixes: 999397926ab3 ("nfsd: Clean up nfsd_file_put()") Signed-off-by: Chuck Lever commit 17d8e3d90b6989419806c1926b894d7d7483a25b Merge: 7c9e960c63630 af7dc8e5124da Author: Linus Torvalds Date: Thu Jun 2 08:59:39 2022 -0700 Merge tag 'ceph-for-5.19-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A big pile of assorted fixes and improvements for the filesystem with nothing in particular standing out, except perhaps that the fact that the MDS never really maintained atime was made official and thus it's no longer updated on the client either. We also have a MAINTAINERS update: Jeff is transitioning his filesystem maintainership duties to Xiubo" * tag 'ceph-for-5.19-rc1' of https://github.com/ceph/ceph-client: (23 commits) MAINTAINERS: move myself from ceph "Maintainer" to "Reviewer" ceph: fix decoding of client session messages flags ceph: switch TASK_INTERRUPTIBLE to TASK_KILLABLE ceph: remove redundant variable ino ceph: try to queue a writeback if revoking fails ceph: fix statfs for subdir mounts ceph: fix possible deadlock when holding Fwb to get inline_data ceph: redirty the page for writepage on failure ceph: try to choose the auth MDS if possible for getattr ceph: disable updating the atime since cephfs won't maintain it ceph: flush the mdlog for filesystem sync ceph: rename unsafe_request_wait() libceph: use swap() macro instead of taking tmp variable ceph: fix statx AT_STATX_DONT_SYNC vs AT_STATX_FORCE_SYNC check ceph: no need to invalidate the fscache twice ceph: replace usage of found with dedicated list iterator variable ceph: use dedicated list iterator variable ceph: update the dlease for the hashed dentry when removing ceph: stop retrying the request when exceeding 256 times ceph: stop forwarding the request when exceeding 256 times ... commit 7c9e960c636306f632ccae623bf94b2b53d35cbd Merge: 12831f6486f9d 5d7c854593a46 Author: Linus Torvalds Date: Thu Jun 2 08:55:01 2022 -0700 Merge tag 'livepatching-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching cleanup from Petr Mladek: - Remove duplicated livepatch code [Christophe] * tag 'livepatching-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Remove klp_arch_set_pc() and asm/livepatch.h commit 12831f6486f9db5a8f2c87129f2b8f33349b1e04 Merge: ca1dcc6d0c569 809631e2bff5a Author: Linus Torvalds Date: Thu Jun 2 08:49:54 2022 -0700 Merge tag 'printk-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixup from Petr Mladek: - Revert inappropriate use of wake_up_interruptible_all() in printk() * tag 'printk-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: Revert "printk: wake up all waiters" commit 8cc5b032240ae5220b62c689c20459d3e1825b2d Author: Carlos Llamas Date: Wed Jun 1 01:00:17 2022 +0000 binder: fix sender_euid type in uapi header The {pid,uid}_t fields of struct binder_transaction were recently replaced to use kernel types in commit 169adc2b6b3c ("android/binder.h: add linux/android/binder(fs).h to UAPI compile-test coverage"). However, using __kernel_uid_t here breaks backwards compatibility in architectures using 16-bits for this type, since glibc and some others still expect a 32-bit uid_t. Instead, let's use __kernel_uid32_t which avoids this compatibility problem. Fixes: 169adc2b6b3c ("android/binder.h: add linux/android/binder(fs).h to UAPI compile-test coverage") Reported-by: Christopher Ferris Signed-off-by: Carlos Llamas Acked-by: Todd Kjos Signed-off-by: Arnd Bergmann commit ca1dcc6d0c569e1e5f5b4a764329d9530760a416 Merge: 690b2549b1956 000605cd1b14f Author: Linus Torvalds Date: Thu Jun 2 08:46:30 2022 -0700 Merge tag 'memblock-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock test suite updates from Mike Rapoport: "Comment updates for memblock test suite Update comments in the memblock tests so that they will have consistent style" * tag 'memblock-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock tests: remove completed TODO item memblock tests: update style of comments for memblock_free_*() functions memblock tests: update style of comments for memblock_remove_*() functions memblock tests: update style of comments for memblock_reserve_*() functions memblock tests: update style of comments for memblock_add_*() functions commit 690b2549b19563ec5ad53e5c82f6a944d910086e Author: Dan Carpenter Date: Thu Jun 2 14:02:18 2022 +0300 i2c: ismt: prevent memory corruption in ismt_access() The "data->block[0]" variable comes from the user and is a number between 0-255. It needs to be capped to prevent writing beyond the end of dma_buffer[]. Fixes: 5e9a97b1f449 ("i2c: ismt: Adding support for I2C_SMBUS_BLOCK_PROC_CALL") Reported-and-tested-by: Zheyu Ma Signed-off-by: Dan Carpenter Reviewed-by: Mika Westerberg Signed-off-by: Linus Torvalds commit 3cbcff691173adf13c40ead37f2f628e2db52909 Author: Masahiro Yamada Date: Thu Jun 2 03:19:41 2022 +0900 sparc: fix mis-use of __kernel_{uid,gid}_t in uapi/asm/stat.h Commit 31a088b664d6 ("sparc: add asm/stat.h to UAPI compile-test coverage") converted as follows: uid_t --> __kernel_uid_t gid_t --> __kernel_gid_t It changed the field widths of struct stat because Sparc uses 16-bits for ___kernel_{uid,gid}_t as in arch/sparc/include/uapi/asm/posix_types.h. The safe replacements across all architectures are: uid_t --> __kernel_uid32_t gid_t --> __kernel_gid32_t as defined in include/linux/types.h. A similar issue was reported for the android binder. [1] [1]: https://lore.kernel.org/all/20220601010017.2639048-1-cmllamas@google.com/ Fixes: 31a088b664d6 ("sparc: add asm/stat.h to UAPI compile-test coverage") Signed-off-by: Masahiro Yamada Signed-off-by: Arnd Bergmann commit d39e06154024b08a856767a70b7f8215e0af6ace Author: Masahiro Yamada Date: Thu Jun 2 03:19:40 2022 +0900 powerpc: use __kernel_{uid,gid}32_t in uapi/asm/stat.h Commit c01013a2f8dd ("powerpc: add asm/stat.h to UAPI compile-test coverage") converted as follows: uid_t --> __kernel_uid_t gid_t --> __kernel_gid_t The bit width of __kernel_{uid,gid}_t is 16 or 32-bits depending on architectures. PPC uses 32-bits for them as in include/uapi/asm-generic/posix_types.h, so the previous conversion is probably fine, but let's stick to the arch-independent conversion just in case. The safe replacements across all architectures are: uid_t --> __kernel_uid32_t gid_t --> __kernel_gid32_t as defined in include/linux/types.h. A similar issue was reported for the android binder. [1] [1]: https://lore.kernel.org/all/20220601010017.2639048-1-cmllamas@google.com/ Fixes: c01013a2f8dd ("powerpc: add asm/stat.h to UAPI compile-test coverage") Signed-off-by: Masahiro Yamada Signed-off-by: Arnd Bergmann commit 6cd6356206605f283f82210918049465d0a08670 Author: Masahiro Yamada Date: Thu Jun 2 03:19:39 2022 +0900 mips: use __kernel_{uid,gid}32_t in uapi/asm/stat.h Commit 8c1a381a4fbb ("mips: add asm/stat.h to UAPI compile-test coverage") converted as follows: uid_t --> __kernel_uid_t gid_t --> __kernel_gid_t The bit width of __kernel_{uid,gid}_t is 16 or 32-bits depending on architectures. MIPS uses 32-bits for them as in include/uapi/asm-generic/posix_types.h, so the previous conversion is probably fine, but let's stick to the arch-independent conversion just in case. The safe replacements across all architectures are: uid_t --> __kernel_uid32_t gid_t --> __kernel_gid32_t as defined in include/linux/types.h. A similar issue was reported for the android binder. [1] [1]: https://lore.kernel.org/all/20220601010017.2639048-1-cmllamas@google.com/ Fixes: 8c1a381a4fbb ("mips: add asm/stat.h to UAPI compile-test coverage") Signed-off-by: Masahiro Yamada Signed-off-by: Arnd Bergmann commit fe3f70eec425af77f3ea9818d8fe43a4b524bc7c Author: Rob Herring Date: Tue May 31 16:58:14 2022 -0500 dt-bindings: PCI: apple: Add missing 'power-domains' property The 'unevaluatedProperties' schema checks is not fully working and doesn't catch some cases where there's a $ref to another schema. A fix is pending, but results in new warnings in examples. The Apple PCIe host schema is missing 'power-domains' in the schema. The example has 3 power domains. However, this is wrong too as actual dts files have a single power domain and Sven confirmed 1 is correct. Cc: Sven Peter Signed-off-by: Rob Herring Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/20220531215815.2408477-1-robh@kernel.org commit f5f1a977fe0b447ade38058dfbdbf540b53042b0 Author: Sibi Sankar Date: Thu Jun 2 06:18:41 2022 +0530 dt-bindings: Update Sibi Sankar's email address Update email address to the quicinc.com domain. Signed-off-by: Sibi Sankar Acked-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/1654130923-18722-1-git-send-email-quic_sibis@quicinc.com commit 304e4d53dd3268b2439932b620d246667ca960f1 Author: Jeffrey Hugo Date: Wed Jun 1 15:29:52 2022 -0600 dt-bindings: clock: Update my email address Update my email address from the defunct codeaurora.org domain to the current quicinc.com domain. Signed-off-by: Jeffrey Hugo Acked-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/1654118992-4026-1-git-send-email-quic_jhugo@quicinc.com commit d69a155555c9d57463b788c400f6b452d976bacd Author: xliu Date: Thu Jun 2 13:19:22 2022 +0800 ASoC: Intel: cirrus-common: fix incorrect channel mapping The default mapping of ASPRX1 (DAC source) is slot 0. Change the slot mapping of right amplifiers (WR and TR) to slot 1 to receive right channel data. Also update the ACPI instance ID mapping according to HW configuration. Signed-off-by: xliu Signed-off-by: Brent Lu Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220602051922.1232457-1-brent.lu@intel.com Signed-off-by: Mark Brown commit 5dad4eccd2b4316a84209603a28d34c6346392bb Author: Dipen Patel Date: Mon May 23 10:25:15 2022 -0700 dt-bindings: timestamp: Correct id path During the repository renaming from hte to timestamp, $id path was not updated accordingly. This patch corrects $id path. Fixes: af583852d2ef ("dt-bindings: Renamed hte directory to timestamp") Signed-off-by: Dipen Patel Acked-by: Rob Herring Signed-off-by: Thierry Reding commit aacae8c469f9ce4b303a2eb61593ff522c1420bc Author: Damien Le Moal Date: Thu Jun 2 21:03:44 2022 +0900 block: null_blk: Fix null_zone_write() The bio and rq fields of struct nullb_cmd are now overlapping in a union. So we cannot use a test on ->bio being non-NULL to detect the NULL_Q_BIO queue mode. null_zone_write() use such broken test to set the sector position of a zone append write in the command bio or request. When the null_blk device uses the NULL_Q_MQ queue mode, null_zone_write() wrongly end up setting the bio sector position, resulting in the command request to be broken and random crashes following. Fix this by testing the device queue mode directly. Fixes: 8ba816b23abd ("null-blk: save memory footprint for struct nullb_cmd") Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220602120344.1365329-1-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit 3e8635fb2e072672cbc650989ffedf8300ad67fb Author: Michael Ellerman Date: Thu Jun 2 00:31:14 2022 +1000 powerpc/kasan: Force thread size increase with KASAN KASAN causes increased stack usage, which can lead to stack overflows. The logic in Kconfig to suggest a larger default doesn't work if a user has CONFIG_EXPERT enabled and has an existing .config with a smaller value. Follow the lead of x86 and arm64, and force the thread size to be increased when KASAN is enabled. That also has the effect of enlarging the stack for 64-bit KASAN builds, which is also desirable. Fixes: edbadaf06710 ("powerpc/kasan: Fix stack overflow by increasing THREAD_SHIFT") Reported-by: Erhard Furtner Reported-by: Christophe Leroy [mpe: Use MIN_THREAD_SHIFT as suggested by Christophe] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220601143114.133524-1-mpe@ellerman.id.au commit 1bec877bdb763999112ad05d243bd538966938b4 Author: Catalin Marinas Date: Wed Jun 1 18:13:38 2022 +0100 arm64: Remove the __user annotation for the restore_za_context() argument The struct user_ctx *user pointer passed to restore_za_context() is not a user point but a structure containing several __user pointers. Remove the __user annotation. Signed-off-by: Catalin Marinas Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling") Reported-by: kernel test robot Cc: Mark Brown Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20220601171338.2143625-1-catalin.marinas@arm.com Signed-off-by: Catalin Marinas commit 6e1ff618737a2ffa12191dcd99f83ef07fac2e45 Author: Alexander Lobakin Date: Wed Jun 1 12:59:24 2022 +0200 ice: fix access-beyond-end in the switch code Global `-Warray-bounds` enablement revealed some problems, one of which is the way we define and use AQC rules messages. In fact, they have a shared header, followed by the actual message, which can be of one of several different formats. So it is straightforward enough to define that header as a separate struct and then embed it into message structures as needed, but currently all the formats reside in one union coupled with the header. Then, the code allocates only the memory needed for a particular message format, leaving the union potentially incomplete. There are no actual reads or writes beyond the end of an allocated chunk, but at the same time, the whole implementation is fragile and backed by an equilibrium rather than strong type and memory checks. Define the structures the other way around: one for the common header and the rest for the actual formats with the header embedded. There are no places where several union members would be used at the same time anyway. This allows to use proper struct_size() and let the compiler know what is going to be done. Finally, unsilence `-Warray-bounds` back for ice_switch.c. Other little things worth mentioning: * &ice_sw_rule_vsi_list_query is not used anywhere, remove it. It's weird anyway to talk to hardware with purely kernel types (bitmaps); * expand the ICE_SW_RULE_*_SIZE() macros to pass a structure variable name to struct_size() to let it do strict typechecking; * rename ice_sw_rule_lkup_rx_tx::hdr to ::hdr_data to keep ::hdr for the header structure to have the same name for it constistenly everywhere; * drop the duplicate of %ICE_SW_RULE_RX_TX_NO_HDR_SIZE residing in ice_switch.h. Fixes: 9daf8208dd4d ("ice: Add support for switch filter programming") Fixes: 66486d8943ba ("ice: replace single-element array used for C struct hack") Signed-off-by: Alexander Lobakin Reviewed-by: Marcin Szycik Acked-by: Tony Nguyen Link: https://lore.kernel.org/r/20220601105924.2841410-1-alexandr.lobakin@intel.com Signed-off-by: Paolo Abeni commit c6fbbf1eae8f35e10966826960e154c9596c86dc Author: Fei Qin Date: Wed Jun 1 10:34:49 2022 +0200 nfp: remove padding in nfp_nfdk_tx_desc NFDK firmware supports 48-bit dma addressing and parses 16 high bits of dma addresses. In nfp_nfdk_tx_desc, dma related structure and tso related structure are union. When "mss" be filled with nonzero value due to enable tso, the memory used by "padding" may be also filled. Then, firmware may parse wrong dma addresses which causes TX watchdog timeout problem. This patch removes padding and unifies the dma_addr_hi bits with the one in firmware. nfp_nfdk_tx_desc_set_dma_addr is also added to match this change. Fixes: c10d12e3dce8 ("nfp: add support for NFDK data path") Signed-off-by: Fei Qin Signed-off-by: Yinjun Zhang Signed-off-by: Louis Peens Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220601083449.50556-1-simon.horman@corigine.com Signed-off-by: Paolo Abeni commit f85daf0e725358be78dfd208dea5fd665d8cb901 Author: Hangyu Hua Date: Wed Jun 1 14:46:25 2022 +0800 xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of pols[0]. This refcount can be dropped in xfrm_expand_policies() when xfrm_expand_policies() return error. pols[0]'s refcount is balanced in here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with num_pols == 1 to drop this refcount when xfrm_expand_policies() return error. This patch also fix an illegal address access. pols[0] will save a error point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve an illegal address in xfrm_bundle_lookup's error path. Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path. Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing flows") Signed-off-by: Hangyu Hua Signed-off-by: Steffen Klassert commit 7d8a3a477b3e25ada8dc71d22048c2ea417209a0 Author: Duoming Zhou Date: Mon May 30 23:21:58 2022 +0800 ax25: Fix ax25 session cleanup problems There are session cleanup problems in ax25_release() and ax25_disconnect(). If we setup a session and then disconnect, the disconnected session is still in "LISTENING" state that is shown below. Active AX.25 sockets Dest Source Device State Vr/Vs Send-Q Recv-Q DL9SAU-4 DL9SAU-3 ??? LISTENING 000/000 0 0 DL9SAU-3 DL9SAU-4 ??? LISTENING 000/000 0 0 The first reason is caused by del_timer_sync() in ax25_release(). The timers of ax25 are used for correct session cleanup. If we use ax25_release() to close ax25 sessions and ax25_dev is not null, the del_timer_sync() functions in ax25_release() will execute. As a result, the sessions could not be cleaned up correctly, because the timers have stopped. In order to solve this problem, this patch adds a device_up flag in ax25_dev in order to judge whether the device is up. If there are sessions to be cleaned up, the del_timer_sync() in ax25_release() will not execute. What's more, we add ax25_cb_del() in ax25_kill_by_device(), because the timers have been stopped and there are no functions that could delete ax25_cb if we do not call ax25_release(). Finally, we reorder the position of ax25_list_lock in ax25_cb_del() in order to synchronize among different functions that call ax25_cb_del(). The second reason is caused by improper check in ax25_disconnect(). The incoming ax25 sessions which ax25->sk is null will close heartbeat timer, because the check "if(!ax25->sk || ..)" is satisfied. As a result, the session could not be cleaned up properly. In order to solve this problem, this patch changes the improper check to "if(ax25->sk && ..)" in ax25_disconnect(). What`s more, the ax25_disconnect() may be called twice, which is not necessary. For example, ax25_kill_by_device() calls ax25_disconnect() and sets ax25->state to AX25_STATE_0, but ax25_release() calls ax25_disconnect() again. In order to solve this problem, this patch add a check in ax25_release(). If the flag of ax25->sk equals to SOCK_DEAD, the ax25_disconnect() in ax25_release() should not be executed. Fixes: 82e31755e55f ("ax25: Fix UAF bugs in ax25 timers") Fixes: 8a367e74c012 ("ax25: Fix segfault after sock connection timeout") Reported-and-tested-by: Thomas Osterried Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220530152158.108619-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni commit 22b106e5355d6e7a9c3b5cb5ed4ef22ae585ea94 Author: Jan Kara Date: Thu Jun 2 10:12:42 2022 +0200 block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Commit d92c370a16cb ("block: really clone the block cgroup in bio_clone_blkg_association") changed bio_clone_blkg_association() to just clone bio->bi_blkg reference from source to destination bio. This is however wrong if the source and destination bios are against different block devices because struct blkcg_gq is different for each bdev-blkcg pair. This will result in IOs being accounted (and throttled as a result) multiple times against the same device (src bdev) while throttling of the other device (dst bdev) is ignored. In case of BFQ the inconsistency can even result in crashes in bfq_bic_update_cgroup(). Fix the problem by looking up correct blkcg_gq for the cloned bio. Reported-by: Logan Gunthorpe Reported-and-tested-by: Donald Buczek Fixes: d92c370a16cb ("block: really clone the block cgroup in bio_clone_blkg_association") CC: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220602081242.7731-1-jack@suse.cz Signed-off-by: Jens Axboe commit ff47dbd18b8db251fe1fd013a8fa067d381ecd5b Author: Damien Le Moal Date: Thu Jun 2 16:51:59 2022 +0900 block: remove useless BUG_ON() in blk_mq_put_tag() Since the if condition in blk_mq_put_tag() checks that the tag to put is not a reserved one, the BUG_ON() check in the else branch checking if the tag is indeed a reserved one is useless. Remove it. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20220602075159.1273366-1-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit b6d9014a3335194590abdd2a2471ef5147a67645 Author: Pablo Neira Ayuso Date: Mon May 30 18:40:06 2022 +0200 netfilter: nf_tables: delete flowtable hooks via transaction list Remove inactive bool field in nft_hook object that was introduced in abadb2f865d7 ("netfilter: nf_tables: delete devices from flowtable"). Move stale flowtable hooks to transaction list instead. Deleting twice the same device does not result in ENOENT. Fixes: abadb2f865d7 ("netfilter: nf_tables: delete devices from flowtable") Signed-off-by: Pablo Neira Ayuso commit c9fdf7b453874e37ff4c499140ba2ab56fa0c7e5 Merge: a1a2d8f0162b2 cbf84dbf0600b Author: Jens Axboe Date: Thu Jun 2 01:48:35 2022 -0600 Merge tag 'nvme-5.19-2022-06-02' of git://git.infradead.org/nvme into for-5.19/drivers Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.19 - set controller enable bit in a separate write (Niklas Cassel) - disable namespace identifiers for the MAXIO MAP1001 (me) - fix a comment typo (Julia Lawall)" * tag 'nvme-5.19-2022-06-02' of git://git.infradead.org/nvme: nvmet: fix typo in comment nvme: set controller enable bit in a separate write nvme-pci: disable namespace identifiers for the MAXIO MAP1001 commit 7bb8a0cf49d5fede1104afdcb43bd2f8a1df3253 Author: Uwe Kleine-König Date: Mon May 23 10:39:47 2022 +0200 gpio: adp5588: Remove support for platform setup and teardown callbacks If the teardown callback failed in the gpio driver, it fails to free the irq (if there is one). The device is removed anyhow. If later on the irq triggers, all sorts of unpleasant things might happen (e.g. accessing the struct adp5588_gpio which is already freed in the meantime or starting i2c bus transfers for an unregistered device). Even before irq support was added to this driver, exiting early was wrong; back then it failed to unregister the gpiochip. Fortunately these callbacks aren't used any more since at least blackfin was removed in 2018. So just drop them. Note that they are not removed from struct adp5588_gpio_platform_data because the keyboard driver adp5588-keys.c also makes use of them. (I didn't check if the callbacks might have been called twice, maybe there is another reason hidden to better not call these functions.) This patch is a preparation for making i2c remove callbacks return void. Fixes: 80884094e344 ("gpio: adp5588-gpio: new driver for ADP5588 GPIO expanders") Signed-off-by: Uwe Kleine-König Reviewed-by: Linus Walleij Acked-by: Michael Hennerich Signed-off-by: Bartosz Golaszewski commit 9cae36a094e7e9d6e5fe8b6dcd4642138b3eb0c7 Author: Jens Axboe Date: Wed Jun 1 23:57:02 2022 -0600 io_uring: reinstate the inflight tracking After some debugging, it was realized that we really do still need the old inflight tracking for any file type that has io_uring_fops assigned. If we don't, then trivial circular references will mean that we never get the ctx cleaned up and hence it'll leak. Just bring back the inflight tracking, which then also means we can eliminate the conditional dropping of the file when task_work is queued. Fixes: d5361233e9ab ("io_uring: drop the old style inflight file tracking") Signed-off-by: Jens Axboe commit 9eb2e45d097c0b951d76d9c6625f248f54e8c7ff Author: Masahiro Yamada Date: Thu May 12 03:44:08 2022 +0900 riscv: move errata/ and kvm/ builds to arch/riscv/Kbuild Commit 909548d6c578 ("riscv: add arch/riscv/Kbuild") intended that subdirectories in arch/riscv/ would be added in arch/riscv/Kbuild. Signed-off-by: Masahiro Yamada Reviewed-by: Anup Patel Signed-off-by: Palmer Dabbelt commit e15db62bc5648ab459a570862f654e787c498faf Author: Christoph Hellwig Date: Wed Jun 1 20:49:39 2022 +0200 swiotlb: fix setting ->force_bounce The swiotlb_init refactor messed up assigning ->force_bounce by doing it in different places based on what caused the setting of the flag. Fix this by passing the SWIOTLB_* flags to swiotlb_init_io_tlb_mem and just setting it there. Fixes: c6af2aa9ffc9 ("swiotlb: make the swiotlb_init interface more useful") Reported-by: Nathan Chancellor Signed-off-by: Christoph Hellwig Tested-by: Nathan Chancellor commit e19f8fa6ce1ca9b8b934ba7d2e8f34c95abc6e60 Author: Rob Clark Date: Wed Jun 1 07:51:16 2022 -0700 dma-debug: make things less spammy under memory pressure Limit the error msg to avoid flooding the console. If you have a lot of threads hitting this at once, they could have already gotten passed the dma_debug_disabled() check before they get to the point of allocation failure, resulting in quite a lot of this error message spamming the log. Use pr_err_once() to limit that. Signed-off-by: Rob Clark Signed-off-by: Christoph Hellwig commit e61bf5c071148c80d091f8e7220b3b9130780ae3 Author: Xianting Tian Date: Wed May 18 09:34:28 2022 +0800 RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY Commit 00ab027a3b82 ("RISC-V: Add kernel image sections to the resource tree") marked IORESOURCE_BUSY for reserved memory, which caused resource map failed in subsequent operations of related driver, so remove the IORESOURCE_BUSY flag. In order to prohibit userland mapping reserved memory, mark IORESOURCE_EXCLUSIVE for it. The code to reproduce the issue, dts: mem0: memory@a0000000 { reg = <0x0 0xa0000000 0 0x1000000>; no-map; }; &test { status = "okay"; memory-region = <&mem0>; }; code: np = of_parse_phandle(pdev->dev.of_node, "memory-region", 0); ret = of_address_to_resource(np, 0, &r); base = devm_ioremap_resource(&pdev->dev, &r); // base = -EBUSY Fixes: 00ab027a3b82 ("RISC-V: Add kernel image sections to the resource tree") Reported-by: Huaming Jiang Reviewed-by: Guo Ren Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Co-developed-by: Nick Kossifidis Signed-off-by: Xianting Tian Link: https://lore.kernel.org/r/20220518013428.1338983-1-xianting.tian@linux.alibaba.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 02d88b40cb2e9614e0117c3385afdce878f0d377 Author: Tobias Klauser Date: Thu May 5 10:18:15 2022 +0200 riscv: Wire up memfd_secret in UAPI header Move the __ARCH_WANT_MEMFD_SECRET define added in commit 7bb7f2ac24a0 ("arch, mm: wire up memfd_secret system call where relevant") to so __NR_memfd_secret is defined when including in userspace. This allows the memfd_secret selftest to pass on riscv. Signed-off-by: Tobias Klauser Link: https://lore.kernel.org/r/20220505081815.22808-1-tklauser@distanz.ch Fixes: 7bb7f2ac24a0 ("arch, mm: wire up memfd_secret system call where relevant") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 2273272823db6f67d57761df8116ae32e7f05bed Author: Samuel Holland Date: Fri Apr 29 22:00:23 2022 -0500 riscv: Fix irq_work when SMP is disabled irq_work is triggered via an IPI, but the IPI infrastructure is not included in uniprocessor kernels. As a result, irq_work never runs. Fall back to the tick-based irq_work implementation on uniprocessor configurations. Fixes: 298447928bb1 ("riscv: Support irq_work via self IPIs") Signed-off-by: Samuel Holland Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220430030025.58405-1-samuel@sholland.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 26b8f69edda85a7942fa580360690c2d5c74f765 Author: Alexandre Ghiti Date: Mon Dec 6 11:46:54 2021 +0100 riscv: Improve virtual kernel memory layout dump With the arrival of sv48 and its large address space, it would be cumbersome to statically define the unit size to use to print the different portions of the virtual memory layout: instead, determine it dynamically. Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 35d33c76d68dfacc330a8eb477b51cc647c5a847 Author: Alexandre Ghiti Date: Mon Dec 6 11:46:56 2021 +0100 riscv: Initialize thread pointer before calling C functions Because of the stack canary feature that reads from the current task structure the stack canary value, the thread pointer register "tp" must be set before calling any C function from head.S: by chance, setup_vm and all the functions that it calls does not seem to be part of the functions where the canary check is done, but in the following commits, some functions will. Fixes: f2c9699f65557a31 ("riscv: Add STACKPROTECTOR supported") Signed-off-by: Alexandre Ghiti Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 096c956b0d7a4a51b31ffabc1a7398a479d59307 Author: Steve French Date: Wed Jun 1 23:23:09 2022 -0500 cifs: update internal module number To 2.37 Signed-off-by: Steve French commit 9d19f2b5256ef6cdd4947b48fab4032d0060e916 Author: Alexandre Ghiti Date: Mon Dec 6 11:46:55 2021 +0100 Documentation: riscv: Add sv48 description to VM layout sv48 was just introduced, so add its virtual memory layout to the documentation. Signed-off-by: Alexandre Ghiti Signed-off-by: Palmer Dabbelt commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 Author: Steve French Date: Wed Jun 1 22:08:46 2022 -0500 cifs: version operations for smb20 unneeded when legacy support disabled We should not be including unused smb20 specific code when legacy support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned off). For example smb2_operations and smb2_values aren't used in that case. Over time we can move more and more SMB1/CIFS and SMB2.0 code into the insecure legacy ifdefs Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 387ba9bf4cb80277fb01a7b753da611ab1260a1a Author: Steve French Date: Wed Jun 1 21:25:43 2022 -0500 cifs: do not build smb1ops if legacy support is disabled We should not be including unused SMB1/CIFS functions when legacy support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned off), but especially obvious is not needing to build smb1ops.c at all when legacy support is disabled. Over time we can move more SMB1/CIFS and SMB2.0 legacy functions into ifdefs but this is a good start (and shrinks the module size a few percent). Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit aa2a4ded05058f134a4dee1424f829d662e00cda Author: Gleb Chesnokov Date: Mon May 23 09:24:59 2022 +0000 scsi: qla2xxx: Remove unused 'ql_dm_tgt_ex_pct' parameter The ql_dm_tgt_ex_pct parameter was introduced in commit ead038556f64 ("qla2xxx: Add Dual mode support in the driver"). Then the use of this parameter was dropped in commit 99e1b683c4be ("scsi: qla2xxx: Add ql2xiniexchg parameter"). Thus, remove ql_dm_tgt_ex_pct since it is no longer used. Link: https://lore.kernel.org/r/AM9PR10MB41185ADE95B92B4E6926BE639DD49@AM9PR10MB4118.EURPRD10.PROD.OUTLOOK.COM Reviewed-by: Himanshu Madhani Signed-off-by: Gleb Chesnokov Signed-off-by: Martin K. Petersen commit e250bd2699e0e7418cd54ea2a762acfcfad43ffd Author: Tom Rix Date: Sat May 21 16:16:07 2022 -0400 scsi: qla2xxx: Remove setting of 'req' and 'rsp' parameters cppcheck reports [drivers/scsi/qla2xxx/qla_mid.c:594]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [drivers/scsi/qla2xxx/qla_mid.c:620]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? The functions qla25xx_free_req_que() and qla25xx_free_rsp_que() are similar. They free a 'req' and a 'rsp' parameter respectively. The last statement of both functions is setting the parameter to NULL. This has no effect and can be removed. Link: https://lore.kernel.org/r/20220521201607.4145298-1-trix@redhat.com Reviewed-by: Himanshu Madhani Signed-off-by: Tom Rix Signed-off-by: Martin K. Petersen commit 1fcbe4c490396c5a0d4588cfb84923ad6076b62a Author: Jiapeng Chong Date: Wed May 25 17:35:14 2022 +0800 scsi: mpi3mr: Fix kernel-doc Fix the following W=1 kernel warnings: drivers/scsi/mpi3mr/mpi3mr_app.c:1706: warning: expecting prototype for adapter_state_show(). Prototype was for adp_state_show() instead. Link: https://lore.kernel.org/r/20220525093514.55467-1-jiapeng.chong@linux.alibaba.com Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Martin K. Petersen commit a5b168efba215229465d9a1a0e77b83073c7bfd0 Author: Bradley Grove Date: Tue May 24 08:56:21 2022 -0400 scsi: lpfc: Add support for ATTO Fibre Channel devices Update pci_device_id table and generate reporting strings for ATTO Celerity and ThunderLink Fibre Channel devices. Link: https://lore.kernel.org/r/20220524125621.47102-1-bgrove@attotech.com Reviewed-by: Hannes Reinecke Reviewed-by: James Smart Co-developed-by: Jason Seba Signed-off-by: Jason Seba Signed-off-by: Bradley Grove Signed-off-by: Martin K. Petersen commit b3bc1a88b534b3ef880a5124f3db45c149e601ee Author: Hannes Reinecke Date: Tue May 24 07:56:31 2022 +0200 scsi: core: Return BLK_STS_TRANSPORT for ALUA transitioning When the 'ALUA state transitioning' sense code is returned we cannot use BLK_STS_AGAIN, as this has a very specific use-case. So return BLK_STS_TRANSPORT here. Link: https://lore.kernel.org/r/20220524055631.85480-3-hare@suse.de Reviewed-by: Chaitanya Kulkarni Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 30c4fdc3dcdd1f08876300711778d8b680d54b36 Author: Damien Le Moal Date: Wed Jun 1 15:25:44 2022 +0900 scsi: sd_zbc: Prevent zone information memory leak Make sure to always free a scsi disk zone information, even for regular disks. This ensures that there is no memory leak, even in the case of a zoned disk changing type to a regular disk (e.g. with a reformat using the FORMAT WITH PRESET command or other vendor proprietary command). To do this, rename sd_zbc_clear_zone_info() to sd_zbc_free_zone_info() and remove sd_zbc_release_disk(). A call to sd_zbc_free_zone_info() is added to sd_zbc_read_zones() for drives for which sd_is_zoned() returns false. Furthermore, sd_zbc_free_zone_info() code make s sure that the sdkp rev_mutex is never used while not being initialized by gating the cleanup code with a a check on the zone_wp_update_buf field as it is never NULL when rev_mutex has been initialized. Link: https://lore.kernel.org/r/20220601062544.905141-3-damien.lemoal@opensource.wdc.com Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 05fbde3a77a4f1d62e4c4428f384288c1f1a0be5 Author: Damien Le Moal Date: Wed Jun 1 15:25:43 2022 +0900 scsi: sd: Fix potential NULL pointer dereference If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference when sd_is_zoned() is called inside that function. Avoid this by removing the call to sd_zbc_release_disk() in sd_probe() error path. This change is safe and does not result in zone information memory leakage because the zone information for a zoned disk is allocated only when sd_revalidate_disk() is called, at which point sdkp->disk_dev is fully set, resulting in sd_disk_release() being called when needed to cleanup a disk zone information using sd_zbc_release_disk(). Link: https://lore.kernel.org/r/20220601062544.905141-2-damien.lemoal@opensource.wdc.com Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Reported-by: Dongliang Mu Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 4094981db7b6ed6ebe3ebe398d8d9136ac5c44c8 Author: Sumit Saxena Date: Thu May 26 13:01:57 2022 -0400 scsi: mpi3mr: Rework mrioc->bsg_device model to fix warnings During driver unload, mrioc->bsg_device reference count becomes negative. Also, as reported in [1], the driver's bsg_device model had few more bugs. Fix all these up. [1] https://marc.info/?l=linux-scsi&m=165183971411991&w=2 Link: https://lore.kernel.org/r/20220526170157.58274-1-sumit.saxena@broadcom.com Fixes: 4268fa751365 ("scsi: mpi3mr: Add bsg device support") Reported-by: Dan Carpenter Tested-by: Tomas Henzl Signed-off-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit 77d707a310fa908d796d00e6c26b650cf2b4442f Author: Palmer Dabbelt Date: Thu Apr 21 10:03:55 2022 -0700 RISC-V: Only default to spinwait on SBI-0.1 and M-mode The spinwait boot method has been superseded by the SBI HSM extension for some time now, but it still enabled by default. This causes some issues on large hart count systems, which will hang if a physical hart exists that is larger than NR_CPUS. Users on modern SBI implementation don't need spinwait, and while it's probably possible to deal with some of the spinwait issues let's just restrict the default to systems that are likely to actually use it. Signed-off-by: Palmer Dabbelt Reviewed-by: Atish Patra Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20220421170354.10555-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 2981deb83de2b94947086a992b961b2339988a71 Merge: 35b51afd23c98 df403b7c95aaa Author: Palmer Dabbelt Date: Wed Jun 1 18:34:02 2022 -0700 RISC-V: PolarFire SoC Device Tree Updates This add a device tree for Sundance Polarberry, along with various cleanups to the PolarFire SOC device trees and bindings. Link: https://lore.kernel.org/r/20220509142610.128590-1-conor.dooley@microchip.com * 'riscv-pfsoc-dt' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/palmer/linux: riscv: dts: icicle: sort nodes alphabetically riscv: microchip: icicle: readability fixes riscv: dts: microchip: add the sundance polarberry dt-bindings: riscv: microchip: add polarberry compatible string dt-bindings: vendor-prefixes: add Sundance DSP riscv: dts: microchip: make the fabric dtsi board specific dt-bindings: riscv: microchip: document icicle reference design riscv: dts: microchip: remove soc vendor from filenames riscv: dts: microchip: move sysctrlr out of soc bus riscv: dts: microchip: remove icicle memory clocks commit d1dc87763f406d4e67caf16dbe438a5647692395 Author: Stephen Brennan Date: Thu May 19 09:50:30 2022 +0100 assoc_array: Fix BUG_ON during garbage collect A rare BUG_ON triggered in assoc_array_gc: [3430308.818153] kernel BUG at lib/assoc_array.c:1609! Which corresponded to the statement currently at line 1593 upstream: BUG_ON(assoc_array_ptr_is_meta(p)); Using the data from the core dump, I was able to generate a userspace reproducer[1] and determine the cause of the bug. [1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc After running the iterator on the entire branch, an internal tree node looked like the following: NODE (nr_leaves_on_branch: 3) SLOT [0] NODE (2 leaves) SLOT [1] NODE (1 leaf) SLOT [2..f] NODE (empty) In the userspace reproducer, the pr_devel output when compressing this node was: -- compress node 0x5607cc089380 -- free=0, leaves=0 [0] retain node 2/1 [nx 0] [1] fold node 1/1 [nx 0] [2] fold node 0/1 [nx 2] [3] fold node 0/2 [nx 2] [4] fold node 0/3 [nx 2] [5] fold node 0/4 [nx 2] [6] fold node 0/5 [nx 2] [7] fold node 0/6 [nx 2] [8] fold node 0/7 [nx 2] [9] fold node 0/8 [nx 2] [10] fold node 0/9 [nx 2] [11] fold node 0/10 [nx 2] [12] fold node 0/11 [nx 2] [13] fold node 0/12 [nx 2] [14] fold node 0/13 [nx 2] [15] fold node 0/14 [nx 2] after: 3 At slot 0, an internal node with 2 leaves could not be folded into the node, because there was only one available slot (slot 0). Thus, the internal node was retained. At slot 1, the node had one leaf, and was able to be folded in successfully. The remaining nodes had no leaves, and so were removed. By the end of the compression stage, there were 14 free slots, and only 3 leaf nodes. The tree was ascended and then its parent node was compressed. When this node was seen, it could not be folded, due to the internal node it contained. The invariant for compression in this function is: whenever nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all leaf nodes. The compression step currently cannot guarantee this, given the corner case shown above. To fix this issue, retry compression whenever we have retained a node, and yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second compression will then allow the node in slot 1 to be folded in, satisfying the invariant. Below is the output of the reproducer once the fix is applied: -- compress node 0x560e9c562380 -- free=0, leaves=0 [0] retain node 2/1 [nx 0] [1] fold node 1/1 [nx 0] [2] fold node 0/1 [nx 2] [3] fold node 0/2 [nx 2] [4] fold node 0/3 [nx 2] [5] fold node 0/4 [nx 2] [6] fold node 0/5 [nx 2] [7] fold node 0/6 [nx 2] [8] fold node 0/7 [nx 2] [9] fold node 0/8 [nx 2] [10] fold node 0/9 [nx 2] [11] fold node 0/10 [nx 2] [12] fold node 0/11 [nx 2] [13] fold node 0/12 [nx 2] [14] fold node 0/13 [nx 2] [15] fold node 0/14 [nx 2] internal nodes remain despite enough space, retrying -- compress node 0x560e9c562380 -- free=14, leaves=1 [0] fold node 2/15 [nx 0] after: 3 Changes ======= DH: - Use false instead of 0. - Reorder the inserted lines in a couple of places to put retained before next_slot. ver #2) - Fix typo in pr_devel, correct comparison to "<=" Fixes: 3cb989501c26 ("Add a generic associative array implementation.") Cc: Signed-off-by: Stephen Brennan Signed-off-by: David Howells cc: Andrew Morton cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@oracle.com/ # v1 Link: https://lore.kernel.org/r/20220512215045.489140-1-stephen.s.brennan@oracle.com/ # v2 Reviewed-by: Jarkko Sakkinen Signed-off-by: Linus Torvalds commit 9f4fc18bf285f20c1498f8fcfb586fa70a070fb5 Author: Slark Xiao Date: Wed Jun 1 12:05:31 2022 +0800 net: usb: qmi_wwan: Add support for Cinterion MV31 with new baseline Adding support for Cinterion device MV31 with Qualcomm new baseline. Use different PIDs to separate it from previous base line products. All interfaces settings keep same as previous. T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00b9 Rev=04.14 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00B9 USB Mobile Broadband S: SerialNumber=90418e79 C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option Signed-off-by: Slark Xiao Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/20220601040531.6016-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit c034ff2b53cf5add27c121d536864a00f0257700 Merge: 11049c9e71f38 1c5de097bea31 Author: Jakub Kicinski Date: Wed Jun 1 18:04:40 2022 -0700 Merge tag 'mlx5-fixes-2022-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2022-05-31 This series provides bug fixes to mlx5 driver. Please pull and let me know if there is any problem. * tag 'mlx5-fixes-2022-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Fix mlx5_get_next_dev() peer device matching net/mlx5e: Update netdev features after changing XDP state net/mlx5: correct ECE offset in query qp output net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition net/mlx5: CT: Fix header-rewrite re-use for tupels net/mlx5e: TC NIC mode, fix tc chains miss table net/mlx5: Don't use already freed action pointer ==================== Link: https://lore.kernel.org/r/20220531205447.99236-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 11049c9e71f38416f5b5d31ac2c51ac08c394698 Merge: 2440d2068a751 25bde571b4a83 Author: Jakub Kicinski Date: Wed Jun 1 17:47:19 2022 -0700 Merge branch 'sfc-siena-fix-some-efx_separate_tx_channels-errors' Íñigo Huguet says: ==================== sfc/siena: fix some efx_separate_tx_channels errors Trying to load sfc driver with modparam efx_separate_tx_channels=1 resulted in errors during initialization and not being able to use the NIC. This patches fix a few bugs and make it work again. This has been already done for sfc, do it also for sfc_siena. ==================== Link: https://lore.kernel.org/r/20220601063603.15362-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 25bde571b4a83a73bb37beacb833bbd9c38b43c6 Author: Íñigo Huguet Date: Wed Jun 1 08:36:03 2022 +0200 sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels tx_channel_offset is calculated in efx_allocate_msix_channels, but it is also calculated again in efx_set_channels because it was originally done there, and when efx_allocate_msix_channels was introduced it was forgotten to be removed from efx_set_channels. Moreover, the old calculation is wrong when using efx_separate_tx_channels because now we can have XDP channels after the TX channels, so n_channels - n_tx_channels doesn't point to the first TX channel. Remove the old calculation from efx_set_channels, and add the initialization of this variable if MSI or legacy interrupts are used, next to the initialization of the rest of the related variables, where it was missing. This has been already done for sfc, do it also for sfc_siena. Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Acked-by: Martin Habets Signed-off-by: Jakub Kicinski commit 183614bff5fc1682240ab7604201e18afb118092 Author: Martin Habets Date: Wed Jun 1 08:36:02 2022 +0200 sfc/siena: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efx_separate_tx_channels=1 is used. In that cases, some channels only have RX queues and others only TX queues (or more preciselly, they have them allocated, but not initialized). Fix efx_channel_has_tx_queues to return the correct value for this case too. This has been already done for sfc, do it also for sfc_siena. Messages shown at probe time before the fix: sfc 0000:03:00.0 ens6f0np0: MC command 0x82 inlen 544 failed rc=-22 (raw=0) arg=0 ------------[ cut here ]------------ netdevice: ens6f0np0: failed to initialise TXQ -1 WARNING: CPU: 1 PID: 626 at drivers/net/ethernet/sfc/ef10.c:2393 efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped RIP: 0010:efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped Call Trace: efx_init_tx_queue+0xaa/0xf0 [sfc] efx_start_channels+0x49/0x120 [sfc] efx_start_all+0x1f8/0x430 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xd0/0x190 __dev_change_flags+0x1b3/0x220 dev_change_flags+0x21/0x60 [...] stripped Messages shown at remove time before the fix: sfc 0000:03:00.0 ens6f0np0: failed to flush 10 queues sfc 0000:03:00.0 ens6f0np0: failed to flush queues Fixes: 8700aff08984 ("sfc: fix channel allocation with brute force") Reported-by: Tianhao Zhao Signed-off-by: Martin Habets Tested-by: Íñigo Huguet Signed-off-by: Jakub Kicinski commit 2440d2068a7517f60003b0e12e5fadcebd14cda3 Merge: 38a4762e4ba61 6821ad8770340 Author: Jakub Kicinski Date: Wed Jun 1 17:44:03 2022 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== ipsec 2022-06-01 1) Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" From Michal Kubecek. 2) Don't set IPv4 DF bit when encapsulating IPv6 frames below 1280 bytes. From Maciej Żenczykowski. * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: do not set IPv4 DF flag when encapsulating IPv6 frames <= 1280 bytes. Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" ==================== Link: https://lore.kernel.org/r/20220601103349.2297361-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 38a4762e4ba61e848c61a3b9eaa8f83cbed07b2d Merge: 8d3398ba2a0d1 2965c4cdf7ad9 Author: Jakub Kicinski Date: Wed Jun 1 17:34:22 2022 -0700 Merge tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v5.19 First set of fixes for v5.19. Build fixes for iwlwifi and libertas, a scheduling while atomic fix for rtw88 and use-after-free fix for mac80211. * tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix use-after-free in chanctx code wifi: rtw88: add a work to correct atomic scheduling warning of ::set_tim wifi: iwlwifi: pcie: rename CAUSE macro wifi: libertas: use variable-size data in assoc req/resp cmd ==================== Link: https://lore.kernel.org/r/20220601110741.90B28C385A5@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 0e5ab8dd87c29640a46aee9e38bc3ba7645b1db0 Merge: 54eb8462f21fb 7146bda743e6f Author: Linus Torvalds Date: Wed Jun 1 17:23:53 2022 -0700 Merge tag 'xfs-5.19-for-linus-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull more xfs updates from Dave Chinner: "This update is largely bug fixes and cleanups for all the code merged in the first pull request. The majority of them are to the new logged attribute code, but there are also a couple of fixes for other log recovery and memory leaks that have recently been found. Summary: - fix refcount leak in xfs_ifree() - fix xfs_buf_cancel structure leaks in log recovery - fix dquot leak after failed quota check - fix a couple of problematic ASSERTS - fix small aim7 perf regression in from new btree sibling validation - clean up log incompat feature marking for new logged attribute feature - disallow logged attributes on legacy V4 filesystem formats. - fix da state leak when freeing attr intents - improve validation of the attr log items in recovery - use slab caches for commonly used attr structures - fix leaks of attr name/value buffer and reduce copying overhead during intent logging - remove some dead debug code from log recovery" * tag 'xfs-5.19-for-linus-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (33 commits) xfs: fix xfs_ifree() error handling to not leak perag ref xfs: move xfs_attr_use_log_assist usage out of libxfs xfs: move xfs_attr_use_log_assist out of xfs_log.c xfs: warn about LARP once per mount xfs: implement per-mount warnings for scrub and shrink usage xfs: don't log every time we clear the log incompat flags xfs: convert buf_cancel_table allocation to kmalloc_array xfs: don't leak xfs_buf_cancel structures when recovery fails xfs: refactor buffer cancellation table allocation xfs: don't leak btree cursor when insrec fails after a split xfs: purge dquots after inode walk fails during quotacheck xfs: assert in xfs_btree_del_cursor should take into account error xfs: don't assert fail on perag references on teardown xfs: avoid unnecessary runtime sibling pointer endian conversions xfs: share xattr name and value buffers when logging xattr updates xfs: do not use logged xattr updates on V4 filesystems xfs: Remove duplicate include xfs: reduce IOCB_NOWAIT judgment for retry exclusive unaligned DIO xfs: Remove dead code xfs: fix typo in comment ... commit 036d20726c30267724416e966c9f92db07de8081 Author: Rob Clark Date: Tue May 31 13:08:56 2022 -0700 drm/msm: Ensure mmap offset is initialized If a GEM object is allocated, and then exported as a dma-buf fd which is mmap'd before or without the GEM buffer being directly mmap'd, the vma_node could be unitialized. This leads to a situation where the CPU mapping is not correctly torn down in drm_vma_node_unmap(). Fixes: e5516553999f ("drm: call drm_gem_object_funcs.mmap with fake offset") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220531200857.136547-1-robdclark@gmail.com commit af0f2a8cc3977e08e79a096f0c2c7a5be29b130b Merge: 1a5409facf9ce b9364eed9232f Author: Rob Clark Date: Wed Jun 1 17:12:50 2022 -0700 Merge tag 'msm-next-5.19-fixes-06-01' of https://gitlab.freedesktop.org/abhinavk/msm into msm-fixes-staging 5.19 fixes for msm-next - Fix to add minimum ICC vote in the msm_mdss pm_resume path to address bootup splats - Fix to avoid dereferencing without checking in WB encoder - Fix to avoid crash during suspend in DP driver by ensuring interrupt mask bits are updated - Remove unused code from dpu_encoder_virt_atomic_check() - Fix to remove redundant init of dsc variable Signed-off-by: Rob Clark commit 8d3398ba2a0d1e25690f830192b7834acab003ec Author: Tobias Klauser Date: Tue May 31 11:43:45 2022 +0200 socket: Don't use u8 type in uapi socket.h Use plain 255 instead, which also avoid introducing an additional header dependency on Fixes: 26859240e4ee ("txhash: Add socket option to control TX hash rethink behavior") Signed-off-by: Tobias Klauser Link: https://lore.kernel.org/r/20220531094345.13801-1-tklauser@distanz.ch Signed-off-by: Jakub Kicinski commit b9364eed9232f3d2a846f68c2307eb25c93cc2d0 Author: Douglas Anderson Date: Tue May 31 16:01:26 2022 -0700 drm/msm/dpu: Move min BW request and full BW disable back to mdss In commit a670ff578f1f ("drm/msm/dpu: always use mdp device to scale bandwidth") we fully moved interconnect stuff to the DPU driver. This had no change for sc7180 but _did_ have an impact for other SoCs. It made them match the sc7180 scheme. Unfortunately, the sc7180 scheme seems like it was a bit broken. Specifically the interconnect needs to be on for more than just the DPU driver's AXI bus. In the very least it also needs to be on for the DSI driver's AXI bus. This can be seen fairly easily by doing this on a ChromeOS sc7180-trogdor class device: set_power_policy --ac_screen_dim_delay=5 --ac_screen_off_delay=10 sleep 10 cd /sys/bus/platform/devices/ae94000.dsi/power echo on > control When you do that, you'll get a warning splat in the logs about "gcc_disp_hf_axi_clk status stuck at 'off'". One could argue that perhaps what I have done above is "illegal" and that it can't happen naturally in the system because in normal system usage the DPU is pretty much always on when DSI is on. That being said: * In official ChromeOS builds (admittedly a 5.4 kernel with backports) we have seen that splat at bootup. * Even though we don't use "autosuspend" for these components, we don't use the "put_sync" variants. Thus plausibly the DSI could stay "runtime enabled" past when the DPU is enabled. Techncially we shouldn't do that if the DPU's suspend ends up yanking our clock. Let's change things such that the "bare minimum" request for the interconnect happens in the mdss driver again. That means that all of the children can assume that the interconnect is on at the minimum bandwidth. We'll then let the DPU request the higher amount that it wants. It should be noted that this isn't as hacky of a solution as it might initially appear. Specifically: * Since MDSS and DPU individually get their own references to the interconnect then the framework will actually handle aggregating them. The two drivers are _not_ clobbering each other. * When the Qualcomm interconnect driver aggregates it takes the max of all the peaks. Thus having MDSS request a peak, as we're doing here, won't actually change the total interconnect bandwidth (it won't be added to the request for the DPU). This perhaps explains why the "average" requested in MDSS was historically 0 since that one _would_ be added in. NOTE also that in the downstream ChromeOS 5.4 and 5.15 kernels, we're also seeing some RPMH hangs that are addressed by this fix. These hangs are showing up in the field and on _some_ devices with enough stress testing of suspend/resume. Specifically right at suspend time with a stack crawl that looks like this (from chromeos-5.15 tree): rpmh_write_batch+0x19c/0x240 qcom_icc_bcm_voter_commit+0x210/0x420 qcom_icc_set+0x28/0x38 apply_constraints+0x70/0xa4 icc_set_bw+0x150/0x24c dpu_runtime_resume+0x50/0x1c4 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x12c/0x20c __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x370/0x4a0 __pm_runtime_resume+0x80/0xb0 dpu_kms_enable_commit+0x24/0x30 msm_atomic_commit_tail+0x12c/0x630 commit_tail+0xac/0x150 drm_atomic_helper_commit+0x114/0x11c drm_atomic_commit+0x68/0x78 drm_atomic_helper_disable_all+0x158/0x1c8 drm_atomic_helper_suspend+0xc0/0x1c0 drm_mode_config_helper_suspend+0x2c/0x60 msm_pm_prepare+0x2c/0x40 pm_generic_prepare+0x30/0x44 genpd_prepare+0x80/0xd0 device_prepare+0x78/0x17c dpm_prepare+0xb0/0x384 dpm_suspend_start+0x34/0xc0 We don't completely understand all the mechanisms in play, but the hang seemed to come and go with random factors. It's not terribly surprising that the hang is gone after this patch since the line of code that was failing is no longer present in the kernel. Fixes: a670ff578f1f ("drm/msm/dpu: always use mdp device to scale bandwidth") Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display") Signed-off-by: Douglas Anderson Reviewed-by: Abhinav Kumar Tested-by: Jessica Zhang # RB3 (sdm845) and Reviewed-by: Stephen Boyd Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/487884/ Link: https://lore.kernel.org/r/20220531160059.v2.1.Ie7f6d4bf8cce28131da31a43354727e417cae98d@changeid Signed-off-by: Abhinav Kumar commit 8caad14e722477807e9324fe0e85dd10151fb134 Author: Haowen Bai Date: Mon May 30 10:19:55 2022 +0800 drm/msm/dpu: Fix pointer dereferenced before checking The phys_enc->wb_idx is dereferencing before null checking, so move it after checking. Signed-off-by: Haowen Bai Reviewed-by: Dmitry Baryshkov Fixes: d7d0e73f7de33 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/487606/ Link: https://lore.kernel.org/r/1653877196-23114-1-git-send-email-baihaowen@meizu.com Signed-off-by: Abhinav Kumar commit fb0af2daaa04d69b9e66613b8721d23d41f387f6 Author: Jiapeng Chong Date: Tue May 24 16:14:13 2022 +0800 drm/msm/dpu: Remove unused code Eliminate the follow clang warning: drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:544:33: warning: variable ‘mode’ set but not used [-Wunused-but-set-variable]. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Fixes: 3177589c6e93("drm/msm/dpu: encoder: drop unused mode_fixup callback") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/487136/ Link: https://lore.kernel.org/r/20220524081413.37895-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Abhinav Kumar commit 6daf7e4aa91e05b3e138805613686fb5c46d8196 Author: Vinod Koul Date: Wed May 25 13:09:12 2022 +0530 drm/msm/disp/dpu1: remove superfluous init Commit 58dca9810749 ("drm/msm/disp/dpu1: Add support for DSC in encoder") added dsc_common_mode variable which was set to zero but then again programmed, so drop the superfluous init. Fixes: 58dca9810749 ("drm/msm/disp/dpu1: Add support for DSC in encoder") Reported-by: kernel test robot Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Signed-off-by: Vinod Koul Patchwork: https://patchwork.freedesktop.org/patch/487208/ Link: https://lore.kernel.org/r/20220525073912.2706505-1-vkoul@kernel.org Signed-off-by: Abhinav Kumar commit 993a2adc6e2e94a0a7b5bfc054eda90ac95f62c3 Author: Kuogee Hsieh Date: Tue May 17 09:21:34 2022 -0700 drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl() dp_catalog_ctrl_reset() will software reset DP controller. But it will not reset programmable registers to default value. DP driver still have to clear mask bits to interrupt status registers to disable interrupts after software reset of controller. At current implementation, dp_ctrl_reset_irq_ctrl() will software reset dp controller but did not call dp_catalog_ctrl_enable_irq(false) to clear hpd related interrupt mask bits to disable hpd related interrupts due to it mistakenly think hpd related interrupt mask bits will be cleared by software reset of dp controller automatically. This mistake may cause system to crash during suspending procedure due to unexpected irq fired and trigger event thread to access dp controller registers with controller clocks are disabled. This patch fixes system crash during suspending problem by removing "enable" flag condition checking at dp_ctrl_reset_irq_ctrl() so that hpd related interrupt mask bits are cleared to prevent unexpected from happening. Changes in v2: -- add more details commit text Changes in v3: -- add synchrons_irq() -- add atomic_t suspended Changes in v4: -- correct Fixes's commit ID -- remove synchrons_irq() Changes in v5: -- revise commit text Changes in v6: -- add event_lock to protect "suspended" Changes in v7: -- delete "suspended" flag Fixes: 989ebe7bc446 ("drm/msm/dp: do not initialize phy until plugin interrupt received") Signed-off-by: Kuogee Hsieh Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/486591/ Link: https://lore.kernel.org/r/1652804494-19650-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Abhinav Kumar commit a19cad0691597eb79c123b8a19a9faba5ab7d90e Author: Andrew Morton Date: Wed Jun 1 15:57:16 2022 -0700 mm/oom_kill.c: fix vm_oom_kill_table[] ifdeffery arm allnoconfig: mm/oom_kill.c:60:25: warning: 'vm_oom_kill_table' defined but not used [-Wunused-variable] 60 | static struct ctl_table vm_oom_kill_table[] = { | ^~~~~~~~~~~~~~~~~ Cc: Luis Chamberlain Signed-off-by: Andrew Morton commit b3e34a47f98974d0844444c5121aaff123004e57 Author: Baoquan He Date: Wed Feb 23 19:32:24 2022 +0800 x86/kexec: fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object 0xffffc900002a9000 (size 4096): comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 ..>............. backtrace: [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170 [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160 [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0 [<0000000019afff23>] crash_load_segments+0x260/0x470 [<0000000019ebe95c>] bzImage64_load+0x814/0xad0 [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0 [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0 [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530 [<0000000087c19992>] do_syscall_64+0x3b/0x90 [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there. And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place. Three different people have reported three bugs about the memory leak on x86_64 inside Redhat. Link: https://lkml.kernel.org/r/20220223113225.63106-2-bhe@redhat.com Signed-off-by: Baoquan He Acked-by: Dave Young Cc: Signed-off-by: Andrew Morton commit a04e1928e2ead144dc2f369768bc0a0f3110af89 Author: Miaohe Lin Date: Tue May 31 20:26:43 2022 +0800 mm/memremap: fix missing call to untrack_pfn() in pagemap_range() We forget to call untrack_pfn() to pair with track_pfn_remap() when range is not allowed to hotplug. Fix it by jump err_kasan. Link: https://lkml.kernel.org/r/20220531122643.25249-1-linmiaohe@huawei.com Fixes: bca3feaa0764 ("mm/memory_hotplug: prevalidate the address range being added with platform") Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Acked-by: Muchun Song Cc: Anshuman Khandual Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 547be963c99f1e9ebc1cfabf630f64601a98dd00 Author: Zi Yan Date: Mon May 30 22:44:50 2022 -0400 mm: page_isolation: use compound_nr() correctly in isolate_single_pageblock() When compound_nr(page) was used, page was not guaranteed to be the head of the compound page and it could cause an infinite loop. Fix it by calling it on the head page. Link: https://lkml.kernel.org/r/20220531024450.2498431-1-zi.yan@sent.com Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity") Signed-off-by: Zi Yan Reported-by: Anshuman Khandual Link: https://lore.kernel.org/linux-mm/20220530115027.123341-1-anshuman.khandual@arm.com/ Reviewed-by: Anshuman Khandual Reviewed-by: Miaohe Lin Reviewed-by: Oscar Salvador Acked-by: Muchun Song Cc: David Hildenbrand Cc: Qian Cai Cc: Vlastimil Babka Cc: Mel Gorman Cc: Eric Ren Cc: Mike Rapoport Cc: Christophe Leroy Signed-off-by: Andrew Morton commit 0111def915b280c64c05f73f01b59ca404255aa3 Author: Muchun Song Date: Fri May 27 16:19:48 2022 +0800 mm: hugetlb_vmemmap: fix CONFIG_HUGETLB_PAGE_FREE_VMEMMAP_DEFAULT_ON The following: commit 47010c040dec ("mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*") forgot to update CONFIG_HUGETLB_PAGE_FREE_VMEMMAP_DEFAULT_ON used in vmemmap_optimize_mode to CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON. The result is we cannot enable hugetlb_optimize_vmemmap at boot time when we configure CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON. Fix it. Link: https://lkml.kernel.org/r/20220527081948.68832-1-songmuchun@bytedance.com Fixes: 47010c040dec ("mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*") Signed-off-by: Muchun Song Reported-by: Vlastimil Babka Acked-by: Vlastimil Babka Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 273aea955ece88a14664fa1cbff5542f05ab0a29 Author: Miaohe Lin Date: Mon May 30 19:45:05 2022 +0800 MAINTAINERS: add maintainer information for z3fold Add the maintainer information for the z3fold compressed page allocator. Also Add myself as a reviewer. Link: https://lkml.kernel.org/r/20220530114505.52367-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 1ff810c16d651547fd1781a0b8b29cab547152b2 Author: Josh Poimboeuf Date: Fri May 27 13:18:52 2022 -0700 mailmap: update Josh Poimboeuf's email I recently switched to my kernel.org email address. Add aliases for my previous Red Hat and IBM addresses. Link: https://lkml.kernel.org/r/0519dcfbb1ee2cb82cb32b0aff61410a62949aa5.1653682698.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf Suggested-by: Nick Desaulniers Signed-off-by: Andrew Morton commit 662ce1dc9caf493c309200edbe38d186f1ea20d0 Author: Yang Yang Date: Wed Jun 1 15:55:25 2022 -0700 delayacct: track delays from write-protect copy Delay accounting does not track the delay of write-protect copy. When tasks trigger many write-protect copys(include COW and unsharing of anonymous pages[1]), it may spend a amount of time waiting for them. To get the delay of tasks in write-protect copy, could help users to evaluate the impact of using KSM or fork() or GUP. Also update tools/accounting/getdelays.c: / # ./getdelays -dl -p 231 print delayacct stats ON listen forever PID 231 CPU count real total virtual total delay total delay average 6247 1859000000 2154070021 1674255063 0.268ms IO count delay total delay average 0 0 0ms SWAP count delay total delay average 0 0 0ms RECLAIM count delay total delay average 0 0 0ms THRASHING count delay total delay average 0 0 0ms COMPACT count delay total delay average 3 72758 0ms WPCOPY count delay total delay average 3635 271567604 0ms [1] commit 31cc5bc4af70("mm: support GUP-triggered unsharing of anonymous pages") Link: https://lkml.kernel.org/r/20220409014342.2505532-1-yang.yang29@zte.com.cn Signed-off-by: Yang Yang Reviewed-by: David Hildenbrand Reviewed-by: Jiang Xuexin Reviewed-by: Ran Xiaokai Reviewed-by: wangyong Cc: Jonathan Corbet Cc: Balbir Singh Cc: Mike Kravetz Cc: Stephen Rothwell Signed-off-by: Andrew Morton commit df403b7c95aaaff3689ecb254c443967badca9ac Author: Conor Dooley Date: Mon May 9 15:26:11 2022 +0100 riscv: dts: icicle: sort nodes alphabetically The icicle device tree is in a "random" order, so clean it up and sort its elements alphabetically to match the newly added PolarBerry dts. Signed-off-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220509142610.128590-11-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 1bcea0303ff32d0d1671226d77dc837eef1a93c9 Author: Conor Dooley Date: Mon May 9 15:26:10 2022 +0100 riscv: microchip: icicle: readability fixes Fix the sort order of the status properties, remove some extra whitespace in the mmc entry & add whitespace to the mac entry containing the phys so that the dt is easier to read. Signed-off-by: Conor Dooley Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220509142610.128590-10-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit bc47b2217f246ed0bf0305dd7572f76fc8a3b85c Author: Conor Dooley Date: Mon May 9 15:26:09 2022 +0100 riscv: dts: microchip: add the sundance polarberry Add a minimal device tree for the PolarFire SoC based Sundance PolarBerry. Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-9-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit b847d32ae7c3c49111e98419ef2a5a65d9e1f51f Author: Conor Dooley Date: Mon May 9 15:26:08 2022 +0100 dt-bindings: riscv: microchip: add polarberry compatible string Add a binding for the Sundance Polarberry board. Acked-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-8-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 83b8b2a464965ef40d59c61229e6bdc1844d0706 Author: Conor Dooley Date: Mon May 9 15:26:07 2022 +0100 dt-bindings: vendor-prefixes: add Sundance DSP Sundance DSP Inc. (https://www.sundancedsp.com/) is a supplier of high-performance DSP and FPGA processor boards and I/O modules. Acked-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-7-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 1277b19506f8aa88a7b78f6b1ed66749c1ecc58a Author: Conor Dooley Date: Mon May 9 15:26:06 2022 +0100 riscv: dts: microchip: make the fabric dtsi board specific Currently mpfs-fabric.dtsi is included by mpfs.dtsi - which is fine currently since there is only one board with this SoC upstream. However if another board was added, it would include the fabric contents of the Icicle Kit's reference design. To avoid this, rename mpfs-fabric.dtsi to mpfs-icicle-kit-fabric.dtsi & include it in the dts rather than mpfs.dtsi. mpfs-icicle-kit-fabric.dtsi specifically matches the 22.03 reference design for the icicle kit's FPGA fabric & an older version of the design may not have the i2c or pwm devices - so add the compatible string to document this. Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-6-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit e8c81d649abc3fa02a7063c27a42b6e214a67362 Author: Conor Dooley Date: Mon May 9 15:26:05 2022 +0100 dt-bindings: riscv: microchip: document icicle reference design Add a compatible for the icicle kit's reference design. This represents the FPGA fabric's contents & is versioned to denote which release of the reference design it applies to. Acked-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220509142610.128590-5-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit da305fa8a9a6c44a0216d7ed30b2f8e91b6aa245 Author: Conor Dooley Date: Mon May 9 15:26:04 2022 +0100 riscv: dts: microchip: remove soc vendor from filenames Having the SoC vendor both as the directory and in the filename adds little. Remove microchip from the filenames so that the files will resemble the other directories in riscv (and arm64). The new names follow a soc-board.dts & soc{,-fabric}.dtsi pattern. Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-4-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 9499e76de5d5ab46b246764f41090074f1c68cfe Author: Conor Dooley Date: Mon May 9 15:26:03 2022 +0100 riscv: dts: microchip: move sysctrlr out of soc bus The MPFS system controller has no registers of its own, so move it out of the soc node to avoid dtbs_check warnings: arch/riscv/boot/dts/microchip/microchip-mpfs-icicle-kit.dtb: soc: syscontroller: {'compatible': ['microchip,mpfs-sys-controller'], 'mboxes': [[15, 0]], 'status': ['okay']} should not be valid under {'type': 'object'} Reported-by: Palmer Dabbelt Suggested-by: Rob Herring Fixes: 528a5b1f2556 ("riscv: dts: microchip: add new peripherals to icicle kit device tree") Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-3-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 8422d1110ad445afd2083547181ff1be3a56f165 Author: Conor Dooley Date: Mon May 9 15:26:02 2022 +0100 riscv: dts: microchip: remove icicle memory clocks The clock properties in the icicle kit's memory entries cause dtbs_check errors: arch/riscv/boot/dts/microchip/microchip-mpfs-icicle-kit.dtb: /: memory@80000000: 'clocks' does not match any of the regexes: 'pinctrl-[0-9]+' Get rid of the clocks to avoid the errors. Reported-by: Palmer Dabbelt Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") Fixes: 5b28df37d311 ("riscv: dts: microchip: update peripherals in icicle kit device tree") Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220509142610.128590-2-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 54eb8462f21fb170a05ad64620f0d8d0cf2b7fb5 Merge: 55fe921790584 f78e3d407a339 Author: Linus Torvalds Date: Wed Jun 1 14:48:13 2022 -0700 Merge tag 'rtc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "A new driver represents the bulk of the changes and then we get the usual small fixes. New driver: - Renesas RZN1 rtc Drivers: - sun6i: Add nvmem support" * tag 'rtc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: mxc: Silence a clang warning rtc: rzn1: Fix a variable type rtc: rzn1: Fix error code in probe rtc: rzn1: Avoid mixing variables rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe rtc: mt6397: check return value after calling platform_get_resource() rtc: rzn1: fix platform_no_drv_owner.cocci warning rtc: gamecube: Add missing iounmap in gamecube_rtc_read_offset_from_sram rtc: meson: Fix email address in MODULE_AUTHOR rtc: simplify the return expression of rx8025_set_offset() rtc: pcf85063: Add a compatible entry for pca85073a dt-binding: pcf85063: Add an entry for pca85073a MAINTAINERS: Add myself as maintainer of the RZN1 RTC driver rtc: rzn1: Add oscillator offset support rtc: rzn1: Add alarm support rtc: rzn1: Add new RTC driver dt-bindings: rtc: rzn1: Describe the RZN1 RTC rtc: sun6i: Add NVMEM provider commit 55fe92179058406fe00bff2167c94443a7b2e07a Merge: fa78526accfd6 66ed42caf286a Author: Linus Torvalds Date: Wed Jun 1 14:44:01 2022 -0700 Merge tag 'i3c/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "Only clean ups and no functional change this cycle. A couple of yaml conversions of the DT bindings, and a couple of code cleanups" * tag 'i3c/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: MAINTAINERS: rectify entries for some i3c drivers after dt conversion i3c: master: svc: fix returnvar.cocci warning i3c/master: simplify the return expression of i3c_hci_remove() dt-bindings: i3c: Convert snps,dw-i3c-master to DT schema dt-bindings: i3c: Convert cdns,i3c-master to DT schema commit fa78526accfd68966fb50a429439e9085f9c88d6 Merge: c7993147519ca 4caae58406f8c Author: Linus Torvalds Date: Wed Jun 1 14:25:04 2022 -0700 Merge tag 'for-5.19/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM core's dm_table_supports_poll to return false if target has no data devices. - Fix DM verity target so that it cannot be switched to a different DM target type (e.g. dm-linear) via DM table reload. * tag 'for-5.19/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm verity: set DM_TARGET_IMMUTABLE feature flag dm table: fix dm_table_supports_poll to return false if no data devices commit f78e3d407a339ffdd2620140300f821ea41118f4 Author: Fabio Estevam Date: Wed May 25 22:14:59 2022 -0300 rtc: mxc: Silence a clang warning Change the of_device_get_match_data() cast to (uintptr_t) to silence the following clang warning: drivers/rtc/rtc-mxc.c:315:19: warning: cast to smaller integer type 'enum imx_rtc_type' from 'const void *' [-Wvoid-pointer-to-enum-cast] Reported-by: kernel test robot Fixes: ba7aa63000f2 ("rtc: mxc: use of_device_get_match_data") Signed-off-by: Fabio Estevam Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220526011459.1167197-1-festevam@gmail.com commit c7993147519ca970ad4af17e0eac9d683e7721b9 Merge: 96752be4d7b44 da50aad6d8671 Author: Linus Torvalds Date: Wed Jun 1 14:13:41 2022 -0700 Merge tag 'for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Not much from the power-supply subsystem this time around, since I was busy most of the cycle. This also contains some fixes that I originally planned to send for 5.18. Apart from this there is nothing noteworthy. Power-supply core: - init power_supply_info struct to zero Drivers: - bq27xxx: expose data for uncalibrated battery - bq24190-charger: use pm_runtime_resume_and_get - ab8500_fg: allocate wq in probe - axp288_fuel_gauge: drop BIOS version from 'T3 MRD' quirk - axp288_fuel_gauge: modify 'T3 MRD' quirk to also fix 'One Mix 1'" * tag 'for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync power: supply: bq27xxx: expose battery data when CI=1 power: supply: ab8500_fg: Allocate wq in probe power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1 power: supply: core: Initialize struct to zero commit 96752be4d7b443e6f1e322428d61f777d7d8bd4d Merge: 176882156ae6d 5d24df3d69080 Author: Linus Torvalds Date: Wed Jun 1 14:05:16 2022 -0700 Merge tag 'linux-watchdog-5.19-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add MediaTek MT8186 support - Add Mediatek MT7986 reset-controller support - Add i.MX93 support - Add watchdog driver for Sunplus SP7021 - Add SC8180X and SC8280XP compatibles - Add Renesas RZ/N1 Watchdog driver and support for RZ/N1 - rzg2l_wdt improvements and fixes - Several other improvements and fixes * tag 'linux-watchdog-5.19-rc1' of git://www.linux-watchdog.org/linux-watchdog: (38 commits) watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe dt-bindings: watchdog: renesas,wdt: R-Car V3U is R-Car Gen4 watchdog: Add Renesas RZ/N1 Watchdog driver dt-bindings: watchdog: renesas,wdt: Add support for RZ/N1 watchdog: wdat_wdt: Stop watchdog when uninstalling module watchdog: wdat_wdt: Stop watchdog when rebooting the system watchdog: wdat_wdt: Using the existing function to check parameter timeout dt-bindings: watchdog: da9062: add watchdog timeout mode dt-bindings: watchdog: renesas,wdt: Document RZ/G2UL SoC watchdog: iTCO_wdt: Using existing macro define covers more scenarios watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking dt-bindings: watchdog: Add SC8180X and SC8280XP compatibles watchdog: rti_wdt: Fix calculation and evaluation of preset heartbeat dt-bindings: watchdog: uniphier: Use unevaluatedProperties watchdog: sp805: disable watchdog on remove watchdog: da9063: optionally disable watchdog during suspend dt-bindings: mfd: da9063: watchdog: add suspend disable option dt-bindings: watchdog: sunxi: clarify clock support dt-bindings: watchdog: sunxi: fix F1C100s compatible watchdog: Add watchdog driver for Sunplus SP7021 ... commit 176882156ae6d63a81fe7f01ea6fe65ab6b52105 Merge: 8171acb8bc9b3 421cfe6596f6c Author: Linus Torvalds Date: Wed Jun 1 13:49:15 2022 -0700 Merge tag 'vfio-v5.19-rc1' of https://github.com/awilliam/linux-vfio Pull vfio updates from Alex Williamson: - Improvements to mlx5 vfio-pci variant driver, including support for parallel migration per PF (Yishai Hadas) - Remove redundant iommu_present() check (Robin Murphy) - Ongoing refactoring to consolidate the VFIO driver facing API to use vfio_device (Jason Gunthorpe) - Use drvdata to store vfio_device among all vfio-pci and variant drivers (Jason Gunthorpe) - Remove redundant code now that IOMMU core manages group DMA ownership (Jason Gunthorpe) - Remove vfio_group from external API handling struct file ownership (Jason Gunthorpe) - Correct typo in uapi comments (Thomas Huth) - Fix coccicheck detected deadlock (Wan Jiabing) - Use rwsem to remove races and simplify code around container and kvm association to groups (Jason Gunthorpe) - Harden access to devices in low power states and use runtime PM to enable d3cold support for unused devices (Abhishek Sahu) - Fix dma_owner handling of fake IOMMU groups (Jason Gunthorpe) - Set driver_managed_dma on vfio-pci variant drivers (Jason Gunthorpe) - Pass KVM pointer directly rather than via notifier (Matthew Rosato) * tag 'vfio-v5.19-rc1' of https://github.com/awilliam/linux-vfio: (38 commits) vfio: remove VFIO_GROUP_NOTIFY_SET_KVM vfio/pci: Add driver_managed_dma to the new vfio_pci drivers vfio: Do not manipulate iommu dma_owner for fake iommu groups vfio/pci: Move the unused device into low power state with runtime PM vfio/pci: Virtualize PME related registers bits and initialize to zero vfio/pci: Change the PF power state to D0 before enabling VFs vfio/pci: Invalidate mmaps and block the access in D3hot power state vfio: Change struct vfio_group::container_users to a non-atomic int vfio: Simplify the life cycle of the group FD vfio: Fully lock struct vfio_group::container vfio: Split up vfio_group_get_device_fd() vfio: Change struct vfio_group::opened from an atomic to bool vfio: Add missing locking for struct vfio_group::kvm kvm/vfio: Fix potential deadlock problem in vfio include/uapi/linux/vfio.h: Fix trivial typo - _IORW should be _IOWR instead vfio/pci: Use the struct file as the handle not the vfio_group kvm/vfio: Remove vfio_group from kvm vfio: Change vfio_group_set_kvm() to vfio_file_set_kvm() vfio: Change vfio_external_check_extension() to vfio_file_enforced_coherent() vfio: Remove vfio_external_group_match_file() ... commit 66ed42caf286a7aaeb6f1db4b2995dd9416226c2 Author: Lukas Bulwahn Date: Wed Jun 1 09:42:12 2022 +0200 MAINTAINERS: rectify entries for some i3c drivers after dt conversion Commit 4bd69ecfa672 ("dt-bindings: i3c: Convert cdns,i3c-master to DT schema") and commit 6742ca620bd9 ("dt-bindings: i3c: Convert snps,dw-i3c-master to DT schema") convert some i3c dt-bindings to yaml, but miss to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about broken references. Repair these file references in I3C DRIVER FOR CADENCE I3C MASTER IP and I3C DRIVER FOR SYNOPSYS DESIGNWARE. Signed-off-by: Lukas Bulwahn Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220601074212.19984-1-lukas.bulwahn@gmail.com commit fa582c6f3684ac0098a9d02ddf0ed52a02b37127 Author: Philip Yang Date: Thu May 26 16:15:38 2022 -0400 drm/amdkfd: Use mmget_not_zero in MMU notifier MMU notifier callback may pass in mm with mm->mm_users==0 when process is exiting, use mmget_no_zero to avoid accessing invalid mm in deferred list work after mm is gone. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 2a460963350ec6b1534d28d7f943b5f84815aff2 Author: Candice Li Date: Wed Jun 1 17:10:44 2022 +0800 drm/amdgpu: Resolve RAS GFX error count issue after cold boot on Arcturus Adjust the sequence for ras late init and separate ras reset error status from query status. v2: squash in fix from Candice Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 28caf8c467e2cb98b90a760b65767fa9aaf52ffb Author: Stanley.Yang Date: Tue May 31 18:57:06 2022 +0800 drm/amdgpu: fix ras supported check Fix aldebaran ras supported check on SRIOV guest side, the previous check conditicon block all ras feature on baremetal Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fd843d03418ead2bba369159bb19b60e9d4b7b1e Author: Aurabindo Pillai Date: Thu Apr 14 15:48:30 2022 -0400 drm/amd/display: remove stale config guards This code should be executed. Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8365ed22d00b5e5889425c8d96462ad88ae463bc Author: sunliming Date: Sun May 29 14:26:31 2022 +0800 drm/amdgpu: make gfx_v11_0_rlc_stop static This symbol is not used outside of gfx_v11_0.c, so marks it static. Fixes the following w1 warning: drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:1945:6: warning: no previous prototype for function 'gfx_v11_0_rlc_stop' [-Wmissing-prototypes]. Reported-by: kernel test robot Signed-off-by: sunliming Signed-off-by: Alex Deucher commit 418214ddcf6e79e4e572f8c7a18e1de7cab195b4 Author: sunliming Date: Sun May 29 15:26:31 2022 +0800 drm/amdgpu: fix a missing break in gfx_v11_0_handle_priv_fault Fixes the following w1 warning: drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c:5873:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough]. Reported-by: kernel test robot Signed-off-by: sunliming Signed-off-by: Alex Deucher commit ae969b62e7a1e17affae24b815b217b9b87a62f4 Author: Roman Li Date: Wed May 25 17:20:21 2022 -0400 drm/amdgpu: fix aper_base for APU [Why] Wrong fb offset results in dmub f/w errors and white screen. [drm:dc_dmub_srv_wait_idle [amdgpu]] *ERROR* Error waiting for DMUB idle: status=3 [How] Read aper_base from mmhub because GC is off by default v2: use BAR for passthrough (Alex) Signed-off-by: Roman Li Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 97e50305542f384741a5b45699aba349fe9fca73 Author: Alex Deucher Date: Thu May 26 16:34:55 2022 -0400 drm/amdgpu: update VCN codec support for Yellow Carp Supports AV1. Mesa already has support for this and doesn't rely on the kernel caps for yellow carp, so this was already working from an application perspective. Fixes: 554398174d98 ("amdgpu/nv.c - Added video codec support for Yellow Carp") Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2002 Reviewed-by: Leo Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 11594fa114276ed41b9fa3849f7eb79be10162d6 Author: Jiapeng Chong Date: Wed May 25 17:37:02 2022 +0800 drm/amdgpu: make program_imu_rlc_ram static This symbol is not used outside of imu_v11_0.c, so marks it static. Fixes the following w1 warning: drivers/gpu/drm/amd/amdgpu/imu_v11_0.c:302:6: warning: no previous prototype for ‘program_imu_rlc_ram’ [-Wmissing-prototypes]. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 067541847781b8e3abd7400ffdc0d402432613c8 Author: Aric Cyr Date: Sun May 15 21:52:38 2022 -0400 drm/amd/display: 3.2.187 This version brings along the following fixes: * Changes to DP LT fallback behavior to more closely match the DP standard * Added new interfaces for lut pipeline * Restore ref_dtblck value when clk struct is cleared in init_clocks * Fixes DMUB outbox trace in S4 * Fixes lingering DIO FIFO errors when DIO no longer enabled * Reads Golden Settings Table from VBIOS Acked-by: Jasdeep Dhillon Signed-off-by: Aric Cyr Signed-off-by: Alex Deucher commit 583ad88871b38dc39f05a316dcde909e444b09a6 Author: Ilya Date: Mon Feb 7 17:39:10 2022 -0500 drm/amd/display: Fix possible infinite loop in DP LT fallback [Why] It's possible for some fallback scenarios to result in infinite looping during link training. [How] This change modifies DP LT fallback behavior to more closely match the DP standard. Keep track of the link rate during the EQ_FAIL fallback, and use it as the maximum link rate for the CR sequence. Reviewed-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Ilya Signed-off-by: Alex Deucher commit f0ad66f42a3d914ac5f9972731ec5bc97f35002d Author: Alvin Date: Thu May 12 16:49:16 2022 -0400 drm/amd/display: Don't clear ref_dtbclk value [Description] ref_dtbclk value is assigned in clk_mgr_construct, but the clks struct is cleared in init_clocks. Make sure to restore the value or we will get 0 value for ref_dtbclk in DCN31. Reviewed-by: Chris Park Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 6ecf9773a5030aa4932096754bacff20e1b944b8 Author: Hung, Cruise Date: Fri May 13 09:16:42 2022 +0800 drm/amd/display: Fix DMUB outbox trace in S4 (#4465) [Why] DMUB Outbox0 read/write pointer not sync after resumed from S4. And that caused old traces were sent to outbox. [How] Disable DMUB Outbox0 interrupt and clear DMUB Outbox0 read/write pointer when resumes from S4. And then enable Outbox0 interrupt before starts DMCUB. Reviewed-by: Nicholas Kazlauskas Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Cruise Hung Signed-off-by: Alex Deucher commit 92909cde3235f894d7cdf59709d86e9b22f897ce Author: hengzhou Date: Sat May 7 09:43:08 2022 +0800 drm/amd/display: Wait DMCUB to idle state before reset. [WHY] Very low rate to cause memory access issue while resetting DMCUB after the halt command was sent to it. The process of stopping fw of DMCUB may be timeout, that means it is not in idle state, such as the window frames may still be kept in cache, so reset by force will cause MMHUB hang. [HOW] After the halt command was sent, keep checking the DMCUB state until it is idle. Reviewed-by: Eric Yang Reviewed-by: Nicholas Kazlauskas Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: hengzhou Signed-off-by: Alex Deucher commit 8440f57532496d398a461887e56ca6f45089fbcf Author: Nicholas Kazlauskas Date: Fri May 6 12:56:38 2022 -0400 drm/amd/display: Pass the new context into disable OTG WA [Why] When enabling an HPO stream for the first time after having previously enabled a DIO stream there may be lingering DIO FIFO errors even though the DIO is no longer enabled. These can cause display clock change to hang if we don't apply the OTG disable workaround since the ramping logic is tied to OTG on. [How] The workaround wasn't being applied in the sequence of: 1 DIO stream 0 streams 1 HPO stream because current_state has no stream or planes in its context - and it's only swapped after optimize has finished. We should be using the incoming context instead to determine whether this logic is needed or not. Reviewed-by: Dmytro Laktyushkin Reviewed-by: Dmytro Laktyushkin Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit 0ec744084793db817990424cc3cc9da63f665f3f Author: Leung, Martin Date: Tue May 10 12:27:08 2022 -0400 drm/amd/display: revert Blank eDP on disable/enable drv why and how: Revert this change. It was causing a black screen with certain blocks Reviewed-by: George Shen Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Leung, Martin Signed-off-by: Alex Deucher commit 4b81dd2cc6f4f4e8cea0ed6ee8d5193a8ae14a72 Author: Sherry Wang Date: Tue May 10 18:42:18 2022 +0800 drm/amd/display: Read Golden Settings Table from VBIOS [Why] Dmub read AUX_DPHY_RX_CONTROL0 from Golden Setting Table, but driver will set it to default value 0x103d1110, which causes issue in some case [How] Remove the driver code, use the value set by dmub in dp_aux_init Reviewed-by: Nicholas Kazlauskas Acked-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Sherry Wang Signed-off-by: Alex Deucher commit e2c6170a55baefcbeb477e06e66f07659ea4f58d Author: Bharat Kumar Gogada Date: Mon May 16 15:52:17 2022 +0530 dt-bindings: PCI: xilinx-cpm: Fix reg property order All existing vendor DTSes are using "cpm_slcr" reg followed by "cfg" reg. This order is also suggested by node name which is pcie@fca10000 which suggests that cpm_slcr register should be the first. Driver itself is using devm_platform_ioremap_resource_byname() for both names that's why there is no functional change even on description which are using current order. But still prefer to change order to cover currently used description. Fixes: e22fadb1d014 ("PCI: xilinx-cpm: Add YAML schemas for Versal CPM Root Port") Signed-off-by: Bharat Kumar Gogada Reviewed-by: Michal Simek Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220516102217.25960-1-bharat.kumar.gogada@xilinx.com commit 8171acb8bc9b33f3ed827f0615b24f7a06495cd0 Merge: e5b0208713326 4398d3c31b582 Author: Linus Torvalds Date: Wed Jun 1 11:54:29 2022 -0700 Merge tag 'erofs-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull more erofs updates from Gao Xiang: "This is a follow-up to the main updates, including some fixes of fscache mode related to compressed inodes and a cachefiles tracepoint. There is also a patch to fix an unexpected decompression strategy change due to a cleanup in the past. All the fixes are quite small. Apart from these, documentation is also updated for a better description of recent new features. In addition, this has some trivial cleanups without actual code logic changes, so I could have a more recent codebase to work on folios and avoiding the PG_error page flag for the next cycle. Summary: - Leave compressed inodes unsupported in fscache mode for now - Avoid crash when using tracepoint cachefiles_prep_read - Fix `backmost' behavior due to a recent cleanup - Update documentation for better description of recent new features - Several decompression cleanups w/o logical change" * tag 'erofs-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix 'backmost' member of z_erofs_decompress_frontend erofs: simplify z_erofs_pcluster_readmore() erofs: get rid of label `restart_now' erofs: get rid of `struct z_erofs_collection' erofs: update documentation erofs: fix crash when enable tracepoint cachefiles_prep_read erofs: leave compressed inodes unsupported in fscache mode for now commit e5b0208713326cdd3f0a83540e31f9b6f280da38 Merge: 17eabd42560f4 621433b7e25d6 Author: Linus Torvalds Date: Wed Jun 1 11:17:24 2022 -0700 Merge tag '5.19-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server updates from Steve French: - rdma (smbdirect) fixes, cleanup and optimizations - crediting (flow control) fix for mounts from Windows client - ACL fix - Windows client query dir fix - write validation fix - cleanups * tag '5.19-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: smbd: relax the count of sges required ksmbd: fix outstanding credits related bugs ksmbd: smbd: fix connection dropped issue ksmbd: Fix some kernel-doc comments ksmbd: fix wrong smbd max read/write size check ksmbd: add smbd max io size parameter ksmbd: handle smb2 query dir request for OutputBufferLength that is too small ksmbd: smbd: handle multiple Buffer descriptors ksmbd: smbd: change the return value of get_sg_list ksmbd: smbd: simplify tracking pending packets ksmbd: smbd: introduce read/write credits for RDMA read/write ksmbd: smbd: change prototypes of RDMA read/write related functions ksmbd: validate length in smb2_write() ksmbd: fix reference count leak in smb_check_perm_dacl() commit 17eabd42560f4636648ad65ba5b20228071e2363 Author: David Howells Date: Tue May 31 09:30:40 2022 +0100 afs: Fix infinite loop found by xfstest generic/676 In AFS, a directory is handled as a file that the client downloads and parses locally for the purposes of performing lookup and getdents operations. The in-kernel afs filesystem has a number of functions that do this. A directory file is arranged as a series of 2K blocks divided into 32-byte slots, where a directory entry occupies one or more slots, plus each block starts with one or more metadata blocks. When parsing a block, if the last slots are occupied by a dirent that occupies more than a single slot and the file position points at a slot that's not the initial one, the logic in afs_dir_iterate_block() that skips over it won't advance the file pointer to the end of it. This will cause an infinite loop in getdents() as it will keep retrying that block and failing to advance beyond the final entry. Fix this by advancing the file pointer if the next entry will be beyond it when we skip a block. This was found by the generic/676 xfstest but can also be triggered with something like: ~/xfstests-dev/src/t_readdir_3 /xfstest.test/z 4000 1 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: http://lore.kernel.org/r/165391973497.110268.2939296942213894166.stgit@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit 8eca6b0a647aabea3d1d2907dd6245fc436f98e7 Merge: 68e6134bb70ab 3d593b6e80ad2 Author: Linus Torvalds Date: Wed Jun 1 10:49:11 2022 -0700 Merge tag 'pwm/for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Quite a large number of conversions this time around, courtesy of Uwe who has been working tirelessly on these. No drivers of the legacy API are left at this point, so as a next step the old API can be removed. Support is added for a few new devices such as the Xilinx AXI timer- based PWMs and the PWM IP found on Sunplus SoCs. Other than that, there's a number of fixes, cleanups and optimizations" * tag 'pwm/for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (43 commits) pwm: pwm-cros-ec: Add channel type support dt-bindings: google,cros-ec-pwm: Add the new -type compatible dt-bindings: Add mfd/cros_ec definitions pwm: Document that the pinstate of a disabled PWM isn't reliable pwm: twl-led: Implement .apply() callback pwm: lpc18xx: Implement .apply() callback pwm: mediatek: Implement .apply() callback pwm: lpc32xx: Implement .apply() callback pwm: tegra: Implement .apply() callback pwm: stmpe: Implement .apply() callback pwm: sti: Implement .apply() callback pwm: pwm-mediatek: Add support for MediaTek Helio X10 MT6795 dt-bindings: pwm: pwm-mediatek: Add documentation for MT6795 SoC pwm: tegra: Optimize period calculation pwm: renesas-tpu: Improve precision of period and duty_cycle calculation pwm: renesas-tpu: Improve maths to compute register settings pwm: renesas-tpu: Rename variables to match the usual naming pwm: renesas-tpu: Implement .apply() callback pwm: renesas-tpu: Make use of devm functions pwm: renesas-tpu: Make use of dev_err_probe() ... commit 68e6134bb70ab20e9f7c36c1ae7dc96b8ed778ae Merge: f634b63d43e1e 59d6f72f6f9c9 Author: Linus Torvalds Date: Wed Jun 1 10:39:58 2022 -0700 Merge tag 'rpmsg-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "This corrects the check for irq_of_parse_and_map() failures in the Qualcomm SMD driver and fixes unregistration and a couple of double free in the virtio rpmsg driver" * tag 'rpmsg-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev() rpmsg: virtio: Fix possible double free in rpmsg_probe() rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value commit f634b63d43e1ef4ccd68017687a8437d3c416918 Merge: 129bdb30fb054 bb489b9640610 Author: Linus Torvalds Date: Wed Jun 1 10:35:22 2022 -0700 Merge tag 'rproc-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "This fixes a race condition in the user space interface for starting and stopping remote processors, it makes the ELF loader properly skip zero memsz segments and it cleans up the debugfs tracefile code a bit by not checking for errors. It introduces support for controlling the audio DSP on Qualcomm MSM8226, as well as audio and compute DSPs on Qualcomm SC8280XP. It makes it possible to specify the firmware path for Mediatek's remote processors, fixes a double free in the SCP driver and addresses an issue with the SRAM initialization on MT8195. Lastly it deprecates the custom ELF loader in the iMX remoteproc driver, in favor of using the shared one" * tag 'rproc-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (21 commits) dt-bindings: remoteproc: mediatek: Add optional memory-region to mtk,scp dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x dt-bindings: remoteproc: st,stm32-rproc: Fix phandle-array parameters description remoteproc: imx_rproc: Support i.MX93 dt-bindings: remoteproc: imx_rproc: Support i.MX93 remoteproc: qcom: pas: Add MSM8226 ADSP support dt-bindings: remoteproc: qcom: pas: Add MSM8226 adsp remoteproc: mediatek: Allow reading firmware-name from DT dt-bindings: remoteproc: mediatek: Add firmware-name property remoteproc: qcom: pas: Add sc8280xp remoteprocs dt-bindings: remoteproc: qcom: pas: Add sc8280xp adsp and nsp pair dt-bindings: remoteproc: mediatek: Add interrupts property to mtk,scp remoteproc: imx_rproc: Ignore create mem entry for resource table remoteproc: core: Move state checking to remoteproc_core remoteproc: core: Remove state checking before calling rproc_boot() remoteproc: imx_dsp_rproc: Make rsc_table optional remoteproc: imx_dsp_rproc: use common rproc_elf_load_segments remoteproc: elf_loader: skip segment with memsz as zero remoteproc: mtk_scp: Fix a potential double free remoteproc: Don't bother checking the return value of debugfs_create* ... commit 129bdb30fb054875f2068ccce376b865076d9934 Merge: 2380dd691e1fe ebf2a35217385 Author: Linus Torvalds Date: Wed Jun 1 10:30:18 2022 -0700 Merge tag 'spi-fix-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fixes that came in during the merge window: a driver fix for spurious timeouts in the fsi driver and an improvement to make the core display error messages for transfer_one_message() to help people debug things" * tag 'spi-fix-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: core: Display return code when failing to transfer message spi: fsi: Fix spurious timeout commit 2380dd691e1fe1ebe3f346d0ce54f8fc7eacc167 Merge: 700170bf6b4d7 2ef4bb24ff39a Author: Linus Torvalds Date: Wed Jun 1 10:25:06 2022 -0700 Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull pcmcia updates from Dominik Brodowski: "A few odd cleanups and fixes, including a Kconfig fix to add a required dependency on MIPS" * 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: Use platform_get_irq() to get the interrupt pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards drivers/pcmcia: Fix typo in comment commit 43624eda86c98b0de726d0b6f2516ccc3ef7313f Author: Haibo Chen Date: Mon May 30 18:48:48 2022 +0800 gpio: pca953x: use the correct register address to do regcache sync For regcache_sync_region, need to use pca953x_recalc_addr() to get the real register address. Fixes: b76574300504 ("gpio: pca953x: Restore registers after suspend/resume cycle") Signed-off-by: Haibo Chen Signed-off-by: Bartosz Golaszewski commit 8a172952fc597ab9a56d4511d5a72af7c4419c7a Author: Andy Shevchenko Date: Mon May 30 14:59:03 2022 +0300 MAINTAINERS: Update Intel GPIO (PMIC and PCH) to Supported The actual status of the code is Supported. Reported-by: dave.hansen@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 741d4514e96a3a6eef57522ba8df3646a1585441 Author: Andy Shevchenko Date: Mon May 30 14:56:53 2022 +0300 MAINTAINERS: Update GPIO ACPI library to Supported The actual status of the code is Supported. Reported-by: dave.hansen@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Bartosz Golaszewski commit ff979b2a9d9779382030023bfc4e3b1989c8c314 Author: Chengming Zhou Date: Fri May 6 11:27:37 2022 +0800 ftrace/fgraph: fix increased missing-prototypes warnings After commit e999995c84c3 ("ftrace: cleanup ftrace_graph_caller enable and disable") merged into the linux-next tree, the kernel test robot (lkp@intel.com) has send out report that there are increased missing-prototypes warnings caused by that commit. COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.3.0 make.cross W=1 \ O=build_dir ARCH=sh SHELL=/bin/bash kernel/trace/ warning: no previous prototype for 'ftrace_enable_ftrace_graph_caller' [-Wmissing-prototypes] warning: no previous prototype for 'ftrace_disable_ftrace_graph_caller' [-Wmissing-prototypes] warning: no previous prototype for 'ftrace_return_to_handler' [-Wmissing-prototypes] warning: no previous prototype for 'ftrace_graph_sleep_time_control' [-Wmissing-prototypes] BTW there are so many missing-prototypes warnings if build kernel with "W=1". The increased warnings for 'ftrace_[enable,disable]_ftrace_graph_caller' is caused by CONFIG_FUNCTION_GRAPH_TRACER && !CONFIG_DYNAMIC_FTRACE, so the declarations in can't be seen in fgraph.c. And this warning can't reproduce on x86_64 since x86_64 select HAVE_FUNCTION_GRAPH_TRACER only when DYNAMIC_FTRACE, so fgraph.c will always see the declarations in . This patch fix the increased warnings by put the definitions in CONFIG_DYNAMIC_FTRACE although there are no real problems exist. Signed-off-by: Chengming Zhou Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20220506032737.23375-1-zhouchengming@bytedance.com Signed-off-by: Catalin Marinas commit 61c1b44a21d70d4783db02198fbf68b132f4953c Author: Pavel Begunkov Date: Wed Jun 1 15:28:44 2022 +0100 io_uring: fix deadlock on iowq file slot alloc io_fixed_fd_install() can grab uring_lock in the slot allocation path when called from io-wq, and then call into io_install_fixed_file(), which will lock it again. Pull all locking out of io_install_fixed_file() into io_fixed_fd_install(). Fixes: 1339f24b336db ("io_uring: allow allocated fixed files for openat/openat2") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/64116172a9d0b85b85300346bb280f3657aafc26.1654087283.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a27e51b45e1bc57f15cffd6b9bfc38efef8cc419 Author: Nelson Penn Date: Sun May 22 19:50:38 2022 +0000 documentation: Format button_dev as a pointer. The docs on creating an input device driver have an example in which button_dev is a pointer to an input_dev struct. However, in two code snippets below, button_dev is used as if it is not a pointer. Make these occurrences of button_dev reflect that it is a pointer. Signed-off-by: Nelson Penn Link: https://lore.kernel.org/r/20220522194953.12097-1-nelsonapenn@protonmail.com Signed-off-by: Jonathan Corbet commit 6199e138fe3b7479f1c6980f8407a8e0b2ade1e8 Author: Miguel Ojeda Date: Sat May 28 17:31:32 2022 +0200 docs: add SVG version of the Linux logo In the Rust for Linux patch series, Jonathan Corbet requested [1] that we avoid binary assets (such as the logo), possibly by recreating them in SVG format. However, it turns out there is no SVG version of the Linux logo in the kernel tree yet, only a GIF one from the pre-v2.0.0 days. This patch fixes that by adding a SVG version of the Linux logo, which we could then use in the Rust for Linux documentation and other similar places. This is a vector re-illustration by Garrett LeSage of the original logo by Larry Ewing, plus cleanups by IFo Hancroft. The file was imported as-is from: https://github.com/garrett/Tux/blob/ecd40de64250ea2b24c849e901c3297ad01e54f6/tux.svg The stated license in the repository is: > Public domain http://creativecommons.org/publicdomain/zero/1.0/ > > ...but, if anyone asks: > > Tux was originally made by Larry Ewing in the Gimp, re-illustrated > in vector by Garrett LeSage, using Inkscape and refined and > cleaned up by IFo Hancroft. Here, the acknowledgement requirement has been made mandatory to match the wording of the existing GIF logo in `COPYING-logo`. Both Garrett LeSage and IFo Hancroft gave their permission [2,3] to use their re-illustration with the license as given in the `COPYING-logo` file. Link: https://lore.kernel.org/lkml/87fspk1xoc.fsf@meer.lwn.net/ [1] Link: https://lore.kernel.org/lkml/YgFsD7zBZyVqyF+F@battlestation/ [2] Link: https://lore.kernel.org/lkml/CAFfNkxV=DmRJL1Oqm3w9YzBYcNLSAG3Ss8pih9ZVwh_E-Fbw+Q@mail.gmail.com/ [3] Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20220528153132.8636-2-ojeda@kernel.org Signed-off-by: Jonathan Corbet commit fae35da4ace3721dfba1b3986a9239fc85cf8c72 Author: Miguel Ojeda Date: Sat May 28 17:31:31 2022 +0200 docs: move Linux logo into a new `images` folder Having assets in the top-level `Documentation` directory can make it harder to find the documents one needs, especially if we want to add more of them later on. Instead, create a new `images` folder inside it that is used to hold assets such as logos. In addition, update the reference in `scripts/spdxcheck-test.sh`. Link: https://lore.kernel.org/lkml/8735hicoy7.fsf@meer.lwn.net/ Suggested-by: Jonathan Corbet Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20220528153132.8636-1-ojeda@kernel.org Signed-off-by: Jonathan Corbet commit 938285a130ecafd9da71f6a28058722bb831b31d Author: Joel Colledge Date: Mon May 30 16:28:49 2022 +0200 docs: blockdev: change title to match section content This index.rst was added in commit 39443104c7d3 docs: blockdev: convert to ReST It appears that the title from the RapidIO index page was copied. This title does not match the content of this directory. Change it to match. Signed-off-by: Joel Colledge Link: https://lore.kernel.org/r/20220530142849.717-1-joel.colledge@linbit.com Signed-off-by: Jonathan Corbet commit 627f01eab93d8671d4e4afee9b148f9998d20e7c Author: Akira Yokosawa Date: Wed Jun 1 23:34:06 2022 +0900 docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 One of the changes in Sphinx 5.0.0 [1] says [sic]: 5.0.0 final - #10474: language does not accept None as it value. The default value of language becomes to 'en' now. [1]: https://www.sphinx-doc.org/en/master/changes.html#release-5-0-0-released-may-30-2022 It results in a new warning from Sphinx 5.0.0 [sic]: WARNING: Invalid configuration value found: 'language = None'. Update your configuration to a valid langauge code. Falling back to 'en' (English). Silence the warning by using 'en'. It works with all the Sphinx versions required for building kernel documentation (1.7.9 or later). Signed-off-by: Akira Yokosawa Link: https://lore.kernel.org/r/bd0c2ddc-2401-03cb-4526-79ca664e1cbe@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Jonathan Corbet commit 479260419fa4cb30e3e5d935a857fbdf0ffdd854 Author: Rob Herring Date: Wed May 25 20:42:04 2022 -0500 dt-bindings: mmc: Fix unevaluatedProperties warnings in examples The 'unevaluatedProperties' schema checks is not fully working and doesn't catch some cases where there's a $ref to another schema. A fix is pending, but results in new warnings in examples. Fix the warnings by removing spurious properties or adding a missing property to the schema. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220526014204.2873107-1-robh@kernel.org Signed-off-by: Ulf Hansson commit a78b6afa9913890e92aede1c17e72dec7e528549 Author: Masahiro Yamada Date: Sun May 29 00:47:01 2022 +0900 kbuild: remove redundant cleanups in scripts/link-vmlinux.sh These are cleaned by the top Makefile. vmlinux.o and .vmlinux.d matches the '*.[aios]' and '.*.d' patterns respectively. Signed-off-by: Masahiro Yamada Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit f6b66ca4f38b1169313383aec7fa0a8446205ebb Author: Masahiro Yamada Date: Fri May 27 19:01:55 2022 +0900 kbuild: rebuild multi-object modules when objtool is updated When CONFIG_LTO_CLANG or CONFIG_X86_KERNEL_IBT is enabled, objtool for multi-object modules is postponed until the objects are linked together. Make sure to re-run objtool and re-link multi-object modules when objtool is updated. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit ebd191b38c5ea177318543a08e544cf2f7df944d Author: Masahiro Yamada Date: Fri May 27 19:01:54 2022 +0900 kbuild: add cmd_and_savecmd macro Separate out the command execution part of if_changed, as we did for if_changed_dep. This allows us to reuse it in if_changed_rule. define rule_foo $(call cmd_and_savecmd,foo) $(call cmd,bar) endef Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook Tested-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit c6031b1dbbbfec03891bf1baefa2e0803d705601 Author: Masahiro Yamada Date: Fri May 27 19:01:53 2022 +0900 kbuild: make *.mod rule robust against too long argument error Like built-in.a, the command length of the *.mod rule scales with the depth of the directory times the number of objects in the Makefile. Add $(obj)/ by the shell command (awk) instead of by Make's builtin function. In-tree modules still have some room to the limit (ARG_MAX=2097152), but this is more future-proof for big modules in a deep directory. For example, you can build i915 as a module (CONFIG_DRM_I915=m) and compare drivers/gpu/drm/i915/.i915.mod.cmd with/without this commit. The issue is more critical for external modules because the M= path can be very long as Jeff Johnson reported before [1]. [1] https://lore.kernel.org/linux-kbuild/4c02050c4e95e4cb8cc04282695f8404@codeaurora.org/ Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit cd968b97c49214e6557381bddddacbd0e0fb696e Author: Masahiro Yamada Date: Fri May 27 19:01:52 2022 +0900 kbuild: make built-in.a rule robust against too long argument error Kbuild runs at the top of objtree instead of changing the working directory to subdirectories. I think this design is nice overall but some commands have a scalability issue. The build command of built-in.a is one of them whose length scales with: O(D * N) Here, D is the length of the directory path (i.e. $(obj)/ prefix), N is the number of objects in the Makefile, O() is the big O notation. The deeper directory the Makefile directory is located, the more easily it will hit the too long argument error. We can make it better. Trim the $(obj)/ by Make's builtin function, and restore it by a shell command (sed). With this, the command length scales with: O(D + N) In-tree modules still have some room to the limit (ARG_MAX=2097152), but this is more future-proof for big modules in a deep directory. For example, you can build i915 as builtin (CONFIG_DRM_I915=y) and compare drivers/gpu/drm/i915/.built-in.a.cmd with/without this commit. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 31cb50b5590fe911077b8463ad01144fac8fa4f3 Author: Masahiro Yamada Date: Fri May 27 19:01:51 2022 +0900 kbuild: check static EXPORT_SYMBOL* by script instead of modpost The 'static' specifier and EXPORT_SYMBOL() are an odd combination. Commit 15bfc2348d54 ("modpost: check for static EXPORT_SYMBOL* functions") tried to detect it, but this check has false negatives. Here is the sample code. Makefile: obj-y += foo1.o foo2.o foo1.c: #include static void foo(void) {} EXPORT_SYMBOL(foo); foo2.c: void foo(void) {} foo1.c exports the static symbol 'foo', but modpost cannot catch it because it is fooled by foo2.c, which has a global symbol with the same name. s->is_static is cleared if a global symbol with the same name is found somewhere, but EXPORT_SYMBOL() and the global symbol do not necessarily belong to the same compilation unit. This check should be done per compilation unit, but I do not know how to do it in modpost. modpost runs against vmlinux.o or modules, which merges multiple objects, then forgets their origin. modpost cannot parse individual objects because they may not be ELF but LLVM IR when CONFIG_LTO_CLANG=y. Add a simple bash script to parse the output from ${NM}. This works for CONFIG_LTO_CLANG=y because llvm-nm can dump symbols of LLVM IR files. Revert 15bfc2348d54. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit ab5e5c062f67c5ae8cd07f0632ffa62dc0e7d169 Author: Pablo Neira Ayuso Date: Wed Jun 1 16:00:00 2022 +0200 netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path Use kfree_rcu(ptr, rcu) variant instead as described by ae089831ff28 ("netfilter: nf_tables: prefer kfree_rcu(ptr, rcu) variant"). Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Pablo Neira Ayuso commit 282e5f8fe907dc3f2fbf9f2103b0e62ffc3a68a5 Author: Florian Westphal Date: Wed Jun 1 10:47:35 2022 +0200 netfilter: nat: really support inet nat without l3 address When no l3 address is given, priv->family is set to NFPROTO_INET and the evaluation function isn't called. Call it too so l4-only rewrite can work. Also add a test case for this. Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only") Reported-by: Yi Chen Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a051246b786af7e4a9d9219cc7038a6e8a411531 Author: Adrian Hunter Date: Tue May 31 20:19:22 2022 +0300 mmc: block: Fix CQE recovery reset success The intention of the use of mmc_blk_reset_success() in mmc_blk_cqe_recovery() was to prevent repeated resets when retrying and getting the same error. However, that may not be the case - any amount of time and I/O may pass before another recovery is needed, in which case there would be no reason to deny it the opportunity to recover via a reset if necessary. CQE recovery is expected seldom and failure to recover (if the clear tasks command fails), even more seldom, so it is better to allow the reset always, which can be done by calling mmc_blk_reset_success() always. Fixes: 1e8e55b67030c6 ("mmc: block: Add CQE support") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20220531171922.76080-1-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 75ed63d919400b803691a0c757ee23c6f767a625 Author: Ard Biesheuvel Date: Sat May 28 11:49:54 2022 +0200 efi: clean up Kconfig dependencies on CONFIG_EFI Geert reports that the new option CONFIG_EFI_DISABLE_RUNTIME is user visible even when EFI support is disabled, which is unnecessary and clutters the Kconfig interface. So let's move this option into the existing Kconfig submenu that already depends on CONFIG_EFI, and while at it, give some other options the same treatment. Also clean up a small wart where the efi/ subdirectory is listed twice. Let's just list it unconditionally so that both EFI and UEFI_CPER based pieces will be built independently (the latter only depends on the former on !X86) Signed-off-by: Ard Biesheuvel commit 31f1a0edff78c43e8a3bd3692af0db1b25c21b17 Author: Ard Biesheuvel Date: Fri May 20 12:07:58 2022 +0200 efi/x86: libstub: Make DXE calls mixed mode safe The newly added DXE calls use 64-bit quantities, which means we need to marshall them explicitly when running in mixed mode. Currently, we get away without it because we just bail when GetMemorySpaceDescriptor() fails, which is guaranteed to happen due to the function argument mixup. Let's fix this properly, though, by defining the macros that describe how to marshall the arguments. While at it, drop an incorrect cast on a status variable. Signed-off-by: Ard Biesheuvel commit ca209f8b5f61b74782dd4275ebc7173d92cb4905 Author: Lukas Bulwahn Date: Wed Jun 1 13:50:43 2022 +0200 efi: x86: Fix config name for setting the NX-compatibility flag in the PE header Commit 21b68da7bf4a ("efi: x86: Set the NX-compatibility flag in the PE header") intends to set the compatibility flag, i.e., IMAGE_DLL_CHARACTERISTICS_NX_COMPAT, but this ifdef is actually dead as the CONFIG_DXE_MEM_ATTRIBUTES Kconfig option does not exist. The config is actually called EFI_DXE_MEM_ATTRIBUTES. Adjust the ifdef to use the intended config name. The issue was identified with ./scripts/checkkconfigsymbols.py. Fixes: 21b68da7bf4a ("efi: x86: Set the NX-compatibility flag in the PE header") Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220601115043.7678-1-lukas.bulwahn@gmail.com Signed-off-by: Ard Biesheuvel commit 86360030cc5117596626bef1d937277cd2bebe05 Author: Dan Carpenter Date: Tue May 31 15:10:05 2022 +0300 net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6() The tcf_ct_flow_table_fill_tuple_ipv6() function is supposed to return false on failure. It should not return negatives because that means succes/true. Fixes: fcb6aa86532c ("act_ct: Support GRE offload") Signed-off-by: Dan Carpenter Acked-by: Toshiaki Makita Link: https://lore.kernel.org/r/YpYFnbDxFl6tQ3Bn@kili Signed-off-by: Paolo Abeni commit e6652a8ef3e64d953168a95878fe29b934ad78ac Author: Aya Levin Date: Tue May 31 11:45:44 2022 +0300 net: ping6: Fix ping -6 with interface name When passing interface parameter to ping -6: $ ping -6 ::11:141:84:9 -I eth2 Results in: PING ::11:141:84:10(::11:141:84:10) from ::11:141:84:9 eth2: 56 data bytes ping: sendmsg: Invalid argument ping: sendmsg: Invalid argument Initialize the fl6's outgoing interface (OIF) before triggering ip6_datagram_send_ctl. Don't wipe fl6 after ip6_datagram_send_ctl() as changes in fl6 that may happen in the function are overwritten explicitly. Update comment accordingly. Fixes: 13651224c00b ("net: ping6: support setting basic SOL_IPV6 options via cmsg") Signed-off-by: Aya Levin Reviewed-by: Gal Pressman Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220531084544.15126-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 28cbc2d4c54c09a427b18a1604740efb6b2cc2d6 Author: Fabien Parent Date: Sun May 29 17:46:13 2022 +0200 regulator: mt6315-regulator: fix invalid allowed mode In the binding example, the regulator mode 4 is shown as a valid mode, but the driver actually only support mode 0 to 2: This generates an error in dmesg when copy/pasting the binding example: [ 0.306080] vbuck1: invalid regulator-allowed-modes element 4 [ 0.307290] vbuck2: invalid regulator-allowed-modes element 4 This commit fixes this error by removing the invalid mode from the examples. Fixes: 977fb5b58469 ("regulator: document binding for MT6315 regulator") Signed-off-by: Fabien Parent Link: https://lore.kernel.org/r/20220529154613.337559-1-fparent@baylibre.com Signed-off-by: Mark Brown commit ef8d89b83bf453ea9cc3c4873a84b50ff334f797 Author: Srinivasa Rao Mandadapu Date: Fri May 27 19:40:08 2022 +0530 ASoC: qcom: lpass-platform: Update VMA access permissions in mmap callback Replace page protection permissions from noncashed to writecombine, in lpass codec DMA path mmp callabck, to support 64 bit chromeOS. Avoid SIGBUS error in userspace caused by noncached permissions in 64 bit chromeOS. Signed-off-by: Srinivasa Rao Mandadapu Link: https://lore.kernel.org/r/1653660608-27245-1-git-send-email-quic_srivasam@quicinc.com Signed-off-by: Mark Brown commit aeca8a3295022bcec46697f16e098140423d8463 Author: Hui Wang Date: Mon May 30 12:01:50 2022 +0800 ASoC: nau8822: Add operation for internal PLL off and on We tried to enable the audio on an imx6sx EVB with the codec nau8822, after setting the internal PLL fractional parameters, the audio still couldn't work and the there was no sdma irq at all. After checking with the section "8.1.1 Phase Locked Loop (PLL) Design Example" of "NAU88C22 Datasheet Rev 0.6", we found we need to turn off the PLL before programming fractional parameters and turn on the PLL after programming. After this change, the audio driver could record and play sound and the sdma's irq is triggered when playing or recording. Cc: David Lin Cc: John Hsu Cc: Seven Li Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20220530040151.95221-2-hui.wang@canonical.com Signed-off-by: Mark Brown commit 724bbe49c5e427cb077357d72d240a649f2e4054 Author: Mikulas Patocka Date: Mon May 30 13:36:45 2022 +0200 fs/ntfs3: provide block_invalidate_folio to fix memory leak The ntfs3 filesystem lacks the 'invalidate_folio' method and it causes memory leak. If you write to the filesystem and then unmount it, the cached written data are not freed and they are permanently leaked. Fixes: 7ba13abbd31e ("fs: Turn block_invalidatepage into block_invalidate_folio") Reported-by: José Luis Lara Carrascal Signed-off-by: Mikulas Patocka Acked-by: Matthew Wilcox (Oracle) Reviewed-by: Namjae Jeon Signed-off-by: Konstantin Komarov Cc: stable@vger.kernel.org # v5.18 commit e0ffcf3fe18e0310221461c08969edec2cc7628c Author: Heiko Carstens Date: Mon May 30 14:20:50 2022 +0200 s390/stack: add union to reflect kvm stack slot usages Add a union which describes how the empty stack slots are being used by kvm and perf. This should help to avoid another bug like the one which was fixed with commit c9bfb460c3e4 ("s390/perf: obtain sie_block from the right address"). Reviewed-by: Nico Boehr Tested-by: Nico Boehr Signed-off-by: Heiko Carstens commit f037acb41dc9fc0f00521685b3250226d6f9b437 Author: Heiko Carstens Date: Mon May 30 14:09:24 2022 +0200 s390/stack: merge empty stack frame slots Merge empty1 and empty2 arrays within the stack frame to one single array. This is possible since with commit 42b01a553a56 ("s390: always use the packed stack layout") the alternative stack frame layout is gone. Reviewed-by: Nico Boehr Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit d144182ed19af0bed4e4a73b51c7af9caccf6fa2 Author: Heiko Carstens Date: Sun May 29 21:36:16 2022 +0200 s390/uaccess: whitespace cleanup Whitespace cleanup to get rid if some checkpatch findings, but mainly to have consistent coding style within the header file again. Signed-off-by: Heiko Carstens commit a0e3a44bc2a01153fe4ff56fc1ec26832a869437 Author: Heiko Carstens Date: Sun May 29 21:27:48 2022 +0200 s390/uaccess: use __noreturn instead of __attribute__((noreturn)) Signed-off-by: Heiko Carstens commit 454ede3f1424c36bc124f8d7ed4b3ea654654be1 Author: Heiko Carstens Date: Sun May 1 21:26:06 2022 +0200 s390/uaccess: use exception handler to zero result on get_user() failure Historically the uaccess code pre-initializes the result of get_user() (and now also __get_kernel_nofault()) to zero and uses the result as input parameter for inline assemblies. This is different to what most, if not all, other architectures are doing, which set the result to zero within the exception handler in case of a fault. Use the new extable mechanism and handle zeroing of the result within the exception handler in case of a fault. Signed-off-by: Heiko Carstens commit 79a74dac447be957178e8596706b1db3d5c714f4 Author: Heiko Carstens Date: Sun May 29 18:55:06 2022 +0200 s390/uaccess: use symbolic names for inline assembler operands Make code easier to read by using symbolic names. Signed-off-by: Heiko Carstens commit 29ccaa4b35ea874ddd50518e5c2c746b9238a792 Author: Alexander Gordeev Date: Mon May 23 12:38:14 2022 +0200 s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag Commit d768bd892fc8 ("s390: add options to change branch prediction behaviour for the kernel") introduced .Lsie_exit label - supposedly to fence off SIE instruction. However, the corresponding address range length .Lsie_crit_mcck_length was not updated, which led to BPON code potentionally marked with CIF_MCCK_GUEST flag. Both .Lsie_exit and .Lsie_crit_mcck_length were removed with commit 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S"), but the issue persisted - currently BPOFF and BPENTER macros might get wrongly considered by the machine check handler as a guest. Fixes: d768bd892fc8 ("s390: add options to change branch prediction behaviour for the kernel") Reviewed-by: Sven Schnelle Reviewed-by: Christian Borntraeger Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 3ae11dbcfac906a8c3a480e98660a823130dc16a Author: Christian Borntraeger Date: Mon May 30 11:27:06 2022 +0200 s390/mm: use non-quiescing sske for KVM switch to keyed guest The switch to a keyed guest does not require a classic sske as the other guest CPUs are not accessing the key before the switch is complete. By using the NQ SSKE things are faster especially with multiple guests. Signed-off-by: Christian Borntraeger Suggested-by: Janis Schoetterl-Glausch Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20220530092706.11637-3-borntraeger@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit 6d5946274df1fff539a7eece458a43be733d1db8 Author: Christian Borntraeger Date: Mon May 30 11:27:05 2022 +0200 s390/gmap: voluntarily schedule during key setting With large and many guest with storage keys it is possible to create large latencies or stalls during initial key setting: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998 (t=2100 jiffies g=155867385 q=20879) Task dump for CPU 18: CPU 1/KVM R running task 0 1030947 256019 0x06000004 Call Trace: sched_show_task rcu_dump_cpu_stacks rcu_sched_clock_irq update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt do_IRQ ext_int_handler ptep_zap_key The mmap lock is held during the page walking but since this is a semaphore scheduling is still possible. Same for the kvm srcu. To minimize overhead do this on every segment table entry or large page. Signed-off-by: Christian Borntraeger Reviewed-by: Alexander Gordeev Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit 315945a43e91c81ebfab0ef011d1dcab419c6d9b Author: Eric Farman Date: Wed May 25 16:40:28 2022 +0200 MAINTAINERS: Update s390 virtio-ccw Add myself to the kernel side of virtio-ccw Signed-off-by: Eric Farman Reviewed-by: Cornelia Huck Acked-by: Halil Pasic Link: https://lore.kernel.org/r/20220525144028.2714489-2-farman@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit 9dade1707fdb4fb6a1d498aa8811779556b7ffbc Author: Heiko Carstens Date: Mon May 30 11:37:48 2022 +0200 s390/kexec: add __GFP_NORETRY to KEXEC_CONTROL_MEMORY_GFP Avoid invoking the OOM-killer when allocating the control page. This is the s390 variant of commit dc5cccacf427 ("kexec: don't invoke OOM-killer for control page allocation"). Signed-off-by: Heiko Carstens commit 13e282cc92d7e4b96fad8b71adf48b7eab22f6b0 Author: Juerg Haefliger Date: Wed May 25 14:01:51 2022 +0200 s390/Kconfig.debug: fix indentation The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. Signed-off-by: Juerg Haefliger Link: https://lore.kernel.org/r/20220525120151.39594-1-juerg.haefliger@canonical.com Signed-off-by: Heiko Carstens commit 4d1f2e4576af57f8d6b357198dcdda88d0431d5e Author: Juerg Haefliger Date: Wed May 25 14:01:40 2022 +0200 s390/Kconfig: fix indentation The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. Signed-off-by: Juerg Haefliger Link: https://lore.kernel.org/r/20220525120140.39534-1-juerg.haefliger@canonical.com Signed-off-by: Heiko Carstens commit 196a888ca6571deb344468e1d7138e3273206335 Author: Ziyang Xuan Date: Tue May 31 15:45:00 2022 +0800 macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following: ================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161 Allocated by task 22209: ... alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748 Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327 After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem. Fixes: 2bce1ebed17d ("macsec: fix refcnt leak in module exit routine") Reported-by: syzbot+d0e94b65ac259c29ce7a@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan Link: https://lore.kernel.org/r/20220531074500.1272846-1-william.xuanziyang@huawei.com Signed-off-by: Paolo Abeni commit 597b89d30b42dcc8e6b262e6876b42dde66f97f0 Author: Mikko Perttunen Date: Mon May 16 11:52:51 2022 +0300 gpu: host1x: Add context bus The context bus is a "dummy" bus that contains struct devices that correspond to IOMMU contexts assigned through Host1x to processes. Even when host1x itself is built as a module, the bus is registered in built-in code so that the built-in ARM SMMU driver is able to reference it. Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding commit f3d671c711097a133bc36bd2bde52f1fcca783a6 Author: Dan Carpenter Date: Tue May 31 10:28:45 2022 +0300 octeontx2-af: fix error code in is_valid_offset() The is_valid_offset() function returns success/true if the call to validate_and_get_cpt_blkaddr() fails. Fixes: ecad2ce8c48f ("octeontx2-af: cn10k: Add mailbox to configure reassembly timeout") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YpXDrTPb8qV01JSP@kili Signed-off-by: Paolo Abeni commit 2965c4cdf7ad9ce0796fac5e57debb9519ea721e Author: Johannes Berg Date: Wed Jun 1 09:19:36 2022 +0200 wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx. Cc: stable@vger.kernel.org Fixes: 5bcae31d9cb1 ("mac80211: implement multi-vif in-place reservations") Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220601091926.df419d91b165.I17a9b3894ff0b8323ce2afdb153b101124c821e5@changeid commit c4caa500ffebf64795d1c0f6f9d6f179b502c6b7 Author: Hangbin Liu Date: Tue May 31 14:37:27 2022 +0800 bonding: guard ns_targets by CONFIG_IPV6 Guard ns_targets in struct bond_params by CONFIG_IPV6, which could save 256 bytes if IPv6 not configed. Also add this protection for function bond_is_ip6_target_ok() and bond_get_targets_ip6(). Remove the IS_ENABLED() check for bond_opts[] as this will make BOND_OPT_NS_TARGETS uninitialized if CONFIG_IPV6 not enabled. Add a dummy bond_option_ns_ip6_targets_set() for this situation. Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Signed-off-by: Hangbin Liu Acked-by: Jonathan Toppins Link: https://lore.kernel.org/r/20220531063727.224043-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 1dc6ff02c8bf77d71b9b5d11cbc9df77cfb28626 Author: Josh Poimboeuf Date: Mon May 23 09:11:49 2022 -0700 x86/speculation/mmio: Print SMT warning Similar to MDS and TAA, print a warning if SMT is enabled for the MMIO Stale Data vulnerability. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner commit 672362cbe6df049299c8ed0a463d89daf66b081c Merge: 079d93b7dba83 ab0925ab72816 Author: Takashi Iwai Date: Wed Jun 1 10:23:35 2022 +0200 Merge tag 'asoc-fix-v5.19-rc0' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 A few more fixes that came in during the merge window - nothing huge here, there is one core fix for DPCM from Pierre but mostly driver changes. commit bd8bb9aed56b1814784a975e2dfea12a9adcee92 Author: Jason Wang Date: Tue May 24 13:55:57 2022 +0800 vdpa: ifcvf: set pci driver data in probe We should set the pci driver data in probe instead of the vdpa device adding callback. Otherwise if no vDPA device is created we will lose the pointer to the management device. Fixes: 6b5df347c6482 ("vDPA/ifcvf: implement management netlink framework for ifcvf") Tested-by: Zheyu Ma Signed-off-by: Jason Wang Message-Id: <20220524055557.1938-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit baf2ad3f6a985354293e371b9ba12b162d639e29 Author: Eli Cohen Date: Mon Apr 11 15:29:42 2022 +0300 vdpa/mlx5: Add RX MAC VLAN filter support Support HW offloaded filtering of MAC/VLAN packets. To allow that, we add a handler to handle VLAN configurations coming through the control VQ. Two operations are supported. 1. Adding VLAN - in this case, an entry will be added to the RX flow table that will allow the combination of the MAC/VLAN to be forwarded to the TIR. 2. Removing VLAN - will remove the entry from the flow table, effectively blocking such packets from going through. Currently the control VQ does not propagate changes to the MAC of the VLAN device so we always use the MAC of the parent device. Examples: 1. Create vlan device: $ ip link add link ens1 name ens1.8 type vlan id 8 Signed-off-by: Eli Cohen Message-Id: <20220411122942.225717-4-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 7becdd13b640a6f91219ae3f201afa03ed67876b Author: Eli Cohen Date: Mon Apr 11 15:29:40 2022 +0300 vdpa/mlx5: Remove flow counter from steering The flow counter has been introduced in early versions of the driver to aid in debugging. It is no longer needed and can harm performance. Remove it. Signed-off-by: Eli Cohen Message-Id: <20220411122942.225717-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 41925b105e345ebc84cedb64f59d20cb14a62613 Author: Juergen Gross Date: Mon May 30 10:26:34 2022 +0200 xen: replace xen_remap() with memremap() xen_remap() is used to establish mappings for frames not under direct control of the kernel: for Xenstore and console ring pages, and for grant pages of non-PV guests. Today xen_remap() is defined to use ioremap() on x86 (doing uncached mappings), and ioremap_cache() on Arm (doing cached mappings). Uncached mappings for those use cases are bad for performance, so they should be avoided if possible. As all use cases of xen_remap() don't require uncached mappings (the mapped area is always physical RAM), a mapping using the standard WB cache mode is fine. As sparse is flagging some of the xen_remap() use cases to be not appropriate for iomem(), as the result is not annotated with the __iomem modifier, eliminate xen_remap() completely and replace all use cases with memremap() specifying the MEMREMAP_WB caching mode. xen_unmap() can be replaced with memunmap(). Reported-by: kernel test robot Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Stefano Stabellini Link: https://lore.kernel.org/r/20220530082634.6339-1-jgross@suse.com Signed-off-by: Juergen Gross commit cc391b694ff085f62f133e6b8f864d43a8e69dfd Author: Vincent Whitchurch Date: Wed Jun 1 00:03:18 2022 -0500 cifs: fix potential deadlock in direct reclaim The srv_mutex is used during writeback so cifs should ensure that allocations done when that mutex is held are done with GFP_NOFS, to avoid having direct reclaim ending up waiting for the same mutex and causing a deadlock. This is detected by lockdep with the splat below: ====================================================== WARNING: possible circular locking dependency detected 5.18.0 #70 Not tainted ------------------------------------------------------ kswapd0/49 is trying to acquire lock: ffff8880195782e0 (&tcp_ses->srv_mutex){+.+.}-{3:3}, at: compound_send_recv but task is already holding lock: ffffffffa98e66c0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire kmem_cache_alloc_trace __request_module crypto_alg_mod_lookup crypto_alloc_tfm_node crypto_alloc_shash cifs_alloc_hash smb311_crypto_shash_allocate smb311_update_preauth_hash compound_send_recv cifs_send_recv SMB2_negotiate smb2_negotiate cifs_negotiate_protocol cifs_get_smb_ses cifs_mount cifs_smb3_do_mount smb3_get_tree vfs_get_tree path_mount __x64_sys_mount do_syscall_64 entry_SYSCALL_64_after_hwframe -> #0 (&tcp_ses->srv_mutex){+.+.}-{3:3}: __lock_acquire lock_acquire __mutex_lock mutex_lock_nested compound_send_recv cifs_send_recv SMB2_write smb2_sync_write cifs_write cifs_writepage_locked cifs_writepage shrink_page_list shrink_lruvec shrink_node balance_pgdat kswapd kthread ret_from_fork other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&tcp_ses->srv_mutex); lock(fs_reclaim); lock(&tcp_ses->srv_mutex); *** DEADLOCK *** 1 lock held by kswapd0/49: #0: ffffffffa98e66c0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat stack backtrace: CPU: 2 PID: 49 Comm: kswapd0 Not tainted 5.18.0 #70 Call Trace: dump_stack_lvl dump_stack print_circular_bug.cold check_noncircular __lock_acquire lock_acquire __mutex_lock mutex_lock_nested compound_send_recv cifs_send_recv SMB2_write smb2_sync_write cifs_write cifs_writepage_locked cifs_writepage shrink_page_list shrink_lruvec shrink_node balance_pgdat kswapd kthread ret_from_fork Fix this by using the memalloc_nofs_save/restore APIs around the places where the srv_mutex is held. Do this in a wrapper function for the lock/unlock of the srv_mutex, and rename the srv_mutex to avoid missing call sites in the conversion. Note that there is another lockdep warning involving internal crypto locks, which was masked by this problem and is visible after this fix, see the discussion in this thread: https://lore.kernel.org/all/20220523123755.GA13668@axis.com/ Link: https://lore.kernel.org/r/CANT5p=rqcYfYMVHirqvdnnca4Mo+JQSw5Qu12v=kPfpk5yhhmg@mail.gmail.com/ Reported-by: Shyam Prasad N Suggested-by: Lars Persson Reviewed-by: Ronnie Sahlberg Reviewed-by: Enzo Matsumiya Signed-off-by: Vincent Whitchurch Signed-off-by: Steve French commit 0a375c822497ed6ad6b5da0792a12a6f1af10c0b Author: Eric Dumazet Date: Mon May 30 14:37:13 2022 -0700 tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one. 2) A socket operation on this socket goes through lock_sock() release_sock() dance. 3) While the socket is owned by the user in step 2), a retransmit of the SYN is received and stored in socket backlog. 4) At release_sock() time, the socket backlog is processed while in process context. 5) A SYNACK packet is cooked in response of the SYN retransmit. 6) -> tcp_rtx_synack() is called in process context. Before blamed commit, tcp_rtx_synack() was always called from BH handler, from a timer handler. Fix this by using TCP_INC_STATS() & NET_INC_STATS() which do not assume caller is in non preemptible context. [1] BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 caller is tcp_rtx_synack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: dump_stack_lvl+0x48/0x5e check_preemption_disabled+0xde/0xe0 tcp_rtx_synack.part.0+0x36/0xc0 tcp_rtx_synack+0x8d/0xa0 ? kmem_cache_alloc+0x2e0/0x3e0 ? apparmor_file_alloc_security+0x3b/0x1f0 inet_rtx_syn_ack+0x16/0x30 tcp_check_req+0x367/0x610 tcp_rcv_state_process+0x91/0xf60 ? get_nohz_timer_target+0x18/0x1a0 ? lock_timer_base+0x61/0x80 ? preempt_count_add+0x68/0xa0 tcp_v4_do_rcv+0xbd/0x270 __release_sock+0x6d/0xb0 release_sock+0x2b/0x90 sock_setsockopt+0x138/0x1140 ? __sys_getsockname+0x7e/0xc0 ? aa_sk_perm+0x3e/0x1a0 __sys_setsockopt+0x198/0x1e0 __x64_sys_setsockopt+0x21/0x30 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path") Signed-off-by: Eric Dumazet Reported-by: Laurent Fasnacht Acked-by: Neal Cardwell Link: https://lore.kernel.org/r/20220530213713.601888-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit b3c0a9efbe0e9471afae2986201da09c046bbd77 Merge: 2e8728c955ce0 97629b237a8cb Author: Jakub Kicinski Date: Tue May 31 20:58:24 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Missing proper sanitization for nft_set_desc_concat_parse(). 2) Missing mutex in nf_tables pre_exit path. 3) Possible double hook unregistration from clean_net path. 4) Missing FLOWI_FLAG_ANYSRC flag in flowtable route lookup. Fix incorrect source and destination address in case of NAT. Patch from wenxu. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: flowtable: fix nft_flow_route source address for nat case netfilter: flowtable: fix missing FLOWI_FLAG_ANYSRC flag netfilter: nf_tables: double hook unregistration in netns path netfilter: nf_tables: hold mutex on netns pre_exit path netfilter: nf_tables: sanitize nft_set_desc_concat_parse() ==================== Link: https://lore.kernel.org/r/20220531215839.84765-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 2e8728c955ce0624b958eee6e030a37aca3a5d86 Author: Guoju Fang Date: Sat May 28 18:16:28 2022 +0800 net: sched: add barrier to fix packet stuck problem for lockless qdisc In qdisc_run_end(), the spin_unlock() only has store-release semantic, which guarantees all earlier memory access are visible before it. But the subsequent test_bit() has no barrier semantics so may be reordered ahead of the spin_unlock(). The store-load reordering may cause a packet stuck problem. The concurrent operations can be described as below, CPU 0 | CPU 1 qdisc_run_end() | qdisc_run_begin() . | . ----> /* may be reorderd here */ | . | . | . | spin_unlock() | set_bit() | . | smp_mb__after_atomic() ---- test_bit() | spin_trylock() . | . Consider the following sequence of events: CPU 0 reorder test_bit() ahead and see MISSED = 0 CPU 1 calls set_bit() CPU 1 calls spin_trylock() and return fail CPU 0 executes spin_unlock() At the end of the sequence, CPU 0 calls spin_unlock() and does nothing because it see MISSED = 0. The skb on CPU 1 has beed enqueued but no one take it, until the next cpu pushing to the qdisc (if ever ...) will notice and dequeue it. This patch fix this by adding one explicit barrier. As spin_unlock() and test_bit() ordering is a store-load ordering, a full memory barrier smp_mb() is needed here. Fixes: a90c57f2cedd ("net: sched: fix packet stuck problem for lockless qdisc") Signed-off-by: Guoju Fang Link: https://lore.kernel.org/r/20220528101628.120193-1-gjfang@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 0a1e19c8a639545ab5912913aba2dd3893cf72fa Author: Rob Herring Date: Wed May 25 20:41:48 2022 -0500 dt-bindings: net: Fix unevaluatedProperties warnings in examples The 'unevaluatedProperties' schema checks is not fully working and doesn't catch some cases where there's a $ref to another schema. A fix is pending, but results in new warnings in examples. Fix the warnings by removing spurious properties or adding missing properties to the schema. Signed-off-by: Rob Herring Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20220526014149.2872762-1-robh@kernel.org commit bcd7ec2cd720d5034a95d42f7ba3276b5e917bda Author: Rob Herring Date: Wed May 25 16:01:16 2022 -0500 dt-bindings: PCI: socionext,uniphier-pcie: Add missing child interrupt controller The Socionext interrupt controller internal to the the PCI block isn't documented which causes warnings when unevaluatedProperties check is also fixed. Add the 'interrupt-controller' child node and properties and fixup the example so that interrupt properties can be parsed. Signed-off-by: Rob Herring Reviewed-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20220525210117.2489333-1-robh@kernel.org commit cdc46fa81cc00b8ae222f979320a14b902acc074 Author: Rob Herring Date: Wed May 25 20:41:18 2022 -0500 dt-bindings: usb: snps,dwc3: Add missing 'dma-coherent' property The 'unevaluatedProperties' schema checks is not fully working and doesn't catch some cases where there's a $ref to another schema. A fix is pending, but results in new warnings in examples. Some DWC3 implementations such as Xilinx are hooked up coherently and need to set the 'dma-coherent' property. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220526014118.2872057-1-robh@kernel.org commit 15e1a9bc41c9e263d1f925f4d5b7e91043470720 Author: Laurent Pinchart Date: Tue May 10 23:05:43 2022 +0300 dt-bindings: soc: imx8mp-media-blk-ctrl: Fix DT example The DT example incorrectly names the ISP power domain "isp1" instead of "isp". This causes a validation failure: Documentation/devicetree/bindings/soc/imx/fsl,imx8mp-media-blk-ctrl.example.dtb: blk-ctl@32ec0000: power-domain-names:7: 'isp' was expected From schema: Documentation/devicetree/bindings/soc/imx/fsl,imx8mp-media-blk-ctrl.yaml Fix it. Fixes: 8b3dd27bfe47 ("dt-bindings: soc: Add i.MX8MP media block control DT bindings") Reported-by: Rob Herring Signed-off-by: Laurent Pinchart Reviewed-by: Paul Elder Acked-by: Rob Herring Reviewed-by: Peng Fan Acked-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220510200543.13482-1-laurent.pinchart@ideasonboard.com commit bf23729c7a5f44f0e863666b9364a64741fd3241 Merge: e573a3cd56d10 9bdc1992c925a Author: Dave Airlie Date: Wed Jun 1 10:56:11 2022 +1000 Merge tag 'amd-drm-next-5.19-2022-05-26-2' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.19-2022-05-26-2: amdgpu: - Update fdinfo to the common drm format UAPI: - Add VM_NOALLOC GPUVM attribute to prevent buffers for going into the MALL Add AMDGPU_GEM_CREATE_DISCARDABLE flag to create buffers that can be discarded on eviction Mesa code which uses these: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16466 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220526202546.66860-1-alexander.deucher@amd.com commit e573a3cd56d10664a89f199606d3c827fd744fd5 Merge: c4955d9cd2fc5 62e9bd20035b5 Author: Dave Airlie Date: Wed Jun 1 10:37:20 2022 +1000 Merge tag 'amd-drm-next-5.19-2022-05-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.19-2022-05-26: amdgpu: - Link training fixes - DPIA fixes - Misc code cleanups - Aux fixes - Hotplug fixes - More FP clean up - Misc GFX9/10 fixes - Fix a possible memory leak in SMU shutdown - SMU 13 updates - RAS fixes - TMZ fixes - GC 11 updates - SMU 11 metrics fixes - Fix coverage blend mode for overlay plane - Note DDR vs LPDDR memory - Fuzz fix for CS IOCTL - Add new PCI DID amdkfd: - Clean up hive setup - Misc fixes radeon: - Fix a possible NULL pointer dereference Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220526200641.64097-1-alexander.deucher@amd.com commit 700170bf6b4d773e328fa54ebb70ba444007c702 Merge: 1501f707d2b24 118f09eda21d3 Author: Linus Torvalds Date: Tue May 31 16:58:24 2022 -0700 Merge tag 'nfs-for-5.19-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Add support for 'dacl' and 'sacl' attributes Bugfixes and Cleanups: - Fixes for reporting mapping errors - Fixes for memory allocation errors - Improve warning message when locks are lost - Update documentation for the nfs4_unique_id parameter - Add an explanation of NFSv4 client identifiers - Ensure the i_size attribute is written to the fscache storage - Fix freeing uninitialized nfs4_labels - Better handling when xprtrdma bc_serv is NULL - Mark qualified async operations as MOVEABLE tasks" * tag 'nfs-for-5.19-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4.1 mark qualified async operations as MOVEABLE tasks xprtrdma: treat all calls not a bcall when bc_serv is NULL NFSv4: Fix free of uninitialized nfs4_label on referral lookup. NFS: Pass i_size to fscache_unuse_cookie() when a file is released Documentation: Add an explanation of NFSv4 client identifiers NFS: update documentation for the nfs4_unique_id parameter NFS: Improve warning message when locks are lost. NFSv4.1: Enable access to the NFSv4.1 'dacl' and 'sacl' attributes NFSv4: Add encoders/decoders for the NFSv4.1 dacl and sacl attributes NFSv4: Specify the type of ACL to cache NFSv4: Don't hold the layoutget locks across multiple RPC calls pNFS/files: Fall back to I/O through the MDS on non-fatal layout errors NFS: Further fixes to the writeback error handling NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout NFS: Memory allocation failures are not server fatal errors NFS: Don't report errors from nfs_pageio_complete() more than once NFS: Do not report flush errors in nfs_write_end() NFS: Don't report ENOSPC write errors twice NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report EINTR/ERESTARTSYS as mapping errors commit 1501f707d2b24316b41d45bdc95a73bc8cc8dd49 Merge: 2a5699b0de4ee 2d1fe8a86bf5e Author: Linus Torvalds Date: Tue May 31 16:52:59 2022 -0700 Merge tag 'f2fs-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've refactored the existing atomic write support implemented by in-memory operations to have storing data in disk temporarily, which can give us a benefit to accept more atomic writes. At the same time, we removed the existing volatile write support. We've also revisited the file pinning and GC flows and found some corner cases which contributeed abnormal system behaviours. As usual, there're several minor code refactoring for readability, sanity check, and clean ups. Enhancements: - allow compression for mmap files in compress_mode=user - kill volatile write support - change the current atomic write way - give priority to select unpinned section for foreground GC - introduce data read/write showing path info - remove unnecessary f2fs_lock_op in f2fs_new_inode Bug fixes: - fix the file pinning flow during checkpoint=disable and GCs - fix foreground and background GCs to select the right victims and get free sections on time - fix GC flags on defragmenting pages - avoid an infinite loop to flush node pages - fix fallocate to use file_modified to update permissions consistently" * tag 'f2fs-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (40 commits) f2fs: fix to tag gcing flag on page during file defragment f2fs: replace F2FS_I(inode) and sbi by the local variable f2fs: add f2fs_init_write_merge_io function f2fs: avoid unneeded error handling for revoke_entry_slab allocation f2fs: allow compression for mmap files in compress_mode=user f2fs: fix typo in comment f2fs: make f2fs_read_inline_data() more readable f2fs: fix to do sanity check for inline inode f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: don't use casefolded comparison for "." and ".." f2fs: do not stop GC when requiring a free section f2fs: keep wait_ms if EAGAIN happens f2fs: introduce f2fs_gc_control to consolidate f2fs_gc parameters f2fs: reject test_dummy_encryption when !CONFIG_FS_ENCRYPTION f2fs: kill volatile write support f2fs: change the current atomic write way f2fs: don't need inode lock for system hidden quota f2fs: stop allocating pinned sections if EAGAIN happens f2fs: skip GC if possible when checkpoint disabling f2fs: give priority to select unpinned section for foreground GC ... commit f66f8b94e7f2f4ac9fffe710be231ca8f25c5057 Author: Ronnie Sahlberg Date: Wed Jun 1 08:48:38 2022 +1000 cifs: when extending a file with falloc we should make files not-sparse as this is the only way to make sure the region is allocated. Fix the conditional that was wrong and only tried to make already non-sparse files non-sparse. Cc: stable@vger.kernel.org Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 2a5699b0de4ee623d77f183c8e8e62691bd60a70 Merge: f8a52af9d00d5 e98a860f65428 Author: Linus Torvalds Date: Tue May 31 14:38:10 2022 -0700 Merge tag 'leds-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: "Most significant here is the driver for Qualcomm LPG. Apparently it drives backlight on some boards, so it is quite important for some people" * tag 'leds-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: leds: qcom-lpg: Require pattern to follow documentation leds: lp50xx: Remove duplicated error reporting in .remove() leds: qcom-lpg: add missing PWM dependency leds: ktd2692: Make aux-gpios optional dt-bindings: leds: convert ktd2692 bindings to yaml leds: ktd2692: Avoid duplicate error messages on probe deferral leds: is31fl32xx: Improve error reporting in .remove() leds: Move pwm-multicolor driver into rgb directory leds: Add PWM multicolor driver dt-bindings: leds: Add multicolor PWM LED bindings dt-bindings: leds: Optional multi-led unit address leds: regulator: Make probeable from device tree leds: regulator: Add dev helper variable dt-bindings: leds: Add regulator-led binding leds: pca9532: Make pca9532_destroy_devices() return void leds: Add pm8350c support to Qualcomm LPG driver dt-bindings: leds: Add pm8350c pmic support leds: Add driver for Qualcomm LPG dt-bindings: leds: Add Qualcomm Light Pulse Generator binding commit f8a52af9d00d59fd887d8ad1fa0c2c88a5d775b9 Merge: 35b51afd23c98 3cd4030da3a9b Author: Linus Torvalds Date: Tue May 31 14:34:00 2022 -0700 Merge tag 'i2c-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Only driver updates for 5.19. Bigger changes are for Meson, NPCM, and R-Car, but there are also changes all over the place" * tag 'i2c-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (34 commits) i2c: meson: fix typo in comment i2c: rcar: use flags instead of atomic_xfer i2c: rcar: REP_AFTER_RD is not a persistent flag i2c: rcar: use BIT macro consistently i2c: qcom-geni: remove unnecessary conditions i2c: mt7621: Use devm_platform_get_and_ioremap_resource() i2c: rcar: refactor handling of first message i2c: rcar: avoid race condition with SMIs i2c: xiic: Correct the datatype for rx_watermark i2c: rcar: fix PM ref counts in probe error paths i2c: npcm: Handle spurious interrupts i2c: npcm: Correct register access width i2c: npcm: Add tx complete counter i2c: npcm: Fix timeout calculation i2c: npcm: Remove unused variable clk_regmap i2c: npcm: Change the way of getting GCR regmap i2c: xiic: Fix Tx Interrupt path for grouped messages i2c: xiic: Fix coding style issues i2c: xiic: return value of xiic_reinit i2c: cadence: Increase timeout per message if necessary ... commit 97629b237a8cb7ac655c3969b8d5e57300ff6598 Author: wenxu Date: Wed May 25 21:25:46 2022 -0400 netfilter: flowtable: fix nft_flow_route source address for nat case For snat and dnat cases, the saddr should be taken from reverse tuple. Fixes: 3412e1641828 (netfilter: flowtable: nft_flow_route use more data for reverse route) Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit f1896d45fee90a868dfd0b3cc119e4cc1bbd7ca2 Author: wenxu Date: Wed May 25 21:25:45 2022 -0400 netfilter: flowtable: fix missing FLOWI_FLAG_ANYSRC flag The nf_flow_table gets route through ip_route_output_key. If the saddr is not local one, then FLOWI_FLAG_ANYSRC flag should be set. Without this flag, the route lookup for other_dst will fail. Fixes: 3412e1641828 (netfilter: flowtable: nft_flow_route use more data for reverse route) Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Author: Pablo Neira Ayuso Date: Mon May 30 18:24:06 2022 +0200 netfilter: nf_tables: double hook unregistration in netns path __nft_release_hooks() is called from pre_netns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again. [ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] [ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables] [ 565.308518] raw_notifier_call_chain+0x63/0x80 [ 565.312386] unregister_netdevice_many+0x54f/0xb50 Unregister and destroy netdev hook from netns pre_exit via kfree_rcu so the NETDEV_UNREGISTER path see unregistered hooks. Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Pablo Neira Ayuso commit 3923b1e4406680d57da7e873da77b1683035d83f Author: Pablo Neira Ayuso Date: Mon May 30 18:24:05 2022 +0200 netfilter: nf_tables: hold mutex on netns pre_exit path clean_net() runs in workqueue while walking over the lists, grab mutex. Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Pablo Neira Ayuso commit fecf31ee395b0295f2d7260aa29946b7605f7c85 Author: Pablo Neira Ayuso Date: Fri May 27 09:56:18 2022 +0200 netfilter: nf_tables: sanitize nft_set_desc_concat_parse() Add several sanity checks for nft_set_desc_concat_parse(): - validate desc->field_count not larger than desc->field_len array. - field length cannot be larger than desc->field_len (ie. U8_MAX) - total length of the concatenation cannot be larger than register array. Joint work with Florian Westphal. Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") Reported-by: Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 35b51afd23c98e2f055ac563aca36173a12588b9 Merge: e1cbc3b96a997 7699f7aacf3eb Author: Linus Torvalds Date: Tue May 31 14:10:54 2022 -0700 Merge tag 'riscv-for-linus-5.19-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for the Svpbmt extension, which allows memory attributes to be encoded in pages - Support for the Allwinner D1's implementation of page-based memory attributes - Support for running rv32 binaries on rv64 systems, via the compat subsystem - Support for kexec_file() - Support for the new generic ticket-based spinlocks, which allows us to also move to qrwlock. These should have already gone in through the asm-geneic tree as well - A handful of cleanups and fixes, include some larger ones around atomics and XIP * tag 'riscv-for-linus-5.19-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (51 commits) RISC-V: Prepare dropping week attribute from arch_kexec_apply_relocations[_add] riscv: compat: Using seperated vdso_maps for compat_vdso_info RISC-V: Fix the XIP build RISC-V: Split out the XIP fixups into their own file RISC-V: ignore xipImage RISC-V: Avoid empty create_*_mapping definitions riscv: Don't output a bogus mmu-type on a no MMU kernel riscv: atomic: Add custom conditional atomic operation implementation riscv: atomic: Optimize dec_if_positive functions riscv: atomic: Cleanup unnecessary definition RISC-V: Load purgatory in kexec_file RISC-V: Add purgatory RISC-V: Support for kexec_file on panic RISC-V: Add kexec_file support RISC-V: use memcpy for kexec_file mode kexec_file: Fix kexec_file.c build error for riscv platform riscv: compat: Add COMPAT Kbuild skeletal support riscv: compat: ptrace: Add compat_arch_ptrace implement riscv: compat: signal: Add rt_frame implementation riscv: add memory-type errata for T-Head ... commit 5f92df8ddacb4b97f6865a3bf687f240072f4f68 Author: Randy Dunlap Date: Tue May 31 08:54:02 2022 -0700 Input: raspberrypi-ts - add missing HAS_IOMEM dependency Since JOYSTICK_SENSEHAT selects MFD_SIMPLE_MFD_I2C and the latter depends on HAS_IOMEM, and since 'select' does not follow any dependency chains, JOYSTICK_SENSEHAT should also depend on HAS_IOMEM to prevent a kconfig warning and a build error: WARNING: unmet direct dependencies detected for MFD_SIMPLE_MFD_I2C Depends on [n]: HAS_IOMEM [=n] && I2C [=y] Selected by [y]: - JOYSTICK_SENSEHAT [=y] && INPUT_JOYSTICK [=y] && INPUT [=y] && I2C [=y] s390-linux-ld: drivers/mfd/simple-mfd-i2c.o: in function `simple_mfd_i2c_probe': simple-mfd-i2c.c:(.text+0xc8): undefined reference to `devm_mfd_add_devices' Fixes: 41657514c796 ("Input: add Raspberry Pi Sense HAT joystick driver") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20220531022942.16340-1-rdunlap@infradead.org Signed-off-by: Dmitry Torokhov commit 118f09eda21d392e1eeb9f8a4bee044958cccf20 Author: Olga Kornievskaia Date: Wed May 25 12:12:59 2022 -0400 NFSv4.1 mark qualified async operations as MOVEABLE tasks Mark async operations such as RENAME, REMOVE, COMMIT MOVEABLE for the nfsv4.1+ sessions. Fixes: 85e39feead948 ("NFSv4.1 identify and mark RPC tasks that can move between transports") Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit 11270e7ca268e8d61b5d9e5c3a54bd1550642c9c Author: Kinglong Mee Date: Sun May 22 20:36:48 2022 +0800 xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug message at rpcrdma_bc_receive_call are, [56579.837169] RPC: rpcrdma_bc_receive_call: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdma_bc_receive_call: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 After that, rpcrdma_bc_receive_call will meets NULL pointer as, [ 226.057890] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 ... [ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878] rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] [ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] [ 226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] [ 226.060257] process_one_work+0x1a7/0x360 [ 226.060367] ? create_worker+0x1a0/0x1a0 [ 226.060440] worker_thread+0x30/0x390 [ 226.060500] ? create_worker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10 [ 226.060724] ret_from_fork+0x35/0x40 ... Signed-off-by: Kinglong Mee Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker commit c3ed222745d9ad7b69299b349a64ba533c64a34f Author: Benjamin Coddington Date: Sat May 14 07:05:13 2022 -0400 NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send along the already-allocated fattr along with nfs4_fs_locations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as: PID: 790 TASK: ffff88811b43c000 CPU: 0 COMMAND: "ls" #0 [ffffc90000857920] panic at ffffffff81b9bfde #1 [ffffc900008579c0] do_trap at ffffffff81023a9b #2 [ffffc90000857a10] do_error_trap at ffffffff81023b78 #3 [ffffc90000857a58] exc_stack_segment at ffffffff81be1f45 #4 [ffffc90000857a80] asm_exc_stack_segment at ffffffff81c009de #5 [ffffc90000857b08] nfs_lookup at ffffffffa0302322 [nfs] #6 [ffffc90000857b70] __lookup_slow at ffffffff813a4a5f #7 [ffffc90000857c60] walk_component at ffffffff813a86c4 #8 [ffffc90000857cb8] path_lookupat at ffffffff813a9553 #9 [ffffc90000857cf0] filename_lookup at ffffffff813ab86b Suggested-by: Trond Myklebust Fixes: 9558a007dbc3 ("NFS: Remove the label from the nfs4_lookup_res struct") Signed-off-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 1c5de097bea31760c3f0467ac0c84ba0dc3525d5 Author: Saeed Mahameed Date: Fri Feb 19 23:10:47 2021 -0800 net/mlx5: Fix mlx5_get_next_dev() peer device matching In some use-cases, mlx5 instances will need to search for their peer device (the other port on the same HCA). For that, mlx5 device matching mechanism relied on auxiliary_find_device() to search, and used a bad matching callback function. This approach has two issues: 1) next_phys_dev() the matching function, assumed all devices are of the type mlx5_adev (mlx5 auxiliary device) which is wrong and could lead to crashes, this worked for a while, since only lately other drivers started registering auxiliary devices. 2) using the auxiliary class bus (auxiliary_find_device) to search for mlx5_core_dev devices, who are actually PCIe device instances, is wrong. This works since mlx5_core always has at least one mlx5_adev instance hanging around in the aux bus. As suggested by others we can fix 1. by comparing device names prefixes if they have the string "mlx5_core" in them, which is not a best practice ! but even with that fixed, still 2. needs fixing, we are trying to match pcie device peers so we should look in the right bus (pci bus), hence this fix. The fix: 1) search the pci bus for mlx5 peer devices, instead of the aux bus 2) to validated devices are the same type "mlx5_core_dev" compare if they have the same driver, which is bulletproof. This wouldn't have worked with the aux bus since the various mlx5 aux device types don't share the same driver, even if they share the same device wrapper struct (mlx5_adev) "which helped to find the parent device" Fixes: a925b5e309c9 ("net/mlx5: Register mlx5 devices to auxiliary virtual bus") Reported-by: Alexander Lobakin Reported-by: Maher Sanalla Signed-off-by: Saeed Mahameed Reviewed-by: Leon Romanovsky Reviewed-by: Mark Bloch Reviewed-by: Maher Sanalla commit f6279f113ad593971999c877eb69dc3d36a75894 Author: Maxim Mikityanskiy Date: Mon May 23 15:39:13 2022 +0300 net/mlx5e: Update netdev features after changing XDP state Some features (LRO, HW GRO) conflict with XDP. If there is an attempt to enable such features while XDP is active, they will be set to `off [requested on]`. In order to activate these features after XDP is turned off, the driver needs to call netdev_update_features(). This commit adds this missing call after XDP state changes. Fixes: cf6e34c8c22f ("net/mlx5e: Properly block LRO when XDP is enabled") Fixes: b0617e7b3500 ("net/mlx5e: Properly block HW GRO when XDP is enabled") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 3fc2a9e89b3508a5cc0c324f26d7b4740ba8c456 Author: Changcheng Liu Date: Tue Apr 26 21:28:14 2022 +0800 net/mlx5: correct ECE offset in query qp output ECE field should be after opt_param_mask in query qp output. Fixes: 6b646a7e4af6 ("net/mlx5: Add ability to read and write ECE options") Signed-off-by: Changcheng Liu Signed-off-by: Saeed Mahameed commit 2e642afb61b24401a7ec819d27ddcd69c7c29784 Author: Maxim Mikityanskiy Date: Fri Apr 15 16:19:15 2022 +0300 net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition When the driver activates the channels, it assumes NAPI isn't running yet. mlx5e_activate_rq posts a NOP WQE to ICOSQ to trigger a hardware interrupt and start NAPI, which will run mlx5e_alloc_rx_mpwqe and post UMR WQEs to ICOSQ to be able to receive packets with striding RQ. Unfortunately, a race condition is possible if NAPI is triggered by something else (for example, TX) at a bad timing, before mlx5e_activate_rq finishes. In this case, mlx5e_alloc_rx_mpwqe may post UMR WQEs to ICOSQ, and with the bad timing, the wqe_info of the first UMR may be overwritten by the wqe_info of the NOP posted by mlx5e_activate_rq. The consequence is that icosq->db.wqe_info[0].num_wqebbs will be changed from MLX5E_UMR_WQEBBS to 1, disrupting the integrity of the array-based linked list in wqe_info[]. mlx5e_poll_ico_cq will hang in an infinite loop after processing wqe_info[0], because after the corruption, the next item to be processed will be wqe_info[1], which is filled with zeros, and `sqcc += wi->num_wqebbs` will never move further. This commit fixes this race condition by using async_icosq to post the NOP and trigger the interrupt. async_icosq is always protected with a spinlock, eliminating the race condition. Fixes: bc77b240b3c5 ("net/mlx5e: Add fragmented memory support for RX multi packet WQE") Signed-off-by: Maxim Mikityanskiy Reported-by: Karsten Nielsen Reviewed-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit 1f2856cde64baa78475e6d3c601fb7b7f693a161 Author: Paul Blakey Date: Mon May 23 19:12:21 2022 +0300 net/mlx5: CT: Fix header-rewrite re-use for tupels Tuple entries that don't have nat configured for them which are added to the ct nat table will always create a new modify header, as we don't check for possible re-use on them. The same for tuples that have nat configured for them but are added to ct table. Fix the above by only avoiding wasteful re-use lookup for actually natted entries in ct nat table. Fixes: 7fac5c2eced3 ("net/mlx5: CT: Avoid reusing modify header context for natted entries") Signed-off-by: Paul Blakey Reviewed-by: Ariel Levkovich Signed-off-by: Saeed Mahameed commit 66cb64e292d21588bdb831f08a7ec0ff04d6380d Author: Maor Dickman Date: Mon May 2 10:51:30 2022 +0300 net/mlx5e: TC NIC mode, fix tc chains miss table The cited commit changed promisc table to be created on demand with the highest priority in the NIC table replacing the vlan table, this caused tc NIC tables miss flow to skip the prmoisc table because it use vlan table as miss table. OVS offload in NIC mode use promisc by default so any unicast packet which will be handled by tc NIC tables miss flow will skip the promisc rule and will be dropped. Fix this by adding new empty table in new tc level with low priority and point the nic tc chain miss to it, the new table is managed so it will point to vlan table if promisc is disabled and to promisc table if enabled. Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode") Signed-off-by: Maor Dickman Reviewed-by: Paul Blakey Reviewed-by: Ariel Levkovich Signed-off-by: Saeed Mahameed commit 80b2bd737d0e833e6a2b77e482e5a714a79c86a4 Author: Leon Romanovsky Date: Tue May 24 15:59:27 2022 +0300 net/mlx5: Don't use already freed action pointer The call to mlx5dr_action_destroy() releases "action" memory. That pointer is set to miss_action later and generates the following smatch error: drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c:53 set_miss_action() warn: 'action' was already freed. Make sure that the pointer is always valid by setting NULL after destroy. Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation") Reported-by: Dan Carpenter Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 4caae58406f8ceb741603eee460d79bacca9b1b5 Author: Sarthak Kukreti Date: Tue May 31 15:56:40 2022 -0400 dm verity: set DM_TARGET_IMMUTABLE feature flag The device-mapper framework provides a mechanism to mark targets as immutable (and hence fail table reloads that try to change the target type). Add the DM_TARGET_IMMUTABLE flag to the dm-verity target's feature flags to prevent switching the verity target with a different target type. Fixes: a4ffc152198e ("dm: add verity target") Cc: stable@vger.kernel.org Signed-off-by: Sarthak Kukreti Reviewed-by: Kees Cook Signed-off-by: Mike Snitzer commit 0d5106a80e08cbbb273f35dc373f4f19e5ec8b03 Author: Enzo Matsumiya Date: Tue May 31 14:27:18 2022 -0300 cifs: remove repeated debug message on cifs_put_smb_ses() Similar message is printed a few lines later in the same function Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 833e53a4ffe92e742e99347c68d99dc33986598b Author: Lorenzo Pieralisi Date: Sat May 28 16:14:11 2022 +0100 MAINTAINERS: Update Lorenzo Pieralisi's email address I will soon lose my @arm.com email address, so to prevent any possible issue let's update all kernel references (inclusive of .mailmap) to my @kernel.org alias ahead of time. My @arm.com address is still working and will likely resume to work at some point in the future; nonetheless, it is safer to switch to the @kernel.org alias from now onwards so that continuity is guaranteed. Link: https://lore.kernel.org/r/20220528151411.29810-1-lorenzo.pieralisi@arm.com Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Will Deacon Cc: Catalin Marinas commit 12068bb346db5776d0ec9bb4cd073f8427a1ac92 Author: Bjorn Helgaas Date: Thu May 26 16:52:23 2022 -0500 PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 92597f97a40b ("PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold") omitted braces around the new Elo i2 entry, so it overwrote the existing Gigabyte X299 entry. Add the appropriate braces. Found by: $ make W=1 drivers/pci/pci.o CC drivers/pci/pci.o drivers/pci/pci.c:2974:12: error: initialized field overwritten [-Werror=override-init] 2974 | .ident = "Elo i2", | ^~~~~~~~ Link: https://lore.kernel.org/r/20220526221258.GA409855@bhelgaas Fixes: 92597f97a40b ("PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold") Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v5.15+ commit f4fd559de3434c44bed1d2912bd0c75cfa42898b Author: Bjorn Helgaas Date: Wed May 11 15:18:56 2022 -0500 Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs" This reverts commit 830aa6f29f07a4e2f1a947dfa72b3ccddb46dd21. This is part of a revert of the following commits: 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend") 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators") 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators") 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs") Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs"), which appeared in v5.17-rc1, broke booting on the Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an Asynchronous SError Interrupt, and after further commits here is a black screen on HDMI and no output on the serial console. This does not seem to affect the Raspberry Pi 4 B. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925 Link: https://lore.kernel.org/r/20220511201856.808690-5-helgaas@kernel.org Reported-by: Cyril Brulebois Signed-off-by: Bjorn Helgaas commit 420be2f7ebe60c9ba3e332f5290017cd168e2bf8 Author: Bjorn Helgaas Date: Wed May 11 15:18:55 2022 -0500 Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators" This reverts commit 67211aadcb4b968d0fdc57bc27240fa71500c2d4. This is part of a revert of the following commits: 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend") 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators") 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators") 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs") Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs"), which appeared in v5.17-rc1, broke booting on the Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an Asynchronous SError Interrupt, and after further commits here is a black screen on HDMI and no output on the serial console. This does not seem to affect the Raspberry Pi 4 B. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925 Link: https://lore.kernel.org/r/20220511201856.808690-4-helgaas@kernel.org Reported-by: Cyril Brulebois Signed-off-by: Bjorn Helgaas commit 212942609d83b591f5a2f2691df122d13aa3a87d Author: Bjorn Helgaas Date: Wed May 11 15:18:54 2022 -0500 Revert "PCI: brcmstb: Add control of subdevice voltage regulators" This reverts commit 93e41f3fca3d4a0f927b784012338c37f80a8a80. This is part of a revert of the following commits: 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend") 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators") 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators") 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs") Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs"), which appeared in v5.17-rc1, broke booting on the Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an Asynchronous SError Interrupt, and after further commits here is a black screen on HDMI and no output on the serial console. This does not seem to affect the Raspberry Pi 4 B. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925 Link: https://lore.kernel.org/r/20220511201856.808690-3-helgaas@kernel.org Reported-by: Cyril Brulebois Signed-off-by: Bjorn Helgaas commit 7894025c783ca36394d3afe49c8cfb4c830b82fe Author: Bjorn Helgaas Date: Wed May 11 15:18:53 2022 -0500 Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend" This reverts commit 11ed8b8624b8085f706864b4addcd304b1e4fc38. This is part of a revert of the following commits: 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend") 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators") 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators") 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs") Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs"), which appeared in v5.17-rc1, broke booting on the Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an Asynchronous SError Interrupt, and after further commits here is a black screen on HDMI and no output on the serial console. This does not seem to affect the Raspberry Pi 4 B. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925 Link: https://lore.kernel.org/r/20220511201856.808690-2-helgaas@kernel.org Reported-by: Cyril Brulebois Signed-off-by: Bjorn Helgaas commit 9571f829f30a89b888ec4c3a72f5a04573f0e058 Author: Mike Snitzer Date: Tue May 31 12:16:49 2022 -0400 dm table: fix dm_table_supports_poll to return false if no data devices It was reported that the "generic/250" test in xfstests (which uses the dm-error target) demonstrates a regression where the kernel crashes in bioset_exit(). Since commit cfc97abcbe0b ("dm: conditionally enable BIOSET_PERCPU_CACHE for dm_io bioset") the bioset_init() for the dm_io bioset will setup the bioset's per-cpu alloc cache if all devices have QUEUE_FLAG_POLL set. But there was an bug where a target that doesn't have any data devices (and that doesn't even set the .iterate_devices dm target callback) will incorrectly return true from dm_table_supports_poll(). Fix this by updating dm_table_supports_poll() to follow dm-table.c's well-worn pattern for testing that _all_ targets in a DM table do in fact have underlying devices that set QUEUE_FLAG_POLL. NOTE: An additional block fix is still needed so that bio_alloc_cache_destroy() clears the bioset's ->cache member. Otherwise, a DM device's table reload that transitions the DM device's bioset from using a per-cpu alloc cache to _not_ using one will result in bioset_exit() crashing in bio_alloc_cache_destroy() because dm's dm_io bioset ("io_bs") was left with a stale ->cache member. Fixes: cfc97abcbe0b ("dm: conditionally enable BIOSET_PERCPU_CACHE for dm_io bioset") Reported-by: Matthew Wilcox Reported-by: Dave Chinner Signed-off-by: Mike Snitzer commit e1cbc3b96a9974746b2a80c3a6c8a0f7eff7b1b5 Merge: 3335d55502562 b0dacee202efb Author: Linus Torvalds Date: Tue May 31 09:56:54 2022 -0700 Merge tag 'iommu-updates-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Intel VT-d driver updates: - Domain force snooping improvement. - Cleanups, no intentional functional changes. - ARM SMMU driver updates: - Add new Qualcomm device-tree compatible strings - Add new Nvidia device-tree compatible string for Tegra234 - Fix UAF in SMMUv3 shared virtual addressing code - Force identity-mapped domains for users of ye olde SMMU legacy binding - Minor cleanups - Fix a BUG_ON in the vfio_iommu_group_notifier: - Groundwork for upcoming iommufd framework - Introduction of DMA ownership so that an entire IOMMU group is either controlled by the kernel or by user-space - MT8195 and MT8186 support in the Mediatek IOMMU driver - Make forcing of cache-coherent DMA more coherent between IOMMU drivers - Fixes for thunderbolt device DMA protection - Various smaller fixes and cleanups * tag 'iommu-updates-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (88 commits) iommu/amd: Increase timeout waiting for GA log enablement iommu/s390: Tolerate repeat attach_dev calls iommu/vt-d: Remove hard coding PGSNP bit in PASID entries iommu/vt-d: Remove domain_update_iommu_snooping() iommu/vt-d: Check domain force_snooping against attached devices iommu/vt-d: Block force-snoop domain attaching if no SC support iommu/vt-d: Size Page Request Queue to avoid overflow condition iommu/vt-d: Fold dmar_insert_one_dev_info() into its caller iommu/vt-d: Change return type of dmar_insert_one_dev_info() iommu/vt-d: Remove unneeded validity check on dev iommu/dma: Explicitly sort PCI DMA windows iommu/dma: Fix iova map result check bug iommu/mediatek: Fix NULL pointer dereference when printing dev_name iommu: iommu_group_claim_dma_owner() must always assign a domain iommu/arm-smmu: Force identity domains for legacy binding iommu/arm-smmu: Support Tegra234 SMMU dt-bindings: arm-smmu: Add compatible for Tegra234 SOC dt-bindings: arm-smmu: Document nvidia,memory-controller property iommu/arm-smmu-qcom: Add SC8280XP support dt-bindings: arm-smmu: Add compatible for Qualcomm SC8280XP ... commit 3335d5550256210c9b213f67240221633d8f7b53 Merge: 8ab2afa23bd19 78b5f52ab6f60 Author: Linus Torvalds Date: Tue May 31 09:46:23 2022 -0700 Merge tag 'microblaze-v5.19' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze updates from Michal Simek: - Fix issues with freestanding - Wire memblock_dump_all() - Add support for memory reservation from DT * tag 'microblaze-v5.19' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: fix typos in comments microblaze: Add support for reserved memory defined by DT microblaze: Wire memblock_dump_all() microblaze: Use simple memmove/memcpy implementation from lib/string.c microblaze: Do loop unrolling for optimized memset implementation microblaze: Use simple memset implementation from lib/string.c commit b2ffa407ed5dd931d6b0657cc8824aa0f4e73a7a Author: Mike Christie Date: Tue May 17 13:08:50 2022 -0500 vhost: rename vhost_work_dev_flush This patch renames vhost_work_dev_flush to just vhost_dev_flush to relfect that it flushes everything on the device and that drivers don't know/care that polls are based on vhost_works. Drivers just flush the entire device and polls, and works for vhost-scsi management TMFs and IO net virtqueues, etc all are flushed. Signed-off-by: Mike Christie Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Message-Id: <20220517180850.198915-9-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit f3a1aad9a448e40d4833913cbd50aeec538a74fe Author: Mike Christie Date: Tue May 17 13:08:49 2022 -0500 vhost-test: drop flush after vhost_dev_cleanup The flush after vhost_dev_cleanup is not needed because: 1. It doesn't do anything. vhost_dev_cleanup will stop the worker thread so the flush call will just return since the worker has not device. 2. It's not needed. The comment about jobs re-queueing themselves does not look correct because handle_vq does not requeue work. Signed-off-by: Mike Christie Acked-by: Jason Wang Message-Id: <20220517180850.198915-8-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit c3d284cf789ddf7a99ed7f414092ed9ea75aa883 Author: Mike Christie Date: Tue May 17 13:08:48 2022 -0500 vhost-scsi: drop flush after vhost_dev_cleanup The flush after vhost_dev_cleanup is not needed because: 1. It doesn't do anything. vhost_dev_cleanup will stop the worker thread so the flush call will just return since the worker has not device. 2. It's not needed for the re-queue case. vhost_scsi_evt_handle_kick grabs the mutex and if the backend is NULL will return without queueing a work. vhost_scsi_clear_endpoint will set the backend to NULL under the vq->mutex then drops the mutex and does a flush. So we know when vhost_scsi_clear_endpoint has dropped the mutex after clearing the backend no evt related work will be able to requeue. The flush would then make sure any queued evts are run and return. Signed-off-by: Mike Christie Acked-by: Jason Wang Message-Id: <20220517180850.198915-7-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 15538ba5ffaa5cbdfd11161ded503b27f5c1f0af Author: Andrey Ryabinin Date: Tue May 17 13:08:47 2022 -0500 vhost_vsock: simplify vhost_vsock_flush() vhost_vsock_flush() calls vhost_work_dev_flush(vsock->vqs[i].poll.dev) before vhost_work_dev_flush(&vsock->dev). This seems pointless as vsock->vqs[i].poll.dev is the same as &vsock->dev and several flushes in a row doesn't do anything useful, one is just enough. Signed-off-by: Andrey Ryabinin Reviewed-by: Stefano Garzarella Signed-off-by: Mike Christie Acked-by: Jason Wang Message-Id: <20220517180850.198915-6-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit c5514758ddd9a774d879b098bf7364c45a76bed5 Author: Andrey Ryabinin Date: Tue May 17 13:08:46 2022 -0500 vhost_test: remove vhost_test_flush_vq() vhost_test_flush_vq() just a simple wrapper around vhost_work_dev_flush() which seems have no value. It's just easier to call vhost_work_dev_flush() directly. Besides there is no point in obtaining vhost_dev pointer via 'n->vqs[index].poll.dev' while we can just use &n->dev. It's the same pointers, see vhost_test_open()/vhost_dev_init(). Signed-off-by: Andrey Ryabinin Signed-off-by: Mike Christie Reviewed-by: Chaitanya Kulkarni Acked-by: Jason Wang Message-Id: <20220517180850.198915-5-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 2c029f3298594c5160ae1036f03db607fa891484 Author: Andrey Ryabinin Date: Tue May 17 13:08:45 2022 -0500 vhost_net: get rid of vhost_net_flush_vq() and extra flush calls vhost_net_flush_vq() calls vhost_work_dev_flush() twice passing vhost_dev pointer obtained via 'n->poll[index].dev' and 'n->vqs[index].vq.poll.dev'. This is actually the same pointer, initialized in vhost_net_open()/vhost_dev_init()/vhost_poll_init() Remove vhost_net_flush_vq() and call vhost_work_dev_flush() directly. Do the flushes only once instead of several flush calls in a row which seems rather useless. Signed-off-by: Andrey Ryabinin [drop vhost_dev forward declaration in vhost.h] Signed-off-by: Mike Christie Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Message-Id: <20220517180850.198915-4-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 6ca84326c283e2f5d4ea920dec6f9d4272e4d124 Author: Mike Christie Date: Tue May 17 13:08:44 2022 -0500 vhost: flush dev once during vhost_dev_stop When vhost_work_dev_flush returns all work queued at that time will have completed. There is then no need to flush after every vhost_poll_stop call, and we can move the flush call to after the loop that stops the pollers. Signed-off-by: Mike Christie Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Message-Id: <20220517180850.198915-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 6fcf224c379f07c73fb972007c93db8c05d930d7 Author: Andrey Ryabinin Date: Tue May 17 13:08:43 2022 -0500 vhost: get rid of vhost_poll_flush() wrapper vhost_poll_flush() is a simple wrapper around vhost_work_dev_flush(). It gives wrong impression that we are doing some work over vhost_poll, while in fact it flushes vhost_poll->dev. It only complicate understanding of the code and leads to mistakes like flushing the same vhost_dev several times in a row. Just remove vhost_poll_flush() and call vhost_work_dev_flush() directly. Signed-off-by: Andrey Ryabinin [merge vhost_poll_flush removal from Stefano Garzarella] Signed-off-by: Mike Christie Reviewed-by: Chaitanya Kulkarni Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Message-Id: <20220517180850.198915-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit f4a8686ec7a34f940d36784872036fbacb1b4623 Author: Dan Carpenter Date: Mon May 23 11:33:26 2022 +0300 vhost-vdpa: return -EFAULT on copy_to_user() failure The copy_to_user() function returns the number of bytes remaining to be copied. However, we need to return a negative error code, -EFAULT, to the user. Fixes: 87f4c217413a ("vhost-vdpa: introduce uAPI to get the number of virtqueue groups") Fixes: e96ef636f154 ("vhost-vdpa: introduce uAPI to get the number of address spaces") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 1f97b9785076d32fbabb8fa23889f9969c84118d Author: Dan Carpenter Date: Mon May 23 11:30:57 2022 +0300 vdpasim: Off by one in vdpasim_set_group_asid() The > comparison needs to be >= to prevent an out of bounds access of the vdpasim->iommu[] array. The vdpasim->iommu[] is allocated in vdpasim_create() and it has vdpasim->dev_attr.nas elements. Fixes: 87e5afeac247 ("vdpasim: control virtqueue support") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 4f58afd6eb177a75dec61c65fdc72db31db93c82 Author: keliu Date: Fri May 27 07:33:02 2022 +0000 virtio: Directly use ida_alloc()/free() Use ida_alloc()/ida_free() instead of deprecated ida_simple_get()/ida_simple_remove() . Signed-off-by: keliu Message-Id: <20220527073302.2474073-1-liuke94@huawei.com> Signed-off-by: Michael S. Tsirkin commit 619e9e14ba3c97a80776c0b5a68a01caa41dd148 Author: Jason Wang Date: Fri May 27 14:01:20 2022 +0800 virtio: use WARN_ON() to warning illegal status value We used to use BUG_ON() in virtio_device_ready() to detect illegal status value, this seems sub-optimal since the value is under the control of the device. Switch to use WARN_ON() instead. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-10-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 8b4ec69d7e098a7ddf832e1e7840de53ed474c77 Author: Jason Wang Date: Fri May 27 14:01:19 2022 +0800 virtio: harden vring IRQ This is a rework on the previous IRQ hardening that is done for virtio-pci where several drawbacks were found and were reverted: 1) try to use IRQF_NO_AUTOEN which is not friendly to affinity managed IRQ that is used by some device such as virtio-blk 2) done only for PCI transport The vq->broken is re-used in this patch for implementing the IRQ hardening. The vq->broken is set to true during both initialization and reset. And the vq->broken is set to false in virtio_device_ready(). Then vring_interrupt() can check and return when vq->broken is true. And in this case, switch to return IRQ_NONE to let the interrupt core aware of such invalid interrupt to prevent IRQ storm. The reason of using a per queue variable instead of a per device one is that we may need it for per queue reset hardening in the future. Note that the hardening is only done for vring interrupt since the config interrupt hardening is already done in commit 22b7050a024d7 ("virtio: defer config changed notifications"). But the method that is used by config interrupt can't be reused by the vring interrupt handler because it uses spinlock to do the synchronization which is expensive. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-9-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit be83f04d2529e8dc4273efdd1ccf7b7502741071 Author: Jason Wang Date: Fri May 27 14:01:18 2022 +0800 virtio: allow to unbreak virtqueue This patch allows the new introduced __virtio_break_device() to unbreak the virtqueue. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-8-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 3a232277c1ac6df70552129a9722abc6ab250128 Author: Jason Wang Date: Fri May 27 14:01:17 2022 +0800 virtio-ccw: implement synchronize_cbs() This patch tries to implement the synchronize_cbs() for ccw. For the vring_interrupt() that is called via virtio_airq_handler(), the synchronization is simply done via the airq_info's lock. For the vring_interrupt() that is called via virtio_ccw_int_handler(), a per device rwlock is introduced and used in the synchronization method. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Halil Pasic Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-7-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 9e9b2893284fa0681ab5c0632d02214385a174c3 Author: Jason Wang Date: Fri May 27 14:01:16 2022 +0800 virtio-mmio: implement synchronize_cbs() Simply synchronize the platform irq that is used by us. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-6-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 48b3dd24382139a239a43bca7c1c632438d1dfb2 Author: Jason Wang Date: Fri May 27 14:01:15 2022 +0800 virtio-pci: implement synchronize_cbs() We can simply reuse vp_synchronize_vectors() for .synchronize_cbs(). Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-5-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 48b69959a8559db5df78661d9c6d5138c2f20871 Author: Jason Wang Date: Fri May 27 14:01:14 2022 +0800 virtio: introduce config op to synchronize vring callbacks This patch introduces new virtio config op to vring callbacks. Transport specific method is required to make sure the write before this function is visible to the vring_interrupt() that is called after the return of this function. For the transport that doesn't provide synchronize_vqs(), use synchornize_rcu() which synchronize with IRQ implicitly as a fallback. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Reviewed-by: Stefano Garzarella commit 0aa96837c3ded5de58782a07b88176f2f1d01404 Author: Jason Wang Date: Fri May 27 14:01:13 2022 +0800 virtio: use virtio_reset_device() when possible This allows us to do common extension without duplicating code. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Reviewed-by: Eugenio Pérez commit 2536b2ca15418c517e3629cc3dd757f811ce52b2 Author: Stefano Garzarella Date: Fri May 27 14:01:12 2022 +0800 virtio: use virtio_device_ready() in virtio_device_restore() It will allow us to do extension on virtio_device_ready() without duplicating code. Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Marc Zyngier Cc: Halil Pasic Cc: Cornelia Huck Cc: Vineeth Vijayan Cc: Peter Oberparleiter Cc: linux-s390@vger.kernel.org Reviewed-by: Cornelia Huck Signed-off-by: Stefano Garzarella Signed-off-by: Jason Wang Message-Id: <20220527060120.20964-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 242436973831aa97e8ce19533c6c912ea8def31b Author: Eugenio Pérez Date: Thu May 19 16:59:19 2022 +0200 vdpasim: allow to enable a vq repeatedly Code must be resilient to enable a queue many times. At the moment the queue is resetting so it's definitely not the expected behavior. v2: set vq->ready = 0 at disable. Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") Cc: stable@vger.kernel.org Signed-off-by: Eugenio Pérez Message-Id: <20220519145919.772896-1-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit ac33f84ba5ffcc6c8a4c3ee98c92f722feb64f43 Author: Zhu Lingshan Date: Sun Apr 24 15:28:06 2022 +0800 vDPA/ifcvf: fix uninitialized config_vector warning Static checkers are not informed that config_vector is controlled by vf->msix_vector_status, which can only be MSIX_VECTOR_SHARED_VQ_AND_CONFIG, MSIX_VECTOR_SHARED_VQ_AND_CONFIG and MSIX_VECTOR_DEV_SHARED. This commit uses an "if...elseif...else" code block to tell the checkers that it is a complete set, and config_vector can be initialized anyway Signed-off-by: Zhu Lingshan Reviewed-by: Dan Carpenter Message-Id: <20220424072806.1083189-1-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit ffbda8e9df10d1784d5427ec199e7d8308e3763f Author: Cindy Lu Date: Fri Apr 29 17:10:30 2022 +0800 vdpa/vp_vdpa : add vdpa tool support in vp_vdpa this patch is to add the support for vdpa tool in vp_vdpa here is the example steps modprobe vp_vdpa modprobe vhost_vdpa echo 0000:00:06.0>/sys/bus/pci/drivers/virtio-pci/unbind echo 1af4 1041 > /sys/bus/pci/drivers/vp-vdpa/new_id vdpa dev add name vdpa1 mgmtdev pci/0000:00:06.0 Signed-off-by: Cindy Lu Message-Id: <20220429091030.547434-1-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 0619eda83d905a9e8eedfb5699d6f520f901281c Author: Solomon Tan Date: Mon Apr 18 02:56:24 2022 +0000 virtio: Replace long long int with long long This patch addresses the checkpatch.pl warning that long long is preferred over long long int. Signed-off-by: Solomon Tan Message-Id: Signed-off-by: Michael S. Tsirkin commit 3153234097f6a0d06981565eb3eec3cb37dea8f8 Author: Solomon Tan Date: Mon Apr 18 02:54:35 2022 +0000 virtio: Replace unsigned with unsigned int This patch addresses the checkpatch.pl warning where unsigned int is preferred over unsigned. Signed-off-by: Solomon Tan Message-Id: Signed-off-by: Michael S. Tsirkin commit 4e0d352af04cf4e019d3e45229eaaff9e8ffb33d Author: lei he Date: Fri May 6 21:16:27 2022 +0800 virtio-crypto: enable retry for virtio-crypto-dev Enable retry for virtio-crypto-dev, so that crypto-engine can process cipher-requests parallelly. Cc: Michael S. Tsirkin Cc: Jason Wang Cc: Gonglei Reviewed-by: Gonglei Signed-off-by: lei he Signed-off-by: zhenwei pi Message-Id: <20220506131627.180784-6-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin commit a36bd0ad9fbf69d0d711b1c105954ce8d6cc144a Author: lei he Date: Fri May 6 21:16:26 2022 +0800 virtio-crypto: adjust dst_len at ops callback For some akcipher operations(eg, decryption of pkcs1pad(rsa)), the length of returned result maybe less than akcipher_req->dst_len, we need to recalculate the actual dst_len through the virt-queue protocol. Cc: Michael S. Tsirkin Cc: Jason Wang Cc: Gonglei Reviewed-by: Gonglei Signed-off-by: lei he Signed-off-by: zhenwei pi Message-Id: <20220506131627.180784-5-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 977231e8d45657871a86fe3c7bed94921d04e447 Author: zhenwei pi Date: Fri May 6 21:16:25 2022 +0800 virtio-crypto: wait ctrl queue instead of busy polling Originally, after submitting request into virtio crypto control queue, the guest side polls the result from the virt queue. This works like following: CPU0 CPU1 ... CPUx CPUy | | | | \ \ / / \--------spin_lock(&vcrypto->ctrl_lock)-------/ | virtqueue add & kick | busy poll virtqueue | spin_unlock(&vcrypto->ctrl_lock) ... There are two problems: 1, The queue depth is always 1, the performance of a virtio crypto device gets limited. Multi user processes share a single control queue, and hit spin lock race from control queue. Test on Intel Platinum 8260, a single worker gets ~35K/s create/close session operations, and 8 workers get ~40K/s operations with 800% CPU utilization. 2, The control request is supposed to get handled immediately, but in the current implementation of QEMU(v6.2), the vCPU thread kicks another thread to do this work, the latency also gets unstable. Tracking latency of virtio_crypto_alg_akcipher_close_session in 5s: usecs : count distribution 0 -> 1 : 0 | | 2 -> 3 : 7 | | 4 -> 7 : 72 | | 8 -> 15 : 186485 |************************| 16 -> 31 : 687 | | 32 -> 63 : 5 | | 64 -> 127 : 3 | | 128 -> 255 : 1 | | 256 -> 511 : 0 | | 512 -> 1023 : 0 | | 1024 -> 2047 : 0 | | 2048 -> 4095 : 0 | | 4096 -> 8191 : 0 | | 8192 -> 16383 : 2 | | This means that a CPU may hold vcrypto->ctrl_lock as long as 8192~16383us. To improve the performance of control queue, a request on control queue waits completion instead of busy polling to reduce lock racing, and gets completed by control queue callback. CPU0 CPU1 ... CPUx CPUy | | | | \ \ / / \--------spin_lock(&vcrypto->ctrl_lock)-------/ | virtqueue add & kick | ---------spin_unlock(&vcrypto->ctrl_lock)------ / / \ \ | | | | wait wait wait wait Test this patch, the guest side get ~200K/s operations with 300% CPU utilization. Cc: Michael S. Tsirkin Cc: Jason Wang Cc: Gonglei Reviewed-by: Gonglei Signed-off-by: zhenwei pi Message-Id: <20220506131627.180784-4-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 0756ad15b1fef287d4d8fa11bc36ea77a5c42e4a Author: zhenwei pi Date: Fri May 6 21:16:24 2022 +0800 virtio-crypto: use private buffer for control request Originally, all of the control requests share a single buffer( ctrl & input & ctrl_status fields in struct virtio_crypto), this allows queue depth 1 only, the performance of control queue gets limited by this design. In this patch, each request allocates request buffer dynamically, and free buffer after request, so the scope protected by ctrl_lock also get optimized here. It's possible to optimize control queue depth in the next step. A necessary comment is already in code, still describe it again: /* * Note: there are padding fields in request, clear them to zero before * sending to host to avoid to divulge any information. * Ex, virtio_crypto_ctrl_request::ctrl::u::destroy_session::padding[48] */ So use kzalloc to allocate buffer of struct virtio_crypto_ctrl_request. Potentially dereferencing uninitialized variables: Reported-by: kernel test robot Reported-by: Dan Carpenter Cc: Michael S. Tsirkin Cc: Jason Wang Cc: Gonglei Reviewed-by: Gonglei Signed-off-by: zhenwei pi Message-Id: <20220506131627.180784-3-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 6fd763d155860eb7ea3a93c8b3bf926940ffa3fb Author: zhenwei pi Date: Fri May 6 21:16:23 2022 +0800 virtio-crypto: change code style Use temporary variable to make code easy to read and maintain. /* Pad cipher's parameters */ vcrypto->ctrl.u.sym_create_session.op_type = cpu_to_le32(VIRTIO_CRYPTO_SYM_OP_CIPHER); vcrypto->ctrl.u.sym_create_session.u.cipher.para.algo = vcrypto->ctrl.header.algo; vcrypto->ctrl.u.sym_create_session.u.cipher.para.keylen = cpu_to_le32(keylen); vcrypto->ctrl.u.sym_create_session.u.cipher.para.op = cpu_to_le32(op); --> sym_create_session = &ctrl->u.sym_create_session; sym_create_session->op_type = cpu_to_le32(VIRTIO_CRYPTO_SYM_OP_CIPHER); sym_create_session->u.cipher.para.algo = ctrl->header.algo; sym_create_session->u.cipher.para.keylen = cpu_to_le32(keylen); sym_create_session->u.cipher.para.op = cpu_to_le32(op); The new style shows more obviously: - the variable we want to operate. - an assignment statement in a single line. Cc: Michael S. Tsirkin Cc: Jason Wang Cc: Gonglei Reviewed-by: Gonglei Signed-off-by: zhenwei pi Message-Id: <20220506131627.180784-2-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 7e415282b41bf0d15c6e0fe268f822d9b083f2f7 Author: Murilo Opsfelder Araujo Date: Thu Apr 14 23:30:02 2022 -0300 virtio-pci: Remove wrong address verification in vp_del_vqs() GCC 12 enhanced -Waddress when comparing array address to null [0], which warns: drivers/virtio/virtio_pci_common.c: In function ‘vp_del_vqs’: drivers/virtio/virtio_pci_common.c:257:29: warning: the comparison will always evaluate as ‘true’ for the pointer operand in ‘vp_dev->msix_affinity_masks + (sizetype)((long unsigned int)i * 256)’ must not be NULL [-Waddress] 257 | if (vp_dev->msix_affinity_masks[i]) | ^~~~~~ In fact, the verification is comparing the result of a pointer arithmetic, the address "msix_affinity_masks + i", which will always evaluate to true. Under the hood, free_cpumask_var() calls kfree(), which is safe to pass NULL, not requiring non-null verification. So remove the verification to make compiler happy (happy compiler, happy life). [0] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102103 Signed-off-by: Murilo Opsfelder Araujo Message-Id: <20220415023002.49805-1-muriloo@linux.ibm.com> Signed-off-by: Michael S. Tsirkin Acked-by: Christophe de Dinechin commit 7a836a2aba09479c8e71fa43249eecc4af945f61 Author: Christophe JAILLET Date: Sun Apr 3 11:11:14 2022 +0200 virtio: pci: Fix an error handling path in vp_modern_probe() If an error occurs after a successful pci_request_selected_regions() call, it should be undone by a corresponding pci_release_selected_regions() call, as already done in vp_modern_remove(). Fixes: fd502729fbbf ("virtio-pci: introduce modern device module") Signed-off-by: Christophe JAILLET Message-Id: <237109725aad2c3c03d14549f777b1927c84b045.1648977064.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Michael S. Tsirkin commit bda324fd037a6b0d44da5699574ce741ca161bc4 Author: Gautam Dawar Date: Wed Mar 30 23:33:59 2022 +0530 vdpasim: control virtqueue support This patch introduces the control virtqueue support for vDPA simulator. This is a requirement for supporting advanced features like multiqueue. A requirement for control virtqueue is to isolate its memory access from the rx/tx virtqueues. This is because when using vDPA device for VM, the control virqueue is not directly assigned to VM. Userspace (Qemu) will present a shadow control virtqueue to control for recording the device states. The isolation is done via the virtqueue groups and ASID support in vDPA through vhost-vdpa. The simulator is extended to have: 1) three virtqueues: RXVQ, TXVQ and CVQ (control virtqueue) 2) two virtqueue groups: group 0 contains RXVQ and TXVQ; group 1 contains CVQ 3) two address spaces and the simulator simply implements the address spaces by mapping it 1:1 to IOTLB. For the VM use cases, userspace(Qemu) may set AS 0 to group 0 and AS 1 to group 1. So we have: 1) The IOTLB for virtqueue group 0 contains the mappings of guest, so RX and TX can be assigned to guest directly. 2) The IOTLB for virtqueue group 1 contains the mappings of CVQ which is the buffers that allocated and managed by VMM only. So CVQ of vhost-vdpa is visible to VMM only. And Guest can not access the CVQ of vhost-vdpa. For the other use cases, since AS 0 is associated to all virtqueue groups by default. All virtqueues share the same mapping by default. To demonstrate the function, VIRITO_NET_F_CTRL_MACADDR is implemented in the simulator for the driver to set mac address. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-20-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit cfe226892913a448e83e7a19db93862baa3cb99c Author: Gautam Dawar Date: Wed Mar 30 23:33:58 2022 +0530 vdpa_sim: filter destination mac address This patch implements a simple unicast filter for vDPA simulator. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-19-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit ec103d983bb56037a147dcdd9798cfa4fcdab126 Author: Gautam Dawar Date: Wed Mar 30 23:33:57 2022 +0530 vdpa_sim: factor out buffer completion logic Wrap up common buffer completion logic in to vdpasim_net_complete Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-18-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 05b6976212d4cffde60ff53716c40809ebdf4aee Author: Gautam Dawar Date: Wed Mar 30 23:33:56 2022 +0530 vdpa_sim: advertise VIRTIO_NET_F_MTU We've already reported maximum mtu via config space, so let's advertise the feature. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-17-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit aaca8373c4b1e010b8d748fc99d929de1bf860b8 Author: Gautam Dawar Date: Wed Mar 30 23:33:55 2022 +0530 vhost-vdpa: support ASID based IOTLB API This patch extends the vhost-vdpa to support ASID based IOTLB API. The vhost-vdpa device will allocated multiple IOTLBs for vDPA device that supports multiple address spaces. The IOTLBs and vDPA device memory mappings is determined and maintained through ASID. Note that we still don't support vDPA device with more than one address spaces that depends on platform IOMMU. This work will be done by moving the IOMMU logic from vhost-vDPA to vDPA device driver. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-16-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin Includes fixup: vhost-vdpa: Fix some error handling path in vhost_vdpa_process_iotlb_msg() In the error paths introduced by the original patch, a mutex may be left locked. Add the correct goto instead of a direct return. Signed-off-by: Christophe JAILLET Message-Id: <89ef0ae4c26ac3cfa440c71e97e392dcb328ac1b.1653227924.git.christophe.jaillet@wanadoo.fr> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 84d7c8fd3aade2fe79313003ed06ede431ec2a6d Author: Gautam Dawar Date: Wed Mar 30 23:33:54 2022 +0530 vhost-vdpa: introduce uAPI to set group ASID Follows the vDPA support for associating ASID to a specific virtqueue group. This patch adds a uAPI to support setting them from userspace. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-15-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 2d1fcb7758e49fd9caf150f3c70804b95b2ce80c Author: Gautam Dawar Date: Wed Mar 30 23:33:53 2022 +0530 vhost-vdpa: uAPI to get virtqueue group id Follows the support for virtqueue group in vDPA. This patches introduces uAPI to get the virtqueue group ID for a specific virtqueue in vhost-vdpa. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-14-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit a0c95f201170bd559737d3cdc8a950aea62f29c6 Author: Gautam Dawar Date: Wed Mar 30 23:33:52 2022 +0530 vhost-vdpa: introduce uAPI to get the number of address spaces This patch introduces the uAPI for getting the number of address spaces supported by this vDPA device. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-13-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 3ace88bd37436abc84906312146fe5158a469142 Author: Gautam Dawar Date: Wed Mar 30 23:33:51 2022 +0530 vhost-vdpa: introduce uAPI to get the number of virtqueue groups Follows the vDPA support for multiple address spaces, this patch introduce uAPI for the userspace to know the number of virtqueue groups supported by the vDPA device. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-12-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 3d5698793897a2b9c0060d899881d1a0591630d5 Author: Gautam Dawar Date: Wed Mar 30 23:33:50 2022 +0530 vhost-vdpa: introduce asid based IOTLB This patch converts the vhost-vDPA device to support multiple IOTLBs tagged via ASID via hlist. This will be used for supporting multiple address spaces in the following patches. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-11-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 91233ad711866f4e375742d84ef3ed6aab9daa96 Author: Gautam Dawar Date: Wed Mar 30 23:33:49 2022 +0530 vhost: support ASID in IOTLB API This patches allows userspace to send ASID based IOTLB message to vhost. This idea is to use the reserved u32 field in the existing V2 IOTLB message. Vhost device should advertise this capability via VHOST_BACKEND_F_IOTLB_ASID backend feature. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-10-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 1cb108994c6830cc6a6e066ad7d9a22ef59fa167 Author: Gautam Dawar Date: Wed Mar 30 23:33:48 2022 +0530 vhost_iotlb: split out IOTLB initialization This patch splits out IOTLB initialization to make sure it could be reused by external modules. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-9-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 46d554b1bcd19133401d2d5c0728b85e7bfd1358 Author: Gautam Dawar Date: Wed Mar 30 23:33:47 2022 +0530 vdpa: introduce config operations for associating ASID to a virtqueue group This patch introduces a new bus operation to allow the vDPA bus driver to associate an ASID to a virtqueue group. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-8-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit db9adcbf4286ad1c1fca091a870db6e49bb0df07 Author: Gautam Dawar Date: Wed Mar 30 23:33:46 2022 +0530 vdpa: multiple address spaces support This patches introduces the multiple address spaces support for vDPA device. This idea is to identify a specific address space via an dedicated identifier - ASID. During vDPA device allocation, vDPA device driver needs to report the number of address spaces supported by the device then the DMA mapping ops of the vDPA device needs to be extended to support ASID. This helps to isolate the environments for the virtqueue that will not be assigned directly. E.g in the case of virtio-net, the control virtqueue will not be assigned directly to guest. As a start, simply claim 1 virtqueue groups and 1 address spaces for all vDPA devices. And vhost-vDPA will simply reject the device with more than 1 virtqueue groups or address spaces. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-7-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit d4821902e43453b85b31329441a9f6ac071228a8 Author: Gautam Dawar Date: Wed Mar 30 23:33:45 2022 +0530 vdpa: introduce virtqueue groups This patch introduces virtqueue groups to vDPA device. The virtqueue group is the minimal set of virtqueues that must share an address space. And the address space identifier could only be attached to a specific virtqueue group. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-6-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 0b7ee47c5f36634926def0142a515eafedc8a779 Author: Gautam Dawar Date: Wed Mar 30 23:33:44 2022 +0530 vhost-vdpa: switch to use vhost-vdpa specific IOTLB To ease the implementation of per group ASID support for vDPA device. This patch switches to use a vhost-vdpa specific IOTLB to avoid the unnecessary refactoring of the vhost core. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-5-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit ae967246d0997a684093ffc06a14999292ad9276 Author: Gautam Dawar Date: Wed Mar 30 23:33:43 2022 +0530 vhost-vdpa: passing iotlb to IOMMU mapping helpers To prepare for the ASID support for vhost-vdpa, try to pass IOTLB object to dma helpers. No functional changes, it's just a preparation for support multiple IOTLBs. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-4-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit ea239a67461a34839e2172ead3043295a9173389 Author: Gautam Dawar Date: Wed Mar 30 23:33:42 2022 +0530 virtio-vdpa: don't set callback if virtio doesn't need it There's no need for setting callbacks for the driver that doesn't care about that. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-3-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit 175d493c3c3e09a3abaa843068fae0f0ad42c47e Author: Gautam Dawar Date: Wed Mar 30 23:33:41 2022 +0530 vhost: move the backend feature bits to vhost_types.h We should store feature bits in vhost_types.h as what has been done for e.g VHOST_F_LOG_ALL. Signed-off-by: Jason Wang Signed-off-by: Gautam Dawar Message-Id: <20220330180436.24644-2-gdawar@xilinx.com> Signed-off-by: Michael S. Tsirkin commit b4b4ff73ef047556e81694174bb8561457f25eeb Author: Xianting Tian Date: Mon Mar 28 18:58:17 2022 +0800 virtio_ring: add unlikely annotation for free descs check The 'if (vq->vq.num_free < descs_used)' check will almost always be false. Signed-off-by: Xianting Tian Message-Id: <20220328105817.1028065-2-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Stefano Garzarella commit 35c51e093d956f6d058e193711c8d424817a44a9 Author: Xianting Tian Date: Mon Mar 28 18:58:16 2022 +0800 virtio_ring: remove unnecessary to_vvq call in vring hot path It passes '_vq' to virtqueue_use_indirect(), which still calls to_vvq to get 'vq', let's directly pass 'vq'. It can avoid unnecessary call of to_vvq in hot path. Signed-off-by: Xianting Tian Message-Id: <20220328105817.1028065-1-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Stefano Garzarella commit 0e9911fa768f32f30e5678512ea405d99a7a9fef Author: Suwan Kim Date: Thu Apr 7 00:32:07 2022 +0900 virtio-blk: support mq_ops->queue_rqs() This patch supports mq_ops->queue_rqs() hook. It has an advantage of batch submission to virtio-blk driver. It also helps polling I/O because polling uses batched completion of block layer. Batch submission in queue_rqs() can boost polling performance. In queue_rqs(), it iterates plug->mq_list, collects requests that belong to same HW queue until it encounters a request from other HW queue or sees the end of the list. Then, virtio-blk adds requests into virtqueue and kicks virtqueue to submit requests. If there is an error, it inserts error request to requeue_list and passes it to ordinary block layer path. For verification, I did fio test. (io_uring, randread, direct=1, bs=4K, iodepth=64 numjobs=N) I set 4 vcpu and 2 virtio-blk queues for VM and run fio test 5 times. It shows about 2% improvement. | numjobs=2 | numjobs=4 ----------------------------------------------------------- fio without queue_rqs() | 291K IOPS | 238K IOPS ----------------------------------------------------------- fio with queue_rqs() | 295K IOPS | 243K IOPS For polling I/O performance, I also did fio test as below. (io_uring, hipri, randread, direct=1, bs=512, iodepth=64 numjobs=4) I set 4 vcpu and 2 poll queues for VM. It shows about 2% improvement in polling I/O. | IOPS | avg latency ----------------------------------------------------------- fio poll without queue_rqs() | 424K | 613.05 usec ----------------------------------------------------------- fio poll with queue_rqs() | 435K | 601.01 usec Reviewed-by: Stefan Hajnoczi Reviewed-by: Christoph Hellwig Signed-off-by: Suwan Kim Message-Id: <20220406153207.163134-3-suwan.kim027@gmail.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Chaitanya Kulkarni commit 4e0400525691d0e676dbe002641f9a61261f1e1b Author: Suwan Kim Date: Thu Apr 7 00:32:06 2022 +0900 virtio-blk: support polling I/O This patch supports polling I/O via virtio-blk driver. Polling feature is enabled by module parameter "poll_queues" and it sets dedicated polling queues for virtio-blk. This patch improves the polling I/O throughput and latency. The virtio-blk driver doesn't not have a poll function and a poll queue and it has been operating in interrupt driven method even if the polling function is called in the upper layer. virtio-blk polling is implemented upon 'batched completion' of block layer. virtblk_poll() queues completed request to io_comp_batch->req_list and later, virtblk_complete_batch() calls unmap function and ends the requests in batch. virtio-blk reads the number of poll queues from module parameter "poll_queues". If VM sets queue parameter as below, ("num-queues=N" [QEMU property], "poll_queues=M" [module parameter]) It allocates N virtqueues to virtio_blk->vqs[N] and it uses [0..(N-M-1)] as default queues and [(N-M)..(N-1)] as poll queues. Unlike the default queues, the poll queues have no callback function. Regarding HW-SW queue mapping, the default queue mapping uses the existing method that condsiders MSI irq vector. But the poll queue doesn't have an irq, so it uses the regular blk-mq cpu mapping. For verifying the improvement, I did Fio polling I/O performance test with io_uring engine with the options below. (io_uring, hipri, randread, direct=1, bs=512, iodepth=64 numjobs=N) I set 4 vcpu and 4 virtio-blk queues - 2 default queues and 2 poll queues for VM. As a result, IOPS and average latency improved about 10%. Test result: - Fio io_uring poll without virtio-blk poll support -- numjobs=1 : IOPS = 339K, avg latency = 188.33us -- numjobs=2 : IOPS = 367K, avg latency = 347.33us -- numjobs=4 : IOPS = 383K, avg latency = 682.06us - Fio io_uring poll with virtio-blk poll support -- numjobs=1 : IOPS = 385K, avg latency = 165.94us -- numjobs=2 : IOPS = 408K, avg latency = 313.28us -- numjobs=4 : IOPS = 424K, avg latency = 613.05us Reviewed-by: Stefan Hajnoczi Reviewed-by: Christoph Hellwig Reviewed-by: Max Gurtovoy Signed-off-by: Suwan Kim Message-Id: <20220406153207.163134-2-suwan.kim027@gmail.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Chaitanya Kulkarni commit 759ae7f9bf1e6b7f5c9c197d7207e2be1dfd74b1 Author: Eli Cohen Date: Wed May 18 16:38:04 2022 +0300 vdpa/mlx5: Use readers/writers semaphore instead of mutex Reading statistics could be done intensively and by several processes concurrently. Reader's lock is sufficient in this case. Change reslock from mutex to a rwsem. Suggested-by: Si-Wei Liu Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-7-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 1892a3d425bf525ac98d6d3534035e6ed2bfab50 Author: Eli Cohen Date: Wed May 18 16:38:03 2022 +0300 vdpa/mlx5: Add support for reading descriptor statistics Implement the get_vq_stats calback of vdpa_config_ops to return the statistics for a virtqueue. The statistics are provided as vendor specific statistics where the driver provides a pair of attribute name and attribute value. Currently supported are received descriptors and completed descriptors. Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-6-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit a6a51adc6e8aafebfe0c4beb80e99694ea562b40 Author: Eli Cohen Date: Wed May 18 16:38:02 2022 +0300 net/vdpa: Use readers/writers semaphore instead of cf_mutex Replace cf_mutex with rw_semaphore to reflect the fact that some calls could be called concurrently but can suffice with read lock. Suggested-by: Si-Wei Liu Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-5-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 0078ad905dc8eada34461312a0060b0904c57e2d Author: Eli Cohen Date: Wed May 18 16:38:01 2022 +0300 net/vdpa: Use readers/writers semaphore instead of vdpa_dev_mutex Use rw_semaphore instead of mutex to control access to vdpa devices. This can be especially beneficial in case processes poll on statistics information. Suggested-by: Si-Wei Liu Reviewed-by: Si-Wei Liu Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-4-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 13b00b135665c92065a27c0c39dd97e0f380bd4f Author: Eli Cohen Date: Wed May 18 16:38:00 2022 +0300 vdpa: Add support for querying vendor statistics Allows to read vendor statistics of a vdpa device. The specific statistics data are received from the upstream driver in the form of an (attribute name, attribute value) pairs. An example of statistics for mlx5_vdpa device are: received_desc - number of descriptors received by the virtqueue completed_desc - number of descriptors completed by the virtqueue A descriptor using indirect buffers is still counted as 1. In addition, N chained descriptors are counted correctly N times as one would expect. A new callback was added to vdpa_config_ops which provides the means for the vdpa driver to return statistics results. The interface allows for reading all the supported virtqueues, including the control virtqueue if it exists. Below are some examples taken from mlx5_vdpa which are introduced in the following patch: 1. Read statistics for the virtqueue at index 1 $ vdpa dev vstats show vdpa-a qidx 1 vdpa-a: queue_type tx queue_index 1 received_desc 3844836 completed_desc 3844836 2. Read statistics for the virtqueue at index 32 $ vdpa dev vstats show vdpa-a qidx 32 vdpa-a: queue_type control_vq queue_index 32 received_desc 62 completed_desc 62 3. Read statisitics for the virtqueue at index 0 with json output $ vdpa -j dev vstats show vdpa-a qidx 0 {"vstats":{"vdpa-a":{ "queue_type":"rx","queue_index":0,"name":"received_desc","value":417776,\ "name":"completed_desc","value":417548}}} 4. Read statistics for the virtqueue at index 0 with preety json output $ vdpa -jp dev vstats show vdpa-a qidx 0 { "vstats": { "vdpa-a": { "queue_type": "rx", "queue_index": 0, "name": "received_desc", "value": 417776, "name": "completed_desc", "value": 417548 } } } Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-3-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 7a6691f1f89784f775fa0c54be57533445726068 Author: Eli Cohen Date: Wed May 18 16:37:59 2022 +0300 vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit In vdpa_nl_cmd_dev_get_doit(), if the call to genlmsg_reply() fails we must not call nlmsg_free() since this is done inside genlmsg_reply(). Fix it. Fixes: bc0d90ee021f ("vdpa: Enable user to query vdpa device info") Reviewed-by: Si-Wei Liu Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20220518133804.1075129-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 079d93b7dba8373920ad8b50e01616ce8ab3c927 Author: Mark Brown Date: Tue May 31 17:13:37 2022 +0200 selftests: alsa: Handle pkg-config failure more gracefully Follow the pattern used by other selftests like memfd and fall back on the standard toolchain options to build with a system installed alsa-lib if we don't get anything from pkg-config. This reduces our build dependencies a bit in the common case while still allowing use of pkg-config in case there is a need for it. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220531151337.2933810-1-broonie@kernel.org Signed-off-by: Takashi Iwai commit 4398d3c31b582db0d640b23434bf344a6c8df57c Author: Weizhao Ouyang Date: Mon May 30 15:51:14 2022 +0800 erofs: fix 'backmost' member of z_erofs_decompress_frontend Initialize 'backmost' to true in DECOMPRESS_FRONTEND_INIT. Fixes: 5c6dcc57e2e5 ("erofs: get rid of `struct z_erofs_collector'") Signed-off-by: Weizhao Ouyang Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220530075114.918874-1-o451686892@gmail.com Signed-off-by: Gao Xiang commit aa793b46bb9342ae3c6152fc21654b8ade8dd125 Author: Gao Xiang Date: Sun May 29 13:54:25 2022 +0800 erofs: simplify z_erofs_pcluster_readmore() Get rid of unnecessary label `skip'. No logic changes. Link: https://lore.kernel.org/r/20220529055425.226363-4-xiang@kernel.org Acked-by: Chao Yu Signed-off-by: Gao Xiang commit 39397a46cff3d7b7d3b45b3283491af05bdfb64b Author: Gao Xiang Date: Sun May 29 13:54:24 2022 +0800 erofs: get rid of label `restart_now' Simplify this part of code. No logic changes. Link: https://lore.kernel.org/r/20220529055425.226363-3-xiang@kernel.org Acked-by: Chao Yu Signed-off-by: Gao Xiang commit 87ca34a7065db66adbbe882a2be6b04127c26a87 Author: Gao Xiang Date: Sun May 29 13:54:23 2022 +0800 erofs: get rid of `struct z_erofs_collection' It was incompletely introduced for deduplication between different logical extents backed with the same pcluster. We will have a better in-memory representation in the next release cycle for this, as well as partial memory folios support. So get rid of it instead. No logic changes. Link: https://lore.kernel.org/r/20220529055425.226363-2-xiang@kernel.org Acked-by: Chao Yu Signed-off-by: Gao Xiang commit f26967b9f7a830e228bb13fb41bd516ddd9d789d Author: Namjae Jeon Date: Mon May 30 18:43:01 2022 +0300 fs/ntfs3: Fix invalid free in log_replay log_read_rst() returns ENOMEM error when there is not enough memory. In this case, if info is returned without initialization, it attempts to kfree the uninitialized info->r_page pointer. This patch moves the memset initialization code to before log_read_rst() is called. Reported-by: Gerald Lee Signed-off-by: Namjae Jeon Signed-off-by: Konstantin Komarov commit 3d76c9f5e0ee842ad42e482669d7fd63d4b67867 Author: Arnd Bergmann Date: Tue May 24 14:20:06 2022 +0200 ARM: pxa/mmp: remove traces of plat-pxa The missing include directory caused a W=1 warning that can be trivially fixed. I also noticed references in the marvell.rst documentation that can be removed at the same time. Reported-by: kernel test robot Signed-off-by: Arnd Bergmann commit 9171c484dffd82ef20942ea6adbbc8f765691c69 Author: Krzysztof Kozlowski Date: Tue May 24 09:04:08 2022 +0200 dt-bindings: soc: qcom,smd: do not use pattern for simple rpm-requests string patternProperties should not be used for properties with a simple string as name: Documentation/devicetree/bindings/soc/qcom/qcom,smd.yaml: patternProperties:^(.*-edge|rpm)$:patternProperties: '^rpm-requests$' should not be valid under {'pattern': '^\\^[a-zA-Z0-9,\\-._#]+\\$$'} Fixes: 375eed5f51a8 ("dt-bindings: soc: qcom,smd: convert to dtschema") Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220524070408.39505-1-krzysztof.kozlowski@linaro.org commit 291e7d52d19f114cad6cbf802f3f19ef12a011f8 Author: Ben Chuang Date: Fri May 20 19:42:42 2022 +0800 mmc: sdhci-pci-gli: Fix GL9763E runtime PM when the system resumes from suspend When the system resumes from suspend (S3 or S4), the power mode is MMC_POWER_OFF. In this status, gl9763e_runtime_resume() should not enable PLL. Add a condition to this function to enable PLL only when the power mode is MMC_POWER_ON. Fixes: d607667bb8fa (mmc: sdhci-pci-gli: Add runtime PM for GL9763E) Signed-off-by: Ben Chuang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220520114242.150235-1-benchuanggli@gmail.com Signed-off-by: Ulf Hansson commit 03ab8e6297acd1bc0eedaa050e2a1635c576fd11 Merge: 52e00ea6b26e4 4b0986a3613c9 Author: Konstantin Komarov Date: Tue May 31 16:13:23 2022 +0300 Merge tag 'v5.18' Linux 5.18 commit 3753fcc22974affa26160ce1c46a6ebaaaa86758 Author: Takashi Iwai Date: Tue May 31 15:07:49 2022 +0200 ALSA: usb-audio: Optimize TEAC clock quirk Maris found out that the quirk for TEAC devices to work around the clock setup is needed to apply only when the base clock is changed, e.g. from 48000-based clocks (48000, 96000, 192000, 384000) to 44100-based clocks (44100, 88200, 176400, 352800), or vice versa, while switching to another clock with the same base clock doesn't need the (forcible) interface setup. This patch implements the optimization for the TEAC clock quirk to avoid the unnecessary interface re-setup. Fixes: 5ce0b06ae5e6 ("ALSA: usb-audio: Workaround for clock setup on TEAC devices") Reported-by: Maris Abele Cc: Link: https://lore.kernel.org/r/20220531130749.30357-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 09e545f7381459c015b6fa0cd0ac6f010ef8cc25 Author: Juergen Gross Date: Mon May 30 13:34:59 2022 +0200 xen/netback: fix incorrect usage of RING_HAS_UNCONSUMED_REQUESTS() Commit 6fac592cca60 ("xen: update ring.h") missed to fix one use case of RING_HAS_UNCONSUMED_REQUESTS(). Reported-by: Jan Beulich Fixes: 6fac592cca60 ("xen: update ring.h") Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Acked-by: Wei Liu Link: https://lore.kernel.org/r/20220530113459.20124-1-jgross@suse.com Signed-off-by: Paolo Abeni commit 3e0b8f529c10037ae0b369fc892e524eae5a5485 Author: Arun Ajith S Date: Mon May 30 10:14:14 2022 +0000 net/ipv6: Expand and rename accept_unsolicited_na to accept_untracked_na RFC 9131 changes default behaviour of handling RX of NA messages when the corresponding entry is absent in the neighbour cache. The current implementation is limited to accept just unsolicited NAs. However, the RFC is more generic where it also accepts solicited NAs. Both types should result in adding a STALE entry for this case. Expand accept_untracked_na behaviour to also accept solicited NAs to be compliant with the RFC and rename the sysctl knob to accept_untracked_na. Fixes: f9a2fb73318e ("net/ipv6: Introduce accept_unsolicited_na knob to implement router-side changes for RFC9131") Signed-off-by: Arun Ajith S Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220530101414.65439-1-aajith@arista.com Signed-off-by: Paolo Abeni commit a7c41b4687f5902af70cd559806990930c8a307b Author: Xiaoguang Wang Date: Mon May 30 21:15:20 2022 +0800 io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots One big issue with the file registration feature is that it needs user space apps to maintain free slot info about io_uring's fixed file table, which really is a burden for development. io_uring now supports choosing free file slot for user space apps by using IORING_FILE_INDEX_ALLOC flag in accept, open, and socket operations, but they need the app to use direct accept or direct open, which not all apps are prepared to use yet. To support apps that still need real fds, make use of the registration feature easier. Let IORING_OP_FILES_UPDATE support choosing fixed file slots, which will store picked fixed files slots in fd array and let cqe return the number of slots allocated. Suggested-by: Hao Xu Signed-off-by: Xiaoguang Wang [axboe: move flag to uapi io_uring header, change goto to break, init] Signed-off-by: Jens Axboe commit 4278a0deb1f6cac40ded3362fe2a9827d7efee3d Author: Xiaoguang Wang Date: Sat May 28 09:51:09 2022 +0800 io_uring: defer alloc_hint update to io_file_bitmap_set() io_file_bitmap_get() returns a free bitmap slot, but if it isn't used later, such as io_queue_rsrc_removal() returns error, in this case, we should not update alloc_hint at all, which still should be considered as a valid candidate for next io_file_bitmap_get() calls. To fix this issue, only update alloc_hint in io_file_bitmap_set(). Signed-off-by: Xiaoguang Wang Link: https://lore.kernel.org/r/20220528015109.48039-1-xiaoguang.wang@linux.alibaba.com Signed-off-by: Jens Axboe commit 8c71fe750215e688df9c7477e7bf448380d4ce9e Author: Xiaoguang Wang Date: Fri May 27 10:54:00 2022 +0800 io_uring: ensure fput() called correspondingly when direct install fails io_fixed_fd_install() may fail for short of free fixed file bitmap, in this case, need to call fput() correspondingly. Signed-off-by: Xiaoguang Wang Link: https://lore.kernel.org/r/20220527025400.51048-1-xiaoguang.wang@linux.alibaba.com Signed-off-by: Jens Axboe commit fa82dd105bed389f37d919fd783ce459bb92facb Author: Jens Axboe Date: Thu May 26 16:58:18 2022 -0600 io_uring: wire up allocated direct descriptors for socket The socket support was merged in an earlier branch that didn't yet have support for allocating direct descriptors, hence only open and accept got support for that. Do the one-liner to enable it now, so we have consistent support for any request that can instantiate a file/direct descriptor. Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit 21870e02fcd385c39fe635e6531ce78302f3cd71 Author: Jens Axboe Date: Thu May 26 11:34:33 2022 -0600 io_uring: fix a memory leak of buffer group list on exit If we use a buffer group ID that is large enough to require io_uring to allocate it, then we don't correctly free it if the cleanup is deferred to the ring exit. The explicit removal paths are fine. Fixes: 9cfc7e94e42b ("io_uring: get rid of hashed provided buffer groups") Signed-off-by: Jens Axboe commit 1151a7cccbd2cfd5a552805c92c92fb264a957d5 Author: Jens Axboe Date: Mon May 23 18:43:13 2022 -0600 io_uring: move shutdown under the general net section Gets rid of some ifdefs and enables use of the net defines for when CONFIG_NET isn't set. Signed-off-by: Jens Axboe commit 157dc813b47ab2adb4bc8a08491887bc161284c2 Author: Jens Axboe Date: Mon May 23 17:16:21 2022 -0600 io_uring: unify calling convention for async prep handling Make them consistent in preparation for defining a req async prep handler. The readv/writev requests share a prep handler, move it one level down so the initial one is consistent with the others. Signed-off-by: Jens Axboe commit 4a1f14df55d1e9ecdfa797a87a80131207cbd66f Author: Hangbin Liu Date: Mon May 30 14:26:39 2022 +0800 bonding: show NS IPv6 targets in proc master info When adding bond new parameter ns_targets. I forgot to print this in bond master proc info. After updating, the bond master info will look like: ARP IP target/s (n.n.n.n form): 192.168.1.254 NS IPv6 target/s (XX::XX form): 2022::1, 2022::2 Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Reported-by: Li Liang Signed-off-by: Hangbin Liu Link: https://lore.kernel.org/r/20220530062639.37179-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit fcde59feb1affb6d56aecadc3868df4631480da5 Author: Jens Axboe Date: Mon May 23 16:53:15 2022 -0600 io_uring: add io_op_defs 'def' pointer in req init and issue Define and set it when appropriate, and use it consistently in the function rather than using io_op_defs[opcode]. Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit ab0925ab728163b854ea17da09e299254a86076e Merge: d6f8168e4345c 2d969e8f35b18 Author: Mark Brown Date: Tue May 31 10:16:59 2022 +0200 ASoC: da7219: Small fixes for jack detection and removal Merge series from Adam Thomson : This series contains 2 small fixes around the AAD part of DA7219, particularly in relation to jack pole detection on certain active headsets, and tidy up when a jack is removed. commit 0c0fe08c76485fe0178ebb0fa1a2052c727abe94 Author: Borislav Petkov Date: Wed May 25 18:12:32 2022 +0200 x86/microcode: Remove unnecessary perf callback c93dc84cbe32 ("perf/x86: Add a microcode revision check for SNB-PEBS") checks whether the microcode revision has fixed PEBS issues. This can happen either: 1. At PEBS init time, where the early microcode has been loaded already 2. During late loading, in the microcode_check() callback. So remove the unnecessary call in the microcode loader init routine. Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220525161232.14924-5-bp@alien8.de commit d23d33ea0fcdc4bbb484990bf53867f99c63ccab Author: Borislav Petkov Date: Wed May 25 18:12:31 2022 +0200 x86/microcode: Taint and warn on late loading Warn before it is attempted and taint the kernel. Late loading microcode can lead to malfunction of the kernel when the microcode update changes behaviour. There is no way for the kernel to determine whether its safe or not. Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220525161232.14924-4-bp@alien8.de commit a77a94f86273ce42a39cb479217dd8d68acfe0ff Author: Borislav Petkov Date: Wed May 25 18:12:30 2022 +0200 x86/microcode: Default-disable late loading It is dangerous and it should not be used anyway - there's a nice early loading already. Requested-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220525161232.14924-3-bp@alien8.de commit 181b6f40e9ea80c76756d4d0cdeed396016c487e Author: Borislav Petkov Date: Wed May 25 18:12:29 2022 +0200 x86/microcode: Rip out the OLD_INTERFACE Everything should be using the early initrd loading by now. Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220525161232.14924-2-bp@alien8.de commit cbf84dbf0600b0efe1134cc3f98ae29c523a3a23 Author: Julia Lawall Date: Sat May 21 13:10:36 2022 +0200 nvmet: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit aa41d2fe60ee2e4452b0f9ca9f0f6d80a4ff9f9d Author: Niklas Cassel Date: Thu May 26 15:57:21 2022 +0200 nvme: set controller enable bit in a separate write The NVM Express Base Specification 2.0 specifies in the description of the CC – Controller Configuration register: "Host software shall set the Arbitration Mechanism Selected (CC.AMS), the Memory Page Size (CC.MPS), and the I/O Command Set Selected (CC.CSS) to valid values prior to enabling the controller by setting CC.EN to ‘1’. While we haven't seen any controller misbehaving while setting all bits in a single write, let's do it in the order that it is written in the spec, as there could potentially be controllers that are implemented to rely on the configuration bits being set before enabling the controller. Signed-off-by: Niklas Cassel Signed-off-by: Christoph Hellwig commit 70ce3455345d056b5fc427c3bb4a3ff4d126b6d5 Author: Christoph Hellwig Date: Fri May 27 07:32:08 2022 +0200 nvme-pci: disable namespace identifiers for the MAXIO MAP1001 The MAXIO MAP1001 controllers reports completely bogus Namespace identifiers that even change after suspend cycles. Disable using the Identifiers entirely. Reported-by: Arman Hajishafieha Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Tested-by: Arman Hajishafieha commit d7cd5e06c9dd70a82f1461c7b5f676bc03f5cd61 Author: Viorel Suman Date: Fri May 27 11:49:34 2022 +0300 net: phy: at803x: disable WOL at probe Before 7beecaf7d507b ("net: phy: at803x: improve the WOL feature") patch "at803x_get_wol" implementation used AT803X_INTR_ENABLE_WOL value to set WAKE_MAGIC flag, and now AT803X_WOL_EN value is used for the same purpose. The problem here is that the values of these two bits are different after hardware reset: AT803X_INTR_ENABLE_WOL=0 after hardware reset, but AT803X_WOL_EN=1. So now, if called right after boot, "at803x_get_wol" will set WAKE_MAGIC flag, even if WOL function is not enabled by calling "at803x_set_wol" function. The patch disables WOL function on probe thus the behavior is consistent. Fixes: 7beecaf7d507b ("net: phy: at803x: improve the WOL feature") Signed-off-by: Viorel Suman Link: https://lore.kernel.org/r/20220527084935.235274-1-viorel.suman@oss.nxp.com Signed-off-by: Jakub Kicinski commit 3a2cd89bfbeb10012eb90857ce641d34f0151c4c Author: huhai Date: Thu May 26 18:12:13 2022 +0800 net: ipv4: Avoid bounds check warning Fix the following build warning when CONFIG_IPV6 is not set: In function ‘fortify_memcpy_chk’, inlined from ‘tcp_md5_do_add’ at net/ipv4/tcp_ipv4.c:1210:2: ./include/linux/fortify-string.h:328:4: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 328 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suggested-by: Paolo Abeni Signed-off-by: huhai Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220526101213.2392980-1-zhanggenjian@kylinos.cn Signed-off-by: Jakub Kicinski commit 8378a51e3f8140f60901fb27208cc7a6e47047b5 Author: Ronnie Sahlberg Date: Tue May 31 13:01:17 2022 +1000 cifs: fix potential double free during failed mount RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799 Cc: stable@vger.kernel.org Signed-off-by: Roberto Bergantinos Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 07bf9431b1590d1cd7a8d62075d0b50b073f0495 Author: Vaibhav Jain Date: Tue May 24 16:53:53 2022 +0530 powerpc/papr_scm: don't requests stats with '0' sized stats buffer Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when papr_scm probe is being called. The panic is of the form below and is observed only with following option disabled(profile) for the said LPAR 'Enable Performance Information Collection' in the HMC: Kernel attempted to write user page (1c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x0000001c Faulting instruction address: 0xc008000001b90844 Oops: Kernel access of bad area, sig: 11 [#1] NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm] LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm] Call Trace: 0xc00000000941bca0 (unreliable) papr_scm_probe+0x2ac/0x6ec [papr_scm] platform_probe+0x98/0x150 really_probe+0xfc/0x510 __driver_probe_device+0x17c/0x230 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception On investigation looks like this panic was caused due to a 'stat_buffer' of size==0 being provided to drc_pmem_query_stats() to fetch all performance stats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn't have been called since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused due to missing check for 'p->stat_buffer_len' at the beginning of papr_scm_pmu_check_events() which indicates that the NVDIMM doesn't support performance-stats. Fix this by introducing the check for 'p->stat_buffer_len' at the beginning of papr_scm_pmu_check_events(). [1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com Fixes: 0e0946e22f3665d2732 ("powerpc/papr_scm: Fix leaking nvdimm_events_map elements") Reported-by: Sachin Sant Signed-off-by: Vaibhav Jain Tested-by: Sachin Sant Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220524112353.1718454-1-vaibhav@linux.ibm.com commit 7699f7aacf3ebfee51c670b6f796b2797f0f7487 Author: Uwe Kleine-König Date: Mon May 30 09:42:02 2022 +0200 RISC-V: Prepare dropping week attribute from arch_kexec_apply_relocations[_add] Without this change arch/riscv/kernel/elf_kexec.c fails to compile once commit 233c1e6c319c ("kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]") is also contained in the tree. This currently happens in next-20220527. Prepare the RISC-V similar to the s390 adaption done in 233c1e6c319c. This is safe to do on top of the riscv change even without the change to arch_kexec_apply_relocations. Fixes: 838b3e28488f ("RISC-V: Load purgatory in kexec_file") Looks-good-to: liaochang (A) Signed-off-by: Uwe Kleine-König Signed-off-by: Palmer Dabbelt commit 8ab2afa23bd197df47819a87f0265c0ac95c5b6a Merge: e11a93567d3f1 79b66128f13f5 Author: Linus Torvalds Date: Mon May 30 12:46:49 2022 -0700 Merge tag 'for-5.19/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes and updates from Helge Deller: "A buch of small fixes and cleanups, including: - vesafb: Fix a use-after-free due early fb_info cleanup - clcdfb: Fix refcount leak in clcdfb_of_vram_setup - hyperv_fb: Allow resolutions with size > 64 MB for Gen1 - pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() - omapfb: Prevent compiler warning regarding hwa742_update_window_async()" * tag 'for-5.19/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: video: fbdev: omap: Add prototype for hwa742_update_window_async() video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup video: fbdev: radeon: Fix spelling typo in comment video: fbdev: xen: remove setting of 'transp' parameter video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() video: fbdev: omapfb: simplify the return expression of nec_8048_connect() video: fbdev: omapfb: simplify the return expression of dsi_init_pll_data() video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 commit e11a93567d3f1e843300ed98ff049a4335db8015 Merge: 1ff7bc3ba71d3 72acadfeb3789 Author: Linus Torvalds Date: Mon May 30 11:52:18 2022 -0700 Merge tag 'for-5.19/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture updates from Helge Deller: "Minor cleanups and code optimizations, e.g.: - improvements in assembly statements in the tmpalias code path - added some additionals compile time checks - drop some unneccesary assembler DMA syncs" * tag 'for-5.19/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Drop __ARCH_WANT_OLD_READDIR and __ARCH_WANT_SYS_OLDUMOUNT parisc: Optimize tmpalias function calls parisc: Add dep_safe() macro to deposit a register in 32- and 64-kernels parisc: Fix wrong comment for shr macro parisc: Prevent ldil() to sign-extend into upper 32 bits parisc: Don't hardcode assembler bit definitions in tmpalias code parisc: Don't enforce DMA completion order in cache flushes parisc: video: fbdev: stifb: Add sti_dump_font() to dump STI font commit 1ff7bc3ba71d398d349c49103a3da34bb4ea02d1 Merge: 32665a9e5432f 9f9c1f6844bda Author: Linus Torvalds Date: Mon May 30 11:37:26 2022 -0700 Merge tag 'pm-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These update the ARM cpufreq drivers and fix up the CPPC cpufreq driver after recent changes, update the OPP code and PM documentation and add power sequences support to the system reboot and power off code. Specifics: - Add Tegra234 cpufreq support (Sumit Gupta) - Clean up and enhance the Mediatek cpufreq driver (Wan Jiabing, Rex-BC Chen, and Jia-Wei Chang) - Fix up the CPPC cpufreq driver after recent changes (Zheng Bin, Pierre Gondois) - Minor update to dt-binding for Qcom's opp-v2-kryo-cpu (Yassine Oudjana) - Use list iterator only inside the list_for_each_entry loop (Xiaomeng Tong, and Jakob Koschel) - New APIs related to finding OPP based on interconnect bandwidth (Krzysztof Kozlowski) - Fix the missing of_node_put() in _bandwidth_supported() (Dan Carpenter) - Cleanups (Krzysztof Kozlowski, and Viresh Kumar) - Add Out of Band mode description to the intel-speed-select utility documentation (Srinivas Pandruvada) - Add power sequences support to the system reboot and power off code and make related platform-specific changes for multiple platforms (Dmitry Osipenko, Geert Uytterhoeven)" * tag 'pm-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (60 commits) cpufreq: CPPC: Fix unused-function warning cpufreq: CPPC: Fix build error without CONFIG_ACPI_CPPC_CPUFREQ_FIE Documentation: admin-guide: PM: Add Out of Band mode kernel/reboot: Change registration order of legacy power-off handler m68k: virt: Switch to new sys-off handler API kernel/reboot: Add devm_register_restart_handler() kernel/reboot: Add devm_register_power_off_handler() soc/tegra: pmc: Use sys-off handler API to power off Nexus 7 properly reboot: Remove pm_power_off_prepare() regulator: pfuze100: Use devm_register_sys_off_handler() ACPI: power: Switch to sys-off handler API memory: emif: Use kernel_can_power_off() mips: Use do_kernel_power_off() ia64: Use do_kernel_power_off() x86: Use do_kernel_power_off() sh: Use do_kernel_power_off() m68k: Switch to new sys-off handler API powerpc: Use do_kernel_power_off() xen/x86: Use do_kernel_power_off() parisc: Use do_kernel_power_off() ... commit 32665a9e5432fd88fe20f4affa8986833bbbabe7 Merge: 527953ef71250 3c1d004bdb4e1 Author: Linus Torvalds Date: Mon May 30 11:34:13 2022 -0700 Merge tag 'thermal-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull additional thermal control update from Rafael Wysocki: "Add Meteor Lake PCI device ID to the int340x thermal control driver (Sumeet Pawnikar)" * tag 'thermal-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: int340x: Add Meteor Lake PCI device ID commit 527953ef7125078cd43ccfbed042d60199842b31 Merge: 2c5ca23f7414e 4a577fca503a6 Author: Linus Torvalds Date: Mon May 30 11:30:16 2022 -0700 Merge tag 'acpi-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These add some new device IDs, update a few drivers (processor, battery, backlight) and clean up code in a few places. Specifics: - Add Meteor Lake ACPI IDs for DPTF devices (Sumeet Pawnikar) - Rearrange find_child_checks() to simplify code (Rafael Wysocki) - Use memremap() to map the UCSI mailbox that is always in main memory and drop acpi_release_memory() that has no more users (Heikki Krogerus, Dan Carpenter) - Make max_cstate/nocst/bm_check_disable processor module parameters visible in sysfs (Yajun Deng) - Fix typo in the CPPC driver (Julia Lawall) - Make the ACPI battery driver show the "not-charging" status by default unless "charging" or "full" is directly indicated (Werner Sembach) - Improve the PM notifier in the ACPI backlight driver (Zhang Rui) - Clean up some white space in the ACPI code (Ian Cowan)" * tag 'acpi-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe ACPI: DPTF: Support Meteor Lake ACPI: CPPC: fix typo in comment ACPI: video: improve PM notifer callback ACPI: clean up white space in a few places for consistency ACPI: glue: Rearrange find_child_checks() ACPI: processor: idle: Expose max_cstate/nocst/bm_check_disable read-only in sysfs ACPI: battery: Make "not-charging" the default on no charging or full info ACPI: OSL: Remove the helper for deactivating memory region usb: typec: ucsi: acpi: Map the mailbox with memremap() commit 2c5ca23f7414eb2c782f945aa417cfab7b5c88dd Merge: 73d15ba6ba390 bc70682a497c4 Author: Linus Torvalds Date: Mon May 30 11:19:16 2022 -0700 Merge tag 'ovl-update-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs updates from Miklos Szeredi: - Support idmapped layers in overlayfs (Christian Brauner) - Add a fix to exportfs that is relevant to open_by_handle_at(2) as well - Introduce new lookup helpers that allow passing mnt_userns into inode_permission() * tag 'ovl-update-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: support idmapped layers ovl: handle idmappings in ovl_xattr_{g,s}et() ovl: handle idmappings in layer open helpers ovl: handle idmappings in ovl_permission() ovl: use ovl_copy_{real,upper}attr() wrappers ovl: store lower path in ovl_inode ovl: handle idmappings for layer lookup ovl: handle idmappings for layer fileattrs ovl: use ovl_path_getxattr() wrapper ovl: use ovl_lookup_upper() wrapper ovl: use ovl_do_notify_change() wrapper ovl: pass layer mnt to ovl_open_realfile() ovl: pass ofs to setattr operations ovl: handle idmappings in creation operations ovl: add ovl_upper_mnt_userns() wrapper ovl: pass ofs to creation operations ovl: use wrappers to all vfs_*xattr() calls exportfs: support idmapped mounts fs: add two trivial lookup helpers commit 73d15ba6ba390caed47aa8885811d1cd7b4477f3 Merge: 2d2da475ac0ee 7e4fd16b38923 Author: Linus Torvalds Date: Mon May 30 11:01:50 2022 -0700 Merge tag 'mips_5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: "Cleanups and fixes" * tag 'mips_5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (38 commits) MIPS: RALINK: Define pci_remap_iospace under CONFIG_PCI_DRIVERS_GENERIC MIPS: Use memblock_add_node() in early_parse_mem() under CONFIG_NUMA MIPS: Return -EINVAL if mem parameter is empty in early_parse_mem() MIPS: Kconfig: Fix indentation and add endif comment MIPS: bmips: Fix compiler warning observed on W=1 build MIPS: Rewrite `csum_tcpudp_nofold' in plain C mips: setup: use strscpy to replace strlcpy MIPS: Octeon: add SNIC10E board MIPS: Ingenic: Refresh defconfig for CU1000-Neo and CU1830-Neo. MIPS: Ingenic: Refresh device tree for Ingenic SoCs and boards. MIPS: Ingenic: Add PWM nodes for X1830. MIPS: Octeon: fix typo in comment MIPS: loongson32: Kconfig: Remove extra space MIPS: Sibyte: remove unnecessary return variable MIPS: Use NOKPROBE_SYMBOL() instead of __kprobes annotation selftests/ftrace: Save kprobe_events to test log MIPS: tools: no need to initialise statics to 0 MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon MIPS: VR41xx: Drop redundant spinlock initialization MIPS: smp: optimization for flush_tlb_mm when exiting ... commit 2d2da475ac0eebfbf40e5c5ca8c0409d62d23424 Merge: b00ed48bb0a7c 6b8be804ff376 Author: Linus Torvalds Date: Mon May 30 10:56:18 2022 -0700 Merge tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A collection of changes to add elf-fdpic loader support for m68k. Also a collection of various fixes. They include typo corrections, undefined symbol compilation fixes, removal of the ISA_DMA_API support and removal of unused code. Summary: - correctly set up ZERO_PAGE pointer - drop ISA_DMA_API support - fix comment typos - fixes for undefined symbols - remove unused code and variables - elf-fdpic loader support for m68k" * tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: fix 68000 CPU link with no platform selected m68k: removed unused "mach_get_ss" m68knommu: fix undefined reference to `mach_get_rtc_pll' m68knommu: fix undefined reference to `_init_sp' m68knommu: allow elf_fdpic loader to be selected m68knommu: add definitions to support elf_fdpic program loader m68knommu: implement minimal regset support m68knommu: use asm-generic/mmu.h for nommu setups m68k: fix typos in comments m68k: coldfire: drop ISA_DMA_API support m68knommu: set ZERO_PAGE() to the allocated zeroed page commit 4a577fca503a63442928ff4cec06c1136ea9b53e Merge: 15f4bb9aac620 185d20694a8ac 1934fee67593c 4c19851c70bae Author: Rafael J. Wysocki Date: Mon May 30 18:07:05 2022 +0200 Merge branches 'acpi-battery', 'acpi-video' and 'acpi-misc' Merge ACPI battery and backlight driver update and miscellaneous cleanup for 5.19-rc1: - Make the ACPI battery driver show the "not-charging" status by default unless "charging" or "full" is directly indicated (Werner Sembach). - Improve the PM notifier in the ACPI backlight driver (Zhang Rui). - Clean up some white space in the ACPI code (Ian Cowan). * acpi-battery: ACPI: battery: Make "not-charging" the default on no charging or full info * acpi-video: ACPI: video: improve PM notifer callback * acpi-misc: ACPI: clean up white space in a few places for consistency commit 15f4bb9aac620f7ca1e50c859731e7d990f807ed Merge: 657b95d34ba3c b7fbf4cebd7c6 a9face899413f 27263b3428f5b 9e12eb8231496 Author: Rafael J. Wysocki Date: Mon May 30 18:04:57 2022 +0200 Merge branches 'acpi-glue', 'acpi-osl', 'acpi-processor' and 'acpi-cppc' Merge general ACPI cleanups and processor support updates for 5.19-rc1: - Rearrange find_child_checks() to simplify code (Rafael Wysocki). - Use memremap() to map the UCSI mailbox that is always in main memory and drop acpi_release_memory() that has no more users (Heikki Krogerus, Dan Carpenter). - Make max_cstate/nocst/bm_check_disable processor module parameters visible in sysfs (Yajun Deng). - Fix typo in the CPPC driver (Julia Lawall). * acpi-glue: ACPI: glue: Rearrange find_child_checks() * acpi-osl: usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe ACPI: OSL: Remove the helper for deactivating memory region usb: typec: ucsi: acpi: Map the mailbox with memremap() * acpi-processor: ACPI: processor: idle: Expose max_cstate/nocst/bm_check_disable read-only in sysfs * acpi-cppc: ACPI: CPPC: fix typo in comment commit a9face899413f468460219c79503c091c4d362cb Author: Dan Carpenter Date: Mon May 9 12:08:28 2022 +0300 usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe The devm_memremap() function never returns NULL. It returns error pointers. Fixes: cdc3d2abf438 ("usb: typec: ucsi: acpi: Map the mailbox with memremap()") Signed-off-by: Dan Carpenter Reviewed-by: Heikki Krogerus Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki commit 72acadfeb378915a3c4990f4252ab33ce8225491 Author: Helge Deller Date: Mon May 30 15:51:08 2022 +0200 parisc: Drop __ARCH_WANT_OLD_READDIR and __ARCH_WANT_SYS_OLDUMOUNT Those old syscalls aren't exported via our syscall table, so just drop them. Signed-off-by: Helge Deller commit 2d969e8f35b1849a43156029a7a6e2943b89d0c0 Author: Adam Thomson Date: Mon May 30 13:22:23 2022 +0000 ASoC: da7219: cancel AAD related work earlier for jack removal To avoid the unlikely possibility of register misalignment for headphones being ungrounded/driven after a jack has been removed, move the cancel_work_sync() call to the start of the jack removal handling in the IRQ thread. Signed-off-by: Adam Thomson Link: https://lore.kernel.org/r/b3f9a679f1e27a9359dcecb496953c4af30acbaa.1653916368.git.DLG-Adam.Thomson.Opensource@dm.renesas.com Signed-off-by: Mark Brown commit 06f5882122e3faa183d76c4ec2c92f4c38e2c7bb Author: Adam Thomson Date: Mon May 30 13:22:22 2022 +0000 ASoC: da7219: Fix pole orientation detection on certain headsets It has been recently found that certain 'active' headsets can be mis-detected as OMTP instead of CTIA, causing obvious issus with audio quality. This relates to increased resistances which negatively impacts the pole detection circuitry within the device. To counter this, ground switches on both headphone channels are available to enable/disable and these allow for the detection process to operate as intended, even with active headsets. This commit adds control of the ground switches to the AAD logic. Signed-off-by: Adam Thomson Link: https://lore.kernel.org/r/e0a627725c189dd50d6ce24571aed87fe2597395.1653916368.git.DLG-Adam.Thomson.Opensource@dm.renesas.com Signed-off-by: Mark Brown commit d6f8168e4345cb00156743c19dc1a409126936e1 Author: Uwe Kleine-König Date: Sun May 29 16:12:50 2022 +0200 ASoC: Intel: avs: Fix build error on arc, m68k and sparc On some platforms (i.e. arc, m68k and sparc) __fls returns an int (while on most platforms it returns an unsigned long). This triggers a format warning on these few platforms as the driver uses %ld to print a warning. So explicitly cast the return value to unsigned long to make the warning go away (and so fix allmodconfig build on the affected architectures). Fixes: beed983621fb ("ASoC: Intel: avs: Machine board registration") Reviewed-by: Cezary Rojewski Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220529141250.1979827-1-u.kleine-koenig@pengutronix.de Signed-off-by: Mark Brown commit 9f9c1f6844bdacb4a011cc69e19b929997038f4f Merge: 1cdc5ba06dcea da007f171fc9d Author: Rafael J. Wysocki Date: Mon May 30 15:41:11 2022 +0200 Merge branch 'pm-sysoff' Merge system power off handling rework from Dmitry Osipenko for 5.19-rc1. This introduces a mechanism allowing power sequences to be used for powering off the system and makes related changes in platform-specific code for multiple platforms. * pm-sysoff: (29 commits) kernel/reboot: Change registration order of legacy power-off handler m68k: virt: Switch to new sys-off handler API kernel/reboot: Add devm_register_restart_handler() kernel/reboot: Add devm_register_power_off_handler() soc/tegra: pmc: Use sys-off handler API to power off Nexus 7 properly reboot: Remove pm_power_off_prepare() regulator: pfuze100: Use devm_register_sys_off_handler() ACPI: power: Switch to sys-off handler API memory: emif: Use kernel_can_power_off() mips: Use do_kernel_power_off() ia64: Use do_kernel_power_off() x86: Use do_kernel_power_off() sh: Use do_kernel_power_off() m68k: Switch to new sys-off handler API powerpc: Use do_kernel_power_off() xen/x86: Use do_kernel_power_off() parisc: Use do_kernel_power_off() arm64: Use do_kernel_power_off() riscv: Use do_kernel_power_off() csky: Use do_kernel_power_off() ... commit 1cdc5ba06dcea1f1008c497fca34c42be9bc6a1d Merge: 22ffff6d21ebf 4fe4f1552394d Author: Rafael J. Wysocki Date: Mon May 30 15:40:37 2022 +0200 Merge branch 'pm-docs' Merge PM documentation update for 5.19-rc1. * pm-docs: Documentation: admin-guide: PM: Add Out of Band mode commit 22ffff6d21ebfcd6e722af5f6954ab97c726c3c8 Merge: da4363457f777 e04314082c319 Author: Rafael J. Wysocki Date: Mon May 30 15:38:34 2022 +0200 Merge branch 'pm-opp' Merge OPP (Operating Performance Points) changes for 5.19-rc1: - Minor update to dt-binding for Qcom's opp-v2-kryo-cpu (Yassine Oudjana). - Use list iterator only inside the list_for_each_entry loop (Xiaomeng Tong, and Jakob Koschel). - New APIs related to finding OPP based on interconnect bandwidth (Krzysztof Kozlowski). - Fix the missing of_node_put() in _bandwidth_supported() (Dan Carpenter). - Cleanups (Krzysztof Kozlowski, and Viresh Kumar). * pm-opp: opp: Reorder definition of ceil/floor helpers opp: Add apis to retrieve opps with interconnect bandwidth dt-bindings: opp: opp-v2-kryo-cpu: Remove SMEM opp: use list iterator only inside the loop opp: replace usage of found with dedicated list iterator variable PM: opp: simplify with dev_err_probe() OPP: call of_node_put() on error path in _bandwidth_supported() commit da4363457f777906d49d765398f5227657c82ef9 Author: Pierre Gondois Date: Mon May 30 12:04:24 2022 +0200 cpufreq: CPPC: Fix unused-function warning Building the cppc_cpufreq driver with for arm64 with CONFIG_ENERGY_MODEL=n triggers the following warnings: drivers/cpufreq/cppc_cpufreq.c:550:12: error: ‘cppc_get_cpu_cost’ defined but not used [-Werror=unused-function] 550 | static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz, | ^~~~~~~~~~~~~~~~~ drivers/cpufreq/cppc_cpufreq.c:481:12: error: ‘cppc_get_cpu_power’ defined but not used [-Werror=unused-function] 481 | static int cppc_get_cpu_power(struct device *cpu_dev, | ^~~~~~~~~~~~~~~~~~ Move the Energy Model related functions into specific guards. This allows to fix the warning and prevent doing extra work when the Energy Model is not present. Fixes: 740fcdc2c20e ("cpufreq: CPPC: Register EM based on efficiency class information") Reported-by: Shaokun Zhang Signed-off-by: Pierre Gondois Tested-by: Shaokun Zhang Signed-off-by: Rafael J. Wysocki commit a3f083e04a87662559bbadddc02f4739b78e743a Author: Zheng Bin Date: Sat May 21 11:24:38 2022 +0800 cpufreq: CPPC: Fix build error without CONFIG_ACPI_CPPC_CPUFREQ_FIE If CONFIG_ACPI_CPPC_CPUFREQ_FIE is not set, building fails: drivers/cpufreq/cppc_cpufreq.c: In function ‘populate_efficiency_class’: drivers/cpufreq/cppc_cpufreq.c:584:2: error: ‘cppc_cpufreq_driver’ undeclared (first use in this function); did you mean ‘cpufreq_driver’? cppc_cpufreq_driver.register_em = cppc_cpufreq_register_em; ^~~~~~~~~~~~~~~~~~~ cpufreq_driver Make declare of cppc_cpufreq_driver out of CONFIG_ACPI_CPPC_CPUFREQ_FIE to fix this. Fixes: 740fcdc2c20e ("cpufreq: CPPC: Register EM based on efficiency class information") Signed-off-by: Zheng Bin Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit b81c14ca14b631aa1abae32fb5ae75b5e9251012 Author: Haisu Wang Date: Mon May 30 14:40:59 2022 +0800 blk-mq: do not update io_ticks with passthrough requests Flush or passthrough requests are not accounted as normal IO in completion. To reflect iostat for slow IO, io_ticks is updated when stat show called based on inflight numbers. It may cause inconsistent io_ticks calculation result. So do not account non-passthrough request when check inflight. Fixes: 86d7331299fd ("block: update io_ticks when io hang") Signed-off-by: Haisu Wang Reviewed-by: samuelliao Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220530064059.1120058-1-haisuwang@tencent.com Signed-off-by: Jens Axboe commit 9c76d723edd4f4d7d10b33e7e56f72ecbe6cee34 Merge: 212e3b6b87346 a3b9ecc805e91 Author: Arnd Bergmann Date: Mon May 30 14:44:25 2022 +0200 Merge tag 'optee-warning-for-v5.19' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/late Fix a compiler warning in OP-TEE driver * tag 'optee-warning-for-v5.19' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: Pass a pointer to virt_addr_valid() Link: https://lore.kernel.org/r/20220530112612.GA1511426@jade Signed-off-by: Arnd Bergmann commit 9bfa7b36343c7d84370bc61c9ed774635b05e4eb Author: Marios Levogiannis Date: Mon May 30 10:41:31 2022 +0300 ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS Set microphone pins 0x18 (rear) and 0x19 (front) to VREF_50 to fix the microphone noise on ASUS TUF B550M-PLUS which uses the ALCS1200A codec. The initial value was VREF_80. The same issue is also present on Windows using both the default Windows driver and all tested Realtek drivers before version 6.0.9049.1. Comparing Realtek driver 6.0.9049.1 (the first one without the microphone noise) to Realtek driver 6.0.9047.1 (the last one with the microphone noise) revealed that the fix is the result of setting pins 0x18 and 0x19 to VREF_50. This fix may also work for other boards that have been reported to have the same microphone issue and use the ALC1150 and ALCS1200A codecs, since these codecs are similar and the fix in the Realtek driver on Windows is common for both. However, it is currently enabled only for ASUS TUF B550M-PLUS as this is the only board that could be tested. Signed-off-by: Marios Levogiannis Cc: Link: https://lore.kernel.org/r/20220530074131.12258-1-marios.levogiannis@gmail.com Signed-off-by: Takashi Iwai commit 82f586f923e3ac6062bc7867717a7f8afc09e0ff Author: Peter Zijlstra Date: Mon May 30 09:45:38 2022 +0200 sched/autogroup: Fix sysctl move Ivan reported /proc/sys/kernel/sched_autogroup_enabled went walk-about and using the noautogroup command line parameter would result in a boot error message. Turns out the sysctl move placed the init function wrong. Fixes: c8eaf6ac76f4 ("sched: move autogroup sysctls into its own file") Reported-by: Ivan Kozik Signed-off-by: Peter Zijlstra (Intel) Tested-by: Ivan Kozik Link: https://lkml.kernel.org/r/YpR2IqndgsyMzN00@worktop.programming.kicks-ass.net commit 212e3b6b8734655ac4edca979915d002b16f915c Author: Mark Brown Date: Fri May 13 13:12:58 2022 +0100 ARM: configs: Enable more audio support for i.MX The generic audio card for Freescale platforms is used by a wide range of i.MX systems and also has selects for the various audio controllers used on them so will help with systems that don't use that specific card too. Signed-off-by: Mark Brown Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/20220513121258.168364-1-broonie@kernel.org' Signed-off-by: Arnd Bergmann commit 7711fe713a4987695ac6c68c9f175cb2d1d06e83 Author: Ping-Ke Shih Date: Thu May 26 13:12:51 2022 +0800 wifi: rtw88: add a work to correct atomic scheduling warning of ::set_tim The set_tim is supposed to be atomic, but we should download beacon context to firmware with a mutex lock. To avoid warning, do the thing in another work. BUG: scheduling while atomic: swapper/1/0/0x00000700 Modules linked in: CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 5.18.0-rc7-00703-g33b5ee09a0c1 #4 Hardware name: Pine64 RK3566 Quartz64-A Board (DT) Call trace: dump_backtrace.part.0+0xc4/0xd0 show_stack+0x14/0x60 dump_stack_lvl+0x60/0x78 dump_stack+0x14/0x2c __schedule_bug+0x5c/0x70 __schedule+0x5c4/0x630 schedule+0x44/0xb0 schedule_preempt_disabled+0xc/0x14 __mutex_lock.constprop.0+0x538/0x56c __mutex_lock_slowpath+0x10/0x20 mutex_lock+0x54/0x60 rtw_ops_set_tim+0x20/0x40 __sta_info_recalc_tim+0x150/0x250 sta_info_recalc_tim+0x10/0x20 invoke_tx_handlers_early+0x4e4/0x5c0 ieee80211_tx+0x78/0x110 ieee80211_xmit+0x94/0xc0 __ieee80211_subif_start_xmit+0x818/0xd20 ieee80211_subif_start_xmit+0x44/0x2d0 dev_hard_start_xmit+0xd0/0x150 __dev_queue_xmit+0x250/0xb30 dev_queue_xmit+0x10/0x20 br_dev_queue_push_xmit+0x94/0x174 br_forward_finish+0x90/0xa0 __br_forward+0xc0/0x13c br_forward+0x108/0x134 br_dev_xmit+0x1cc/0x3a4 dev_hard_start_xmit+0xd0/0x150 __dev_queue_xmit+0x250/0xb30 dev_queue_xmit+0x10/0x20 arp_xmit+0x6c/0x7c arp_send_dst+0x8c/0xc0 arp_solicit+0xd4/0x1e0 neigh_probe+0x58/0xa0 neigh_timer_handler+0x27c/0x380 call_timer_fn.constprop.0+0x20/0x80 __run_timers.part.0+0x230/0x280 run_timer_softirq+0x38/0x70 _stext+0x104/0x278 __irq_exit_rcu+0xa4/0xdc irq_exit_rcu+0xc/0x14 el1_interrupt+0x34/0x50 el1h_64_irq_handler+0x14/0x20 el1h_64_irq+0x64/0x68 arch_cpu_idle+0x14/0x20 do_idle+0x208/0x290 cpu_startup_entry+0x20/0x30 secondary_start_kernel+0x130/0x144 __secondary_switched+0x54/0x58 Fixes: f2217968ffda ("rtw88: Add update beacon flow for AP mode") Reported-by: Ondřej Jirman Signed-off-by: Ping-Ke Shih Tested-by: Ondřej Jirman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220526051251.281905-1-pkshih@realtek.com commit 9c6837311f437701b398bfaed963458aa292e9d7 Author: Johannes Berg Date: Mon May 23 22:03:01 2022 +0200 wifi: iwlwifi: pcie: rename CAUSE macro At least mips64 has ist own CAUSE macro, so rename ours to IWL_CAUSE to fix build issues. Reported-by: Jakub Kicinski Fixes: c1918196427b ("iwlwifi: pcie: simplify MSI-X cause mapping") Signed-off-by: Johannes Berg Acked-by: Gregory Greenman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220523220300.682be2029361.I283200b18da589a975a284073dca8ed001ee107a@changeid commit d944e09ea839033476e43fe03db0121b7be5154e Author: Johannes Berg Date: Mon May 23 18:02:01 2022 +0200 wifi: libertas: use variable-size data in assoc req/resp cmd The firmware has a 512 limit here, but we use less, so gcc starts complaining about it: drivers/net/wireless/marvell/libertas/cfg.c:1198:63: warning: array subscript ‘struct cmd_ds_802_11_associate_response[0]’ is partly outside array bounds of ‘unsigned char[203]’ [-Warray-bounds] 1198 | "aid 0x%04x\n", status, le16_to_cpu(resp->statuscode), | ^~ Since we size the command and response buffer per our needs and not per the firmware maximum, change to a variable size data array and put the 512 only into a comment. In the end, that's actually what the code always wanted, and it simplifies the code that used to subtract the fixed size buffer size in two places. Reported-by: Jakub Kicinski Signed-off-by: Johannes Berg Acked-by: Kalle Valo Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220523180200.115fa27fbece.Ie66d874b047e7afad63900aa2df70f031711147e@changeid commit 8eecf1c9929aef24e9e75280a39ed1ba3c64fb71 Merge: 725523dd3634f 22511e665eadc Author: Arnd Bergmann Date: Mon May 30 11:00:01 2022 +0200 Merge tag 'socfpga_dts_updates_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/late SoCFPGA dts updates for v5.19 - dtschema fix SPI NOR node - correct dt-bindings doc for Altera gpio driver - add support for n6000 Agilex platform and dt-bindings documentation * tag 'socfpga_dts_updates_for_v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: intel: add device tree for n6000 dt-bindings: intel: add binding for Intel n6000 dt-bindings: soc: add bindings for Intel HPS Copy Engine dt-bindings: gpio: altera: correct interrupt-cells ARM: dts: socfpga: align SPI NOR node name with dtschema Link: https://lore.kernel.org/r/20220519232317.16079-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 725523dd3634f960c504ed3b64b00687734f8c3d Merge: 8a1e75c53c7a5 8dc7aa0a7246a Author: Arnd Bergmann Date: Mon May 30 10:59:41 2022 +0200 Merge tag 'aspeed-5.19-devicetree' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/bmc into arm/late ASPEED device tree updates for 5.19 - New machine: * Nuvia's DC-SCM BMC - Enable AST2600 GFX, the BMC-driven graphics device - Add a bunch of devices for the AST2600 EVB - Updates to the AST2600 Bletchley machine - Backwards compatible changes to support the new spi-mem based SPI NOR driver * tag 'aspeed-5.19-devicetree' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/bmc: ARM: dts: aspeed: ast2600-evb: Enable GFX device ARM: dts: aspeed: Add GFX node to AST2600 ARM: dts: aspeed: ast2600-evb: Enable virtual hub ARM: dts: aspeed: ast2600-evb: Enable video engine ARM: dts: aspeed: everest, rainier: Add power-ffs-sync-history GPIO ARM: dts: aspeed: Add Nuvia DC-SCM BMC ARM: dts: aspeed: bletchley: add sample averaging for ADM1278 ARM: dts: aspeed: bletchley: add eeprom node on each sled ARM: dts: aspeed: bletchley: add pca9536 node on each sled ARM: dts: aspeed: bletchley: update gpio0 line names ARM: dts: aspeed: bletchley: Enable mdio0 bus ARM: dts: aspeed: bletchley: switch spi2 driver to aspeed-smc ARM: dts: aspeed: bletchley: enable ehci0 device node ARM: dts: aspeed: Add USB2.0 device controller node ARM: dts: aspeed-g4: Set spi-max-frequency for all flashes ARM: dts: aspeed: Enable Dual SPI RX transfers ARM: dts: aspeed: Adjust "reg" property of FMC/SPI controllers ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1 Link: https://lore.kernel.org/r/CACPK8XfUmFxU8Y6C+aZ2+=dT7=fCfs2=2_aYqyRjoXCoeQaUWQ@mail.gmail.com Signed-off-by: Arnd Bergmann commit a3b9ecc805e9131476c719111fe347c7dbc0d1d1 Author: Linus Walleij Date: Thu May 19 23:46:35 2022 +0200 tee: optee: Pass a pointer to virt_addr_valid() A pointer into virtual memory is represented by a (void *) not an u32, so the compiler warns: drivers/tee/optee/call.c:365:29: warning: passing argument 1 of 'virt_to_pfn' makes pointer from integer without a cast [-Wint-conversion] Fix this with an explicit cast. Cc: Sumit Garg Signed-off-by: Linus Walleij Reviewed-by: Sumit Garg [jw: fixed merge conflict] Signed-off-by: Jens Wiklander commit 7146bda743e6f543af60584fad2cfbb6ce83d8ac Merge: 621dc801df4c2 efc2efeba169f Author: Dave Chinner Date: Mon May 30 10:58:59 2022 +1000 Merge branch 'guilt/xfs-5.19-larp-cleanups' into xfs-5.19-for-next This series contains a two key cleanups for the new LARP code. Most of it is refactoring and tweaking the code that creates kernel log messages about enabling and disabling features -- we should be warning about LARP being turned on once per mount, instead of once per insmod cycle; we shouldn't be spamming the logs so aggressively about turning *off* log incompat features. The second part of the series refactors the LARP code responsible for getting (and releasing) permission to use xattr log items. The implementation code doesn't belong in xfs_log.c, and calls to logging functions don't belong in libxfs -- they really should be done by the VFS implementation functions before they start calling into libraries. Signed-off-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 621dc801df4c2e523a66c96b250e0133ed7da90e Merge: 6f5097e3367a7 910bbdf2f4d7d Author: Dave Chinner Date: Mon May 30 10:58:13 2022 +1000 Merge branch 'guilt/xfs-5.19-recovery-buf-cancel' into xfs-5.19-for-next As part of solving the memory leaks and UAF problems in the new LARP code, kmemleak also reported that log recovery will leak the table used to hash buffer cancellations if the recovery fails. Fix this problem by creating alloc/free helpers that initialize and free the hashtable contents correctly. Signed-off-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 6f5097e3367a7c0751e165e4c15bc30511a4ba38 Author: Brian Foster Date: Mon May 30 10:56:33 2022 +1000 xfs: fix xfs_ifree() error handling to not leak perag ref For some reason commit 9a5280b312e2e ("xfs: reorder iunlink remove operation in xfs_ifree") replaced a jump to the exit path in the event of an xfs_difree() error with a direct return, which skips releasing the perag reference acquired at the top of the function. Restore the original code to drop the reference on error. Fixes: 9a5280b312e2e ("xfs: reorder iunlink remove operation in xfs_ifree") Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit b00ed48bb0a7c295facf9036135a573a5cdbe7de Merge: c3a9a3c5f5590 d1a2859780826 Author: Linus Torvalds Date: Sun May 29 11:38:27 2022 -0700 Merge tag 'dmaengine-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "Nothing special, this includes a couple of new device support and new driver support and bunch of driver updates. New support: - Tegra gpcdma driver support - Qualcomm SM8350, Sm8450 and SC7280 device support - Renesas RZN1 dma and platform support Updates: - stm32 device pause/resume support and updates - DMA memset ops Documentation and usage clarification - deprecate '#dma-channels' & '#dma-requests' bindings - driver updates for stm32, ptdma idsx etc" * tag 'dmaengine-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (87 commits) dmaengine: idxd: make idxd_wq_enable() return 0 if wq is already enabled dmaengine: sun6i: Add support for the D1 variant dmaengine: sun6i: Add support for 34-bit physical addresses dmaengine: sun6i: Do not use virt_to_phys dt-bindings: dma: sun50i-a64: Add compatible for D1 dmaengine: tegra: Remove unused switch case dmaengine: tegra: Fix uninitialized variable usage dmaengine: stm32-dma: add device_pause/device_resume support dmaengine: stm32-dma: rename pm ops before dma pause/resume introduction dmaengine: stm32-dma: pass DMA_SxSCR value to stm32_dma_handle_chan_done() dmaengine: stm32-dma: introduce stm32_dma_sg_inc to manage chan->next_sg dmaengine: stm32-dmamux: avoid reset of dmamux if used by coprocessor dmaengine: qcom: gpi: Add support for sc7280 dt-bindings: dma: pl330: Add power-domains dmaengine: stm32-mdma: use dev_dbg on non-busy channel spurious it dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() dmaengine: stm32-mdma: remove GISR1 register dmaengine: ti: deprecate '#dma-channels' dmaengine: mmp: deprecate '#dma-channels' dmaengine: pxa: deprecate '#dma-channels' and '#dma-requests' ... commit 9ff9f77f34e44a0054eadb9041e459548c955ccb Author: Jeff Layton Date: Tue May 24 06:31:54 2022 -0400 MAINTAINERS: reciprocal co-maintainership for file locking and nfsd Chuck has agreed to backstop me as maintainer of the file locking code, and I'll do the same for him on knfsd. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c3a9a3c5f5590e85da15d6201e415ff636fe5670 Merge: 76bfd3de34783 dada03db9bb19 Author: Linus Torvalds Date: Sun May 29 10:48:58 2022 -0700 Merge tag 'trace-tools-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing tool updates from Steven Rostedt: - Various clean ups and fixes to rtla (Real Time Linux Analysis) * tag 'trace-tools-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: rtla: Remove procps-ng dependency rtla: Fix __set_sched_attr error message rtla: Minor grammar fix for rtla README rtla: Don't overwrite existing directory mode rtla: Avoid record NULL pointer dereference rtla/Makefile: Properly handle dependencies commit 76bfd3de34783ceda1fc1d73d0db87361de07ecb Merge: 09f73a1ab8207 b39181f7c6907 Author: Linus Torvalds Date: Sun May 29 10:31:36 2022 -0700 Merge tag 'trace-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: "The majority of the changes are for fixes and clean ups. Notable changes: - Rework trace event triggers code to be easier to interact with. - Support for embedding bootconfig with the kernel (as suppose to having it embedded in initram). This is useful for embedded boards without initram disks. - Speed up boot by parallelizing the creation of tracefs files. - Allow absolute ring buffer timestamps handle timestamps that use more than 59 bits. - Added new tracing clock "TAI" (International Atomic Time) - Have weak functions show up in available_filter_function list as: __ftrace_invalid_address___ instead of using the name of the function before it" * tag 'trace-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (52 commits) ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function tracing: Fix comments for event_trigger_separate_filter() x86/traceponit: Fix comment about irq vector tracepoints x86,tracing: Remove unused headers ftrace: Clean up hash direct_functions on register failures tracing: Fix comments of create_filter() tracing: Disable kcov on trace_preemptirq.c tracing: Initialize integer variable to prevent garbage return value ftrace: Fix typo in comment ftrace: Remove return value of ftrace_arch_modify_*() tracing: Cleanup code by removing init "char *name" tracing: Change "char *" string form to "char []" tracing/timerlat: Do not wakeup the thread if the trace stops at the IRQ tracing/timerlat: Print stacktrace in the IRQ handler if needed tracing/timerlat: Notify IRQ new max latency only if stop tracing is set kprobes: Fix build errors with CONFIG_KRETPROBES=n tracing: Fix return value of trace_pid_write() tracing: Fix potential double free in create_var_ref() tracing: Use strim() to remove whitespace instead of doing it manually ftrace: Deal with error return code of the ftrace_process_locs() function ... commit 09f73a1ab8207481d1d6bd91ab7d0125c6722005 Merge: 664a393a2663a 9dde6cadb92b5 Author: Linus Torvalds Date: Sun May 29 10:10:15 2022 -0700 Merge tag 'perf-tools-for-v5.19-2022-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tools updates from Arnaldo Carvalho de Melo: - Add BPF based off-CPU profiling - Improvements for system wide recording, specially for Intel PT - Improve DWARF unwinding on arm64 - Support Arm CoreSight trace data disassembly in 'perf script' python - Fix build with new libbpf version, related to supporting older versions of distro released libbpf packages - Fix event syntax error caused by ExtSel in the JSON events infra - Use stdio interface if slang is not supported in 'perf c2c' - Add 'perf test' checking for perf stat CSV output - Sync the msr-index.h copy with the kernel sources * tag 'perf-tools-for-v5.19-2022-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (38 commits) tools arch x86: Sync the msr-index.h copy with the kernel sources perf scripts python: Support Arm CoreSight trace data disassembly perf scripting python: Expose dso and map information perf jevents: Fix event syntax error caused by ExtSel perf tools arm64: Add support for VG register perf unwind arm64: Decouple Libunwind register names from Perf perf unwind: Use dynamic register set for DWARF unwind perf tools arm64: Copy perf_regs.h from the kernel perf unwind arm64: Use perf's copy of kernel headers perf c2c: Use stdio interface if slang is not supported perf test: Add a basic offcpu profiling test perf record: Add cgroup support for off-cpu profiling perf record: Handle argument change in sched_switch perf record: Implement basic filtering for off-cpu perf record: Enable off-cpu analysis with BPF perf report: Do not extend sample type of bpf-output event perf test: Add checking for perf stat CSV output. perf tools: Allow system-wide events to keep their own threads perf tools: Allow system-wide events to keep their own CPUs libperf evsel: Add comments for booleans ... commit 605f7415ecfb426610195dd6c7577b30592b3369 Author: Jens Axboe Date: Sun May 29 07:13:09 2022 -0600 block: make bioset_exit() fully resilient against being called twice Most of bioset_exit() is fine being called twice, as it clears the various allocations etc when they are freed. The exception is bio_alloc_cache_destroy(), which does not clear ->cache when it has freed it. This isn't necessarily a bug, but can be if buggy users does call the exit path more then once, or with just a memset() bioset which has never been initialized. dm appears to be one such user. Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") Link: https://lore.kernel.org/linux-block/YpK7m+14A+pZKs5k@casper.infradead.org/ Reported-by: Matthew Wilcox Signed-off-by: Jens Axboe commit 90343f573252f5ebf13b3aa3b9a0b7e60ca7f503 Merge: 18eeb4dea65cb c308dfd1b43ef Author: David S. Miller Date: Sun May 29 12:12:53 2022 +0100 Merge branch 'sfc-fixes' Íñigo Huguet says: ==================== sfc: fix some efx_separate_tx_channels errors Trying to load sfc driver with modparam efx_separate_tx_channels=1 resulted in errors during initialization and not being able to use the NIC. This patches fix a few bugs and make it work again. v2: * added Martin's patch instead of a previous mine. Mine one solved some of the initialization errors, but Martin's solves them also in all possible cases. * removed whitespaces cleanup, as requested by Jakub ==================== Signed-off-by: David S. Miller commit c308dfd1b43ef0d4c3e57b741bb3462eb7a7f4a2 Author: Íñigo Huguet Date: Fri May 27 10:05:29 2022 +0200 sfc: fix wrong tx channel offset with efx_separate_tx_channels tx_channel_offset is calculated in efx_allocate_msix_channels, but it is also calculated again in efx_set_channels because it was originally done there, and when efx_allocate_msix_channels was introduced it was forgotten to be removed from efx_set_channels. Moreover, the old calculation is wrong when using efx_separate_tx_channels because now we can have XDP channels after the TX channels, so n_channels - n_tx_channels doesn't point to the first TX channel. Remove the old calculation from efx_set_channels, and add the initialization of this variable if MSI or legacy interrupts are used, next to the initialization of the rest of the related variables, where it was missing. Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Signed-off-by: David S. Miller commit 2e102b53f8a778f872dc137f4c7ac548705817aa Author: Martin Habets Date: Fri May 27 10:05:28 2022 +0200 sfc: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efx_separate_tx_channels=1 is used. In that cases, some channels only have RX queues and others only TX queues (or more preciselly, they have them allocated, but not initialized). Fix efx_channel_has_tx_queues to return the correct value for this case too. Messages shown at probe time before the fix: sfc 0000:03:00.0 ens6f0np0: MC command 0x82 inlen 544 failed rc=-22 (raw=0) arg=0 ------------[ cut here ]------------ netdevice: ens6f0np0: failed to initialise TXQ -1 WARNING: CPU: 1 PID: 626 at drivers/net/ethernet/sfc/ef10.c:2393 efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped RIP: 0010:efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped Call Trace: efx_init_tx_queue+0xaa/0xf0 [sfc] efx_start_channels+0x49/0x120 [sfc] efx_start_all+0x1f8/0x430 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xd0/0x190 __dev_change_flags+0x1b3/0x220 dev_change_flags+0x21/0x60 [...] stripped Messages shown at remove time before the fix: sfc 0000:03:00.0 ens6f0np0: failed to flush 10 queues sfc 0000:03:00.0 ens6f0np0: failed to flush queues Fixes: 8700aff08984 ("sfc: fix channel allocation with brute force") Reported-by: Tianhao Zhao Signed-off-by: Martin Habets Tested-by: Íñigo Huguet Signed-off-by: David S. Miller commit 534671e0ef5b652d6a983bc1c85c339f7dbfe6ce Author: Masahiro Yamada Date: Fri May 27 23:39:31 2022 +0900 parisc: remove arch/parisc/nm Parisc overrides 'nm' with a shell script. I was hit by a false-positive error of $(NM) because this script returns the exit status of grep instead of ${CROSS_COMPILE}nm. (grep returns 1 if no lines were selected) I tried to fix it, but in the code review, Helge suggested to remove it entirely. [1] This script was added in 2003. [2] Presumably, it was a workaround for old toolchains (but even the parisc maintainer does not know the detail any more). Hopefully, recent tools should work fine. [1]: https://lore.kernel.org/all/1c12cd26-d8aa-4498-f4c0-29478b9578fe@gmx.de/ [2]: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=36eaa6e4c0e0b6950136b956b72fd08155b92ca3 Suggested-by: Helge Deller Signed-off-by: Masahiro Yamada Acked-by: Helge Deller commit c25e1c55822f9b3b53ccbf88b85644317a525752 Author: Masahiro Yamada Date: Fri May 27 19:01:49 2022 +0900 kbuild: do not create *.prelink.o for Clang LTO or IBT When CONFIG_LTO_CLANG=y, additional intermediate *.prelink.o is created for each module. Also, objtool is postponed until LLVM IR is converted to ELF. CONFIG_X86_KERNEL_IBT works in a similar way to postpone objtool until objects are merged together. This commit stops generating *.prelink.o, so the build flow will look similar with/without LTO. The following figures show how the LTO build currently works, and how this commit is changing it. Current build flow ================== [1] single-object module $(LD) $(CC) +objtool $(LD) foo.c --------------------> foo.o -----> foo.prelink.o -----> foo.ko (LLVM IR) (ELF) | (ELF) | foo.mod.o --/ (LLVM IR) [2] multi-object module $(LD) $(CC) $(AR) +objtool $(LD) foo1.c -----> foo1.o -----> foo.o -----> foo.prelink.o -----> foo.ko | (archive) (ELF) | (ELF) foo2.c -----> foo2.o --/ | (LLVM IR) foo.mod.o --/ (LLVM IR) One confusion is that foo.o in multi-object module is an archive despite of its suffix. New build flow ============== [1] single-object module Since there is only one object, there is no need to keep the LLVM IR. Use $(CC)+$(LD) to generate an ELF object in one build rule. When LTO is disabled, $(LD) is unneeded because $(CC) produces an ELF object. $(CC)+$(LD)+objtool $(LD) foo.c ----------------------------> foo.o ---------> foo.ko (ELF) | (ELF) | foo.mod.o --/ (LLVM IR) [2] multi-object module Previously, $(AR) was used to combine LLVM IR files into an archive, but there was no technical reason to do so. Use $(LD) to merge them into a single ELF object. $(LD) $(CC) +objtool $(LD) foo1.c ---------> foo1.o ---------> foo.o ---------> foo.ko | (ELF) | (ELF) foo2.c ---------> foo2.o ----/ | (LLVM IR) foo.mod.o --/ (LLVM IR) Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Reviewed-by: Sami Tolvanen Tested-by: Sedat Dilek # LLVM-14 (x86-64) Acked-by: Josh Poimboeuf commit 0cfd90060d714e3d1e0d1b30cfd1c46b71f4e721 Author: Masahiro Yamada Date: Fri May 27 19:01:48 2022 +0900 kbuild: replace $(linked-object) with CONFIG options *.prelink.o is created when CONFIG_LTO_CLANG or CONFIG_X86_KERNEL_IBT is enabled. Replace $(linked-object) with $(CONFIG_LTO_CLANG)$(CONFIG_X86_KERNEL_IBT) so you will get a quick idea of when the --link option is passed. No functional change is intended. Signed-off-by: Masahiro Yamada Acked-by: Josh Poimboeuf Reviewed-by: Nick Desaulniers Tested-by: Sedat Dilek # LLVM-14 commit 0aa24a79ee3b603f6e6cd470c364edc2d746f613 Author: Masahiro Yamada Date: Sun May 29 13:23:18 2022 +0900 kbuild: do not try to parse *.cmd files for objects provided by compiler Guenter Roeck reported the build breakage for parisc and csky. I confirmed nios2 and openrisc are broken as well. The reason is that they borrow libgcc.a from the toolchains. For example, see this line in arch/parisc/Makefile: LIBGCC := $(shell $(CC) -print-libgcc-file-name) Some objects in libgcc.a are linked to vmlinux.o, but they do not have .*.cmd files. Obviously, there is no EXPORT_SYMBOL in external objects. Ignore them. (Most of the architectures import library code into the kernel tree. Perhaps those 4 architectures can do similar, but I do not know how challenging it is.) Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files") Link: https://lore.kernel.org/linux-kbuild/20220528224745.GA2501857@roeck-us.net/T/#mac65c20c71c3e272db0350ecfba53fcd8905b0a0 Reported-by: Guenter Roeck Signed-off-by: Masahiro Yamada Tested-by: Guenter Roeck commit 79b66128f13f5c22dea03a2197495c4b96ab31f5 Author: Helge Deller Date: Sun May 29 08:35:52 2022 +0200 video: fbdev: omap: Add prototype for hwa742_update_window_async() The symbol hwa742_update_window_async() is exported, but there is no prototype defined for it. That's why gcc complains: drivers-video-fbdev-omap-hwa742.c:warning:no-previous-prototype-for-hwa742_update_window_async Add the prototype, but I wonder if we couldn't drop exporting the symbol instead. Since omapfb_update_window_async() is exported the same way, are there any users outside of the tree? Signed-off-by: Helge Deller commit 6e95d0a01899ed176b3450db057c3c0a9609cf47 Author: Gao Xiang Date: Fri May 27 15:01:33 2022 +0800 erofs: update documentation - refine the filesystem overview for better description of recent new features like FSDAX and Fscache; - add the new `fsid' mount option; - fix some typos. Link: https://lore.kernel.org/r/20220527070133.77962-1-hsiangkao@linux.alibaba.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit b5cb79dcfd03e7bb8054d38eaaa557d07966a811 Author: Xin Yin Date: Fri May 27 18:18:00 2022 +0800 erofs: fix crash when enable tracepoint cachefiles_prep_read RIP: 0010:trace_event_raw_event_cachefiles_prep_read+0x88/0xe0 [cachefiles] Call Trace: cachefiles_prepare_read+0x1d7/0x3a0 [cachefiles] erofs_fscache_read_folios+0x188/0x220 [erofs] erofs_fscache_meta_readpage+0x106/0x160 [erofs] do_read_cache_folio+0x42a/0x590 ? bdi_register_va.part.14+0x1a7/0x210 ? super_setup_bdi_name+0x76/0xe0 erofs_bread+0x5b/0x170 [erofs] erofs_fc_fill_super+0x12b/0xc50 [erofs] This tracepoint uses rreq->inode, should set it when allocating. Fixes: d435d53228dd ("erofs: change to use asynchronous io for fscache readpage/readahead") Signed-off-by: Xin Yin Reviewed-by: Jeffle Xu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220527101800.22360-1-yinxin.x@bytedance.com Signed-off-by: Gao Xiang commit 0130e4e8e49f9bd0342d3fc14102470ea9e7230e Author: Jeffle Xu Date: Thu May 26 09:03:44 2022 +0800 erofs: leave compressed inodes unsupported in fscache mode for now erofs over fscache doesn't support the compressed layout yet. It will cause NULL crash if there are compressed inodes contained when working in fscache mode. So far in the erofs based container image distribution scenarios (RAFS v6), the compressed RAFS v6 images are downloaded and then decompressed on demand as an uncompressed erofs image. Then the erofs image is mounted in fscache mode for containers to use. IOWs, currently compressed data is decompressed on the userspace side instead and uncompressed erofs images will be finally cached. The fscache support for the compressed layout is still under development and it will be used for runtime decompression feature. Anyway, to avoid the potential crash, let's leave the compressed inodes unsupported in fscache mode until we support it later. Fixes: 1442b02b66ad ("erofs: implement fscache-based data read for non-inline layout") Signed-off-by: Jeffle Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220526010344.118493-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 1346d00e1bdfd4067f92bc14e8a6131a01de4190 Author: Michael Ellerman Date: Wed May 25 13:26:39 2022 +1000 powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK The HAVE_IRQ_EXIT_ON_IRQ_STACK option tells generic code that irq_exit() is called while still running on the hard irq stack (hardirq_ctx[] in the powerpc code). Selecting the option means the generic code will *not* switch to the softirq stack before running softirqs, because the code is already running on the (mostly empty) hard irq stack. But since commit 1b1b6a6f4cc0 ("powerpc: handle irq_enter/irq_exit in interrupt handler wrappers"), irq_exit() is now called on the regular task stack, not the hard irq stack. That's because previously irq_exit() was called in __do_irq() which is run on the hard irq stack, but now it is called in interrupt_async_exit_prepare() which is called from do_irq() constructed by the wrapper macro, which is after the switch back to the task stack. So drop HAVE_IRQ_EXIT_ON_IRQ_STACK from the Kconfig. This will mean an extra stack switch when processing some interrupts, but should significantly reduce the likelihood of stack overflow. It also means the softirq stack will be used for running softirqs from other interrupts that don't use the hard irq stack, eg. timer interrupts. Fixes: 1b1b6a6f4cc0 ("powerpc: handle irq_enter/irq_exit in interrupt handler wrappers") Cc: stable@vger.kernel.org # v5.12+ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220525032639.1947280-1-mpe@ellerman.id.au commit a1b29ba2f2c171b9bea73be993bfdf0a62d37d15 Author: He Ying Date: Thu Jan 20 20:44:18 2022 -0500 powerpc/kasan: Silence KASAN warnings in __get_wchan() The following KASAN warning was reported in our kernel. BUG: KASAN: stack-out-of-bounds in get_wchan+0x188/0x250 Read of size 4 at addr d216f958 by task ps/14437 CPU: 3 PID: 14437 Comm: ps Tainted: G O 5.10.0 #1 Call Trace: [daa63858] [c0654348] dump_stack+0x9c/0xe4 (unreliable) [daa63888] [c035cf0c] print_address_description.constprop.3+0x8c/0x570 [daa63908] [c035d6bc] kasan_report+0x1ac/0x218 [daa63948] [c00496e8] get_wchan+0x188/0x250 [daa63978] [c0461ec8] do_task_stat+0xce8/0xe60 [daa63b98] [c0455ac8] proc_single_show+0x98/0x170 [daa63bc8] [c03cab8c] seq_read_iter+0x1ec/0x900 [daa63c38] [c03cb47c] seq_read+0x1dc/0x290 [daa63d68] [c037fc94] vfs_read+0x164/0x510 [daa63ea8] [c03808e4] ksys_read+0x144/0x1d0 [daa63f38] [c005b1dc] ret_from_syscall+0x0/0x38 --- interrupt: c00 at 0x8fa8f4 LR = 0x8fa8cc The buggy address belongs to the page: page:98ebcdd2 refcount:0 mapcount:0 mapping:00000000 index:0x2 pfn:0x1216f flags: 0x0() raw: 00000000 00000000 01010122 00000000 00000002 00000000 ffffffff 00000000 raw: 00000000 page dumped because: kasan: bad access detected Memory state around the buggy address: d216f800: 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 d216f880: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >d216f900: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 ^ d216f980: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 d216fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 After looking into this issue, I find the buggy address belongs to the task stack region. It seems KASAN has something wrong. I look into the code of __get_wchan in x86 architecture and find the same issue has been resolved by the commit f7d27c35ddff ("x86/mm, kasan: Silence KASAN warnings in get_wchan()"). The solution could be applied to powerpc architecture too. As Andrey Ryabinin said, get_wchan() is racy by design, it may access volatile stack of running task, thus it may access redzone in a stack frame and cause KASAN to warn about this. Use READ_ONCE_NOCHECK() to silence these warnings. Reported-by: Wanming Hu Signed-off-by: He Ying Signed-off-by: Chen Jingwen Reviewed-by: Kees Cook Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220121014418.155675-1-heying24@huawei.com commit 743cdb7bd0f1cb32c03680c8b38257957db2e692 Author: Paul Mackerras Date: Thu May 19 17:45:21 2022 +1000 powerpc/kasan: Mark more real-mode code as not to be instrumented This marks more files and functions that can possibly be called in real mode as not to be instrumented by KASAN. Most were found by inspection, except for get_pseries_errorlog() which was reported as causing a crash in testing. Reported-by: Nageswara R Sastry Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoX1kZPnmUX4RZEK@cleo commit 664a393a2663a0f62fc1b18157ccae33dcdbb8c8 Merge: 47f15561b69e2 1e90e2628cec1 Author: Linus Torvalds Date: Sat May 28 14:05:54 2022 -0700 Merge tag 'input-for-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new driver for the Azoteq IQS7222A/B/C capacitive touch controller - a new driver for Raspberry Pi Sense HAT joystick - sun4i-lradc-keys gained support of R329 and D1 variants, plus it can be now used as a wakeup source - pm8941-pwrkey can now properly handle PON GEN3 variants; the driver also implements software debouncing and has a workaround for missing key press events - assorted driver fixes and cleanups * tag 'input-for-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (29 commits) Input: stmfts - do not leave device disabled in stmfts_input_open Input: gpio-keys - cancel delayed work only in case of GPIO Input: cypress_ps2 - fix typo in comment Input: vmmouse - disable vmmouse before entering suspend mode dt-bindings: google,cros-ec-keyb: Fixup bad compatible match Input: cros-ec-keyb - allow skipping keyboard registration dt-bindings: google,cros-ec-keyb: Introduce switches only compatible Input: psmouse-smbus - avoid flush_scheduled_work() usage Input: bcm-keypad - remove unneeded NULL check before clk_disable_unprepare Input: sparcspkr - fix refcount leak in bbc_beep_probe Input: sun4i-lradc-keys - add support for R329 and D1 Input: sun4i-lradc-keys - add optional clock/reset support dt-bindings: input: sun4i-lradc-keys: Add R329 and D1 compatibles Input: sun4i-lradc-keys - add wakeup support Input: pm8941-pwrkey - simulate missed key press events Input: pm8941-pwrkey - add software key press debouncing support Input: pm8941-pwrkey - add support for PON GEN3 base addresses Input: pm8941-pwrkey - fix error message Input: synaptics-rmi4 - remove unnecessary flush_workqueue() Input: ep93xx_keypad - use devm_platform_ioremap_resource() helper ... commit 47f15561b69e226bfc034e94ff6dbec51a4662af Author: Linus Torvalds Date: Sat May 28 11:08:48 2022 -0700 drm: fix EDID struct for old ARM OABI format When building the kernel for arm with the "-mabi=apcs-gnu" option, gcc will force alignment of all structures and unions to a word boundary (see also STRUCTURE_SIZE_BOUNDARY and the "-mstructure-size-boundary=XX" option if you're a gcc person), even when the members of said structures do not want or need said alignment. This completely messes up the structure alignment of 'struct edid' on those targets, because even though all the embedded structures are marked with "__attribute__((packed))", the unions that contain them are not. This was exposed by commit f1e4c916f97f ("drm/edid: add EDID block count and size helpers"), but the bug is pre-existing. That commit just made the structure layout problem cause a build failure due to the addition of the BUILD_BUG_ON(sizeof(*edid) != EDID_LENGTH); sanity check in drivers/gpu/drm/drm_edid.c:edid_block_data(). This legacy union alignment should probably not be used in the first place, but we can fix the layout by adding the packed attribute to the union entries even when each member is already packed and it shouldn't matter in a sane build environment. You can see this issue with a trivial test program: union { struct { char c[5]; }; struct { char d; unsigned e; } __attribute__((packed)); } a = { "1234" }; where building this with a normal "gcc -S" will result in the expected 5-byte size of said union: .type a, @object .size a, 5 but with an ARM compiler and the old ABI: arm-linux-gnu-gcc -mabi=apcs-gnu -mfloat-abi=soft -S t.c you get .type a, %object .size a, 8 instead, because even though each member of the union is packed, the union itself still gets aligned. This was reported by Sudip for the spear3xx_defconfig target. Link: https://lore.kernel.org/lkml/YpCUzStDnSgQLNFN@debian/ Reported-by: Sudip Mukherjee Acked-by: Arnd Bergmann Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Linus Torvalds commit 18eeb4dea65cb587057740d6b7b71a13bcfececd Author: Christophe JAILLET Date: Fri May 27 11:25:47 2022 +0200 net: enetc: Use pci_release_region() to release some resources Some resources are allocated using pci_request_region(). It is more straightforward to release them with pci_release_region(). Fixes: 231ece36f50d ("enetc: Add mdio bus driver for the PCIe MDIO endpoint") Signed-off-by: Christophe JAILLET Reviewed-by: Claudiu Manoil Signed-off-by: David S. Miller commit f56dbdda4322d33d485f3d30f3aabba71de9098c Merge: 6112bd00e84e5 d27423bf048dc Author: Linus Torvalds Date: Sat May 28 11:39:01 2022 -0700 Merge tag 'hyperv-next-signed-20220528' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Harden hv_sock driver (Andrea Parri) - Harden Hyper-V PCI driver (Andrea Parri) - Fix multi-MSI for Hyper-V PCI driver (Jeffrey Hugo) - Fix Hyper-V PCI to reduce boot time (Dexuan Cui) - Remove code for long EOL'ed Hyper-V versions (Michael Kelley, Saurabh Sengar) - Fix balloon driver error handling (Shradha Gupta) - Fix a typo in vmbus driver (Julia Lawall) - Ignore vmbus IMC device (Michael Kelley) - Add a new error message to Hyper-V DRM driver (Saurabh Sengar) * tag 'hyperv-next-signed-20220528' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (28 commits) hv_balloon: Fix balloon_probe() and balloon_remove() error handling scsi: storvsc: Removing Pre Win8 related logic Drivers: hv: vmbus: fix typo in comment PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit() PCI: hv: Add validation for untrusted Hyper-V values PCI: hv: Fix interrupt mapping for multi-MSI PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 video: hyperv_fb: Remove support for Hyper-V 2008 and 2008R2/Win7 scsi: storvsc: Remove support for Hyper-V 2008 and 2008R2/Win7 Drivers: hv: vmbus: Remove support for Hyper-V 2008 and Hyper-V 2008R2/Win7 x86/hyperv: Disable hardlockup detector by default in Hyper-V guests drm/hyperv: Add error message for fb size greater than allocated PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI Drivers: hv: vmbus: Refactor the ring-buffer iterator functions Drivers: hv: vmbus: Accept hv_sock offers in isolated guests hv_sock: Add validation for untrusted Hyper-V values hv_sock: Copy packets sent by Hyper-V out of the ring buffer hv_sock: Check hv_pkt_iter_first_raw()'s return value ... commit 6112bd00e84e5dbffebc3c1e908cbe914ca772ee Merge: 907bb57aa7b47 dcf280e6f80be Author: Linus Torvalds Date: Sat May 28 11:27:17 2022 -0700 Merge tag 'powerpc-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Convert to the generic mmap support (ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT) - Add support for outline-only KASAN with 64-bit Radix MMU (P9 or later) - Increase SIGSTKSZ and MINSIGSTKSZ and add support for AT_MINSIGSTKSZ - Enable the DAWR (Data Address Watchpoint) on POWER9 DD2.3 or later - Drop support for system call instruction emulation - Many other small features and fixes Thanks to Alexey Kardashevskiy, Alistair Popple, Andy Shevchenko, Bagas Sanjaya, Bjorn Helgaas, Bo Liu, Chen Huang, Christophe Leroy, Colin Ian King, Daniel Axtens, Dwaipayan Ray, Fabiano Rosas, Finn Thain, Frank Rowand, Fuqian Huang, Guilherme G. Piccoli, Hangyu Hua, Haowen Bai, Haren Myneni, Hari Bathini, He Ying, Jason Wang, Jiapeng Chong, Jing Yangyang, Joel Stanley, Julia Lawall, Kajol Jain, Kevin Hao, Krzysztof Kozlowski, Laurent Dufour, Lv Ruyi, Madhavan Srinivasan, Magali Lemes, Miaoqian Lin, Minghao Chi, Nathan Chancellor, Naveen N. Rao, Nicholas Piggin, Oliver O'Halloran, Oscar Salvador, Pali Rohár, Paul Mackerras, Peng Wu, Qing Wang, Randy Dunlap, Reza Arbab, Russell Currey, Sohaib Mohamed, Vaibhav Jain, Vasant Hegde, Wang Qing, Wang Wensheng, Xiang wangx, Xiaomeng Tong, Xu Wang, Yang Guang, Yang Li, Ye Bin, YueHaibing, Yu Kuai, Zheng Bin, Zou Wei, and Zucheng Zheng. * tag 'powerpc-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (200 commits) powerpc/64: Include cache.h directly in paca.h powerpc/64s: Only set HAVE_ARCH_UNMAPPED_AREA when CONFIG_PPC_64S_HASH_MMU is set powerpc/xics: Include missing header powerpc/powernv/pci: Drop VF MPS fixup powerpc/fsl_book3e: Don't set rodata RO too early powerpc/microwatt: Add mmu bits to device tree powerpc/powernv/flash: Check OPAL flash calls exist before using powerpc/powermac: constify device_node in of_irq_parse_oldworld() powerpc/powermac: add missing g5_phy_disable_cpu1() declaration selftests/powerpc/pmu: fix spelling mistake "mis-match" -> "mismatch" powerpc: Enable the DAWR on POWER9 DD2.3 and above powerpc/64s: Add CPU_FTRS_POWER10 to ALWAYS mask powerpc/64s: Add CPU_FTRS_POWER9_DD2_2 to CPU_FTRS_ALWAYS mask powerpc: Fix all occurences of "the the" selftests/powerpc/pmu/ebb: remove fixed_instruction.S powerpc/platforms/83xx: Use of_device_get_match_data() powerpc/eeh: Drop redundant spinlock initialization powerpc/iommu: Add missing of_node_put in iommu_init_early_dart powerpc/pseries/vas: Call misc_deregister if sysfs init fails powerpc/papr_scm: Fix leaking nvdimm_events_map elements ... commit 907bb57aa7b471872aab2f2e83e9713a145673f9 Merge: ca7984dff94c0 83969805cc716 Author: Linus Torvalds Date: Sat May 28 11:15:54 2022 -0700 Merge tag 'pinctrl-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Pretty big this time. Mostly due to (nice) Renesas refactorings. Core changes: - New helpers from Andy such as for_each_gpiochip_node() affecting both GPIO and pin control, improving a bunch of drivers in the process. - Pulled in Marc Zyngiers work to make IRQ chips immutable, and started to apply fixups on top. New drivers: - New driver for Marvell MVEBU 98DX2530. - New driver for Mediatek MT8195. - Support Qualcomm PMX65 and PM6125. - New driver for Qualcomm SC7280 LPASS pin control. - New driver for Rockchip RK3588. - New driver for NXP Freescale i.MXRT1170. - New driver for Mediatek MT6795 Helio X10. Improvements: - Several Aspeed G6 cleanups and non-critical fixes. - Thorought refactoring of some of the ever improving Renesas drivers. - Clean up Mediatek MT8192 bindings a bit. - PWM output and clock monitoring in the Ocelot LAN966x driver. - Thorough refactoring and cleanup of the Ralink drivers such as RT2880, RT3883, RT305X, MT7620, MT7621, MT7628 splitting these into proper sub-drivers" * tag 'pinctrl-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (161 commits) pinctrl: apple: Use a raw spinlock for the regmap pinctrl: berlin: bg4ct: Use devm_platform_*ioremap_resource() APIs pinctrl: intel: Fix kernel doc format, i.e. add return sections dt-bindings: pinctrl: qcom: Drop 'maxItems' on 'wakeup-parent' pinctrl: starfive: Make the irqchip immutable pinctrl: mediatek: Add pinctrl driver for MT6795 Helio X10 dt-bindings: pinctrl: Add MediaTek MT6795 pinctrl bindings pinctrl: freescale: Add i.MXRT1170 pinctrl driver support dt-bindings: pinctrl: add i.MXRT1170 pinctrl Documentation dt-bindings: pinctrl: rockchip: increase max amount of device functions dt-bindings: pinctrl: qcom,pmic-gpio: add 'gpio-reserved-ranges' dt-bindings: pinctrl: qcom,pmic-gpio: add 'input-disable' dt-bindings: pinctrl: qcom,pmic-gpio: describe gpio-line-names dt-bindings: pinctrl: qcom,pmic-gpio: fix matching pin config dt-bindings: pinctrl: qcom,pmic-gpio: document PM8150L and PMM8155AU pinctrl: qcom: spmi-gpio: Add pm6125 compatible dt-bindings: pinctrl: qcom-pmic-gpio: Add pm6125 compatible pinctrl: intel: Drop unused irqchip member in struct intel_pinctrl pinctrl: intel: make irq_chip immutable pinctrl: cherryview: Use GPIO chip pointer in chv_gpio_irq_mask_unmask() ... commit acde4003efc16480375543638484d8f13f2e99a3 Author: Javier Martinez Canillas Date: Thu May 26 21:47:52 2022 +0200 video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup Commit b3c9a924aab6 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove") fixed a use-after-free error due the vesafb driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy. This can happen if the .fb_destroy callback is executed after the .remove callback, since the former tries to access a pointer freed by the latter. But that change didn't take into account that another possible scenario is that .fb_destroy is called before the .remove callback. For example, if no process has the fbdev chardev opened by the time the driver is removed. If that's the case, fb_info will be freed when unregister_framebuffer() is called, making the fb_info pointer accessed in vesafb_remove() after that to no longer be valid. To prevent that, move the expression containing the info->par to happen before the unregister_framebuffer() function call. Fixes: b3c9a924aab6 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove") Reported-by: Pascal Ernster Signed-off-by: Javier Martinez Canillas Tested-by: Pascal Ernster Signed-off-by: Helge Deller commit ca7984dff94c091a68454b61eb754ec9d4b782a6 Author: Jason A. Donenfeld Date: Sat May 28 13:09:18 2022 +0200 Revert "crypto: poly1305 - cleanup stray CRYPTO_LIB_POLY1305_RSIZE" This reverts commit 8bdc2a190105e862dfe7a4033f2fd385b7e58ae8. It got merged a bit prematurely and shortly after the kernel test robot and Sudip pointed out build failures: arm: imx_v6_v7_defconfig and multi_v7_defconfig mips: decstation_64_defconfig, decstation_defconfig, decstation_r4k_defconfig In file included from crypto/chacha20poly1305.c:13: include/crypto/poly1305.h:56:46: error: 'CONFIG_CRYPTO_LIB_POLY1305_RSIZE' undeclared here (not in a function); did you mean 'CONFIG_CRYPTO_POLY1305_MODULE'? 56 | struct poly1305_key opaque_r[CONFIG_CRYPTO_LIB_POLY1305_RSIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We could attempt to fix this by listing the dependencies piecemeal, but it's not as obvious as it looks: drivers like caam use this macro in headers even if there's no .o compiled in that makes use of it. So actually fixing this might require a bit more of a comprehensive approach, rather than whack-a-mole with hunting down which drivers use which headers which use this macro. Therefore, this commit just reverts the change, and maybe the problem can be visited on the next rainy day. Reported-by: Sudip Mukherjee Reported-by: kernel test robot Fixes: 8bdc2a190105 ("crypto: poly1305 - cleanup stray CRYPTO_LIB_POLY1305_RSIZE") Signed-off-by: Jason A. Donenfeld Signed-off-by: Linus Torvalds commit 5e1eeef69c0fef6249b794bda5d68f95a65d062f Author: Hangbin Liu Date: Fri May 27 14:44:39 2022 +0800 bonding: NS target should accept link local address When setting bond NS target, we use bond_is_ip6_target_ok() to check if the address valid. The link local address was wrongly rejected in bond_changelink(), as most time the user just set the ARP/NS target to gateway, while the IPv6 gateway is always a link local address when user set up interface via SLAAC. So remove the link local addr check when setting bond NS target. Fixes: 129e3c1bab24 ("bonding: add new option ns_ip6_target") Reported-by: Li Liang Signed-off-by: Hangbin Liu Reviewed-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit 911799172d2f703cc14e9000c55d124d5e0a91a2 Author: keliu Date: Fri May 27 06:42:25 2022 +0000 net: nfc: Directly use ida_alloc()/free() Use ida_alloc()/ida_free() instead of deprecated ida_simple_get()/ida_simple_remove() . Signed-off-by: keliu Signed-off-by: David S. Miller commit b39181f7c6907dc66ff937b74758671fa6ba430c Author: Steven Rostedt (Google) Date: Thu May 26 14:19:12 2022 -0400 ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function If an unused weak function was traced, it's call to fentry will still exist, which gets added into the __mcount_loc table. Ftrace will use kallsyms to retrieve the name for each location in __mcount_loc to display it in the available_filter_functions and used to enable functions via the name matching in set_ftrace_filter/notrace. Enabling these functions do nothing but enable an unused call to ftrace_caller. If a traced weak function is overridden, the symbol of the function would be used for it, which will either created duplicate names, or if the previous function was not traced, it would be incorrectly be listed in available_filter_functions as a function that can be traced. This became an issue with BPF[1] as there are tooling that enables the direct callers via ftrace but then checks to see if the functions were actually enabled. The case of one function that was marked notrace, but was followed by an unused weak function that was traced. The unused function's call to fentry was added to the __mcount_loc section, and kallsyms retrieved the untraced function's symbol as the weak function was overridden. Since the untraced function would not get traced, the BPF check would detect this and fail. The real fix would be to fix kallsyms to not show addresses of weak functions as the function before it. But that would require adding code in the build to add function size to kallsyms so that it can know when the function ends instead of just using the start of the next known symbol. In the mean time, this is a work around. Add a FTRACE_MCOUNT_MAX_OFFSET macro that if defined, ftrace will ignore any function that has its call to fentry/mcount that has an offset from the symbol that is greater than FTRACE_MCOUNT_MAX_OFFSET. If CONFIG_HAVE_FENTRY is defined for x86, define FTRACE_MCOUNT_MAX_OFFSET to zero (unless IBT is enabled), which will have ftrace ignore all locations that are not at the start of the function (or one after the ENDBR instruction). A worker thread is added at boot up to scan all the ftrace record entries, and will mark any that fail the FTRACE_MCOUNT_MAX_OFFSET test as disabled. They will still appear in the available_filter_functions file as: __ftrace_invalid_address___ (showing the offset that caused it to be invalid). This is required for tools that use libtracefs (like trace-cmd does) that scan the available_filter_functions and enable set_ftrace_filter and set_ftrace_notrace using indexes of the function listed in the file (this is a speedup, as enabling thousands of files via names is an O(n^2) operation and can take minutes to complete, where the indexing takes less than a second). The invalid functions cannot be removed from available_filter_functions as the names there correspond to the ftrace records in the array that manages them (and the indexing depends on this). [1] https://lore.kernel.org/all/20220412094923.0abe90955e5db486b7bca279@kernel.org/ Link: https://lkml.kernel.org/r/20220526141912.794c2786@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit a1a2d8f0162b27e85e7ce0ae6a35c96a490e0559 Author: Coly Li Date: Sat May 28 20:45:50 2022 +0800 bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() The kworker routine update_writeback_rate() is schedued to update the writeback rate in every 5 seconds by default. Before calling __update_writeback_rate() to do real job, semaphore dc->writeback_lock should be held by the kworker routine. At the same time, bcache writeback thread routine bch_writeback_thread() also needs to hold dc->writeback_lock before flushing dirty data back into the backing device. If the dirty data set is large, it might be very long time for bch_writeback_thread() to scan all dirty buckets and releases dc->writeback_lock. In such case update_writeback_rate() can be starved for long enough time so that kernel reports a soft lockup warn- ing started like: watchdog: BUG: soft lockup - CPU#246 stuck for 23s! [kworker/246:31:179713] Such soft lockup condition is unnecessary, because after the writeback thread finishes its job and releases dc->writeback_lock, the kworker update_writeback_rate() may continue to work and everything is fine indeed. This patch avoids the unnecessary soft lockup by the following method, - Add new member to struct cached_dev - dc->rate_update_retry (0 by default) - In update_writeback_rate() call down_read_trylock(&dc->writeback_lock) firstly, if it fails then lock contention happens. - If dc->rate_update_retry <= BCH_WBRATE_UPDATE_MAX_SKIPS (15), doesn't acquire the lock and reschedules the kworker for next try. - If dc->rate_update_retry > BCH_WBRATE_UPDATE_MAX_SKIPS, no retry anymore and call down_read(&dc->writeback_lock) to wait for the lock. By the above method, at worst case update_writeback_rate() may retry for 1+ minutes before blocking on dc->writeback_lock by calling down_read(). For a 4TB cache device with 1TB dirty data, 90%+ of the unnecessary soft lockup warning message can be avoided. When retrying to acquire dc->writeback_lock in update_writeback_rate(), of course the writeback rate cannot be updated. It is fair, because when the kworker is blocked on the lock contention of dc->writeback_lock, the writeback rate cannot be updated neither. This change follows Jens Axboe's suggestion to a more clear and simple version. Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20220528124550.32834-2-colyli@suse.de Signed-off-by: Jens Axboe commit e2e530867245d051dc7800b0d07193b3e581f5b9 Author: Christoph Hellwig Date: Tue May 24 14:15:30 2022 +0200 blk-mq: remove the done argument to blk_execute_rq_nowait Let the caller set it together with the end_io_data instead of passing a pointless argument. Note the the target code did in fact already set it and then just overrode it again by calling blk_execute_rq_nowait. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20220524121530.943123-4-hch@lst.de Signed-off-by: Jens Axboe commit 32ac5a9b8bc511edcd81f03c3e21753789475709 Author: Christoph Hellwig Date: Tue May 24 14:15:29 2022 +0200 blk-mq: avoid a mess of casts for blk_end_sync_rq Instead of trying to cast a __bitwise 32-bit integer to a larger integer and then a pointer, just allow a struct with the blk_status_t and the completion on stack and set the end_io_data to that. Use the opportunity to move the code to where it belongs and drop rather confusing comments. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20220524121530.943123-3-hch@lst.de Signed-off-by: Jens Axboe commit ae948fd6d02930a7e8e7c492d9627dfef18e7d7f Author: Christoph Hellwig Date: Tue May 24 14:15:28 2022 +0200 blk-mq: remove __blk_execute_rq_nowait We don't want to plug for synchronous execution that where we immediately wait for the request. Once that is done not a whole lot of code is shared, so just remove __blk_execute_rq_nowait. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20220524121530.943123-2-hch@lst.de Signed-off-by: Jens Axboe commit ebd076bf7d5deef488ec7ebc3fdbf781eafae269 Author: Christoph Hellwig Date: Mon May 23 14:43:02 2022 +0200 block: use bio_queue_enter instead of blk_queue_enter in bio_poll We want to have a valid live gendisk to call ->poll and not just a request_queue, so call the right helper. Fixes: 3e08773c3841 ("block: switch polling to be bio based") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220523124302.526186-1-hch@lst.de Signed-off-by: Jens Axboe commit 0649e4d63420ebc8cbebef3e9d39e12ffc5eb9fa Author: Yu Xiao Date: Fri May 27 20:24:24 2022 +0200 nfp: only report pause frame configuration for physical device Only report pause frame configuration for physical device. Logical port of both PCI PF and PCI VF do not support it. Fixes: 9fdc5d85a8fe ("nfp: update ethtool reporting of pauseframe control") Signed-off-by: Yu Xiao Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit d8064c10560d53a841b08ab2e11dbd5d28873955 Author: Sean Anderson Date: Fri May 27 16:37:47 2022 -0400 net: dpaa: Convert to SPDX identifiers This converts these files to use SPDX idenfifiers instead of license text. Signed-off-by: Sean Anderson Reviewed-by: Madalin Bucur Signed-off-by: David S. Miller commit 11825765291a93d8e7f44230da67b9f607c777bf Author: Eric Dumazet Date: Fri May 27 14:28:29 2022 -0700 tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd syzbot got a new report [1] finally pointing to a very old bug, added in initial support for MTU probing. tcp_mtu_probe() has checks about starting an MTU probe if tcp_snd_cwnd(tp) >= 11. But nothing prevents tcp_snd_cwnd(tp) to be reduced later and before the MTU probe succeeds. This bug would lead to potential zero-divides. Debugging added in commit 40570375356c ("tcp: add accessors to read/set tp->snd_cwnd") has paid off :) While we are at it, address potential overflows in this code. [1] WARNING: CPU: 1 PID: 14132 at include/net/tcp.h:1219 tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712 Modules linked in: CPU: 1 PID: 14132 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-07857-gbabf0bb978e3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcp_snd_cwnd_set include/net/tcp.h:1219 [inline] RIP: 0010:tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712 Code: 74 08 48 89 ef e8 da 80 17 f9 48 8b 45 00 65 48 ff 80 80 03 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 aa b0 c5 f8 <0f> 0b e9 16 fe ff ff 48 8b 4c 24 08 80 e1 07 38 c1 0f 8c c7 fc ff RSP: 0018:ffffc900079e70f8 EFLAGS: 00010287 RAX: ffffffff88c0f7f6 RBX: ffff8880756e7a80 RCX: 0000000000040000 RDX: ffffc9000c6c4000 RSI: 0000000000031f9e RDI: 0000000000031f9f RBP: 0000000000000000 R08: ffffffff88c0f606 R09: ffffc900079e7520 R10: ffffed101011226d R11: 1ffff1101011226c R12: 1ffff1100eadcf50 R13: ffff8880756e72c0 R14: 1ffff1100eadcf89 R15: dffffc0000000000 FS: 00007f643236e700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1ab3f1e2a0 CR3: 0000000064fe7000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_clean_rtx_queue+0x223a/0x2da0 net/ipv4/tcp_input.c:3356 tcp_ack+0x1962/0x3c90 net/ipv4/tcp_input.c:3861 tcp_rcv_established+0x7c8/0x1ac0 net/ipv4/tcp_input.c:5973 tcp_v6_do_rcv+0x57b/0x1210 net/ipv6/tcp_ipv6.c:1476 sk_backlog_rcv include/net/sock.h:1061 [inline] __release_sock+0x1d8/0x4c0 net/core/sock.c:2849 release_sock+0x5d/0x1c0 net/core/sock.c:3404 sk_stream_wait_memory+0x700/0xdc0 net/core/stream.c:145 tcp_sendmsg_locked+0x111d/0x3fc0 net/ipv4/tcp.c:1410 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1448 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] __sys_sendto+0x439/0x5c0 net/socket.c:2119 __do_sys_sendto net/socket.c:2131 [inline] __se_sys_sendto net/socket.c:2127 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2127 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f6431289109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f643236e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f643139c100 RCX: 00007f6431289109 RDX: 00000000d0d0c2ac RSI: 0000000020000080 RDI: 000000000000000a RBP: 00007f64312e308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff372533af R14: 00007f643236e300 R15: 0000000000022000 Fixes: 5d424d5a674f ("[TCP]: MTU probing") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Signed-off-by: David S. Miller commit 2f1de254a25bee55600287e2eb2cc12ea389c129 Author: Ke Liu Date: Sat May 28 04:54:37 2022 +0000 net: phy: Directly use ida_alloc()/free() Use ida_alloc()/ida_free() instead of deprecated ida_simple_get()/ida_simple_remove(). Signed-off-by: Ke Liu Signed-off-by: David S. Miller commit e225c9a5a74b12e9ef8516f30a3db2c7eb866ee1 Author: Guangguan Wang Date: Sat May 28 14:54:57 2022 +0800 net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" "struct smc_cdc_tx_pend **" can not directly convert to "struct smc_wr_tx_pend_priv *". Fixes: 2bced6aefa3d ("net/smc: put slot when connection is killed") Signed-off-by: Guangguan Wang Signed-off-by: David S. Miller commit 630f972d76d6460235e84e1aa034ee06f9c8c3a9 Author: Heinrich Schuchardt Date: Sat May 28 03:41:32 2022 +0200 riscv: read-only pages should not be writable If EFI pages are marked as read-only, we should remove the _PAGE_WRITE flag. The current code overwrites an unused value. Fixes: b91540d52a08b ("RISC-V: Add EFI runtime services") Signed-off-by: Heinrich Schuchardt Link: https://lore.kernel.org/r/20220528014132.91052-1-heinrich.schuchardt@canonical.com Signed-off-by: Ard Biesheuvel commit 2ef4bb24ff39ae4af89b80bcc5d516f55368e8ae Author: Minghao Chi Date: Wed Mar 9 05:37:32 2022 +0000 pcmcia: Use platform_get_irq() to get the interrupt It is not recommened to use platform_get_resource(pdev, IORESOURCE_IRQ) for requesting IRQ's resources any more, as they can be not ready yet in case of DT-booting. platform_get_irq() instead is a recommended way for getting IRQ even if it was not retrieved earlier. It also makes code simpler because we're getting "int" value right away and no conversion from resource to int is required. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Signed-off-by: Dominik Brodowski commit 0a19bab54ef44348aa5edfc2b8ff47f63a45ae15 Author: Boris Ostrovsky Date: Fri May 27 13:57:05 2022 -0400 MAINTAINERS: Update Xen maintainership Due to time constraints I am stepping down as maintainter. I will stay as reviewer for x86 code (for which create a separate category). Stefano is now maintainer for Xen hypervisor interface and Oleksandr has graciously agreed to become a reviewer. Signed-off-by: Boris Ostrovsky Acked-by: Stefano Stabellini Acked-by: Juergen Gross Acked-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/1653674225-10447-1-git-send-email-boris.ostrovsky@oracle.com Signed-off-by: Juergen Gross commit 9d004b2f4fea97cde123e7f1939b80e77bf2e695 Merge: a9f94826e4bb6 34e37b4c432cd Author: Linus Torvalds Date: Fri May 27 21:24:19 2022 -0700 Merge tag 'cxl-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl updates from Dan Williams: "Compute Express Link (CXL) updates for this cycle. The highlight is new driver-core infrastructure and CXL subsystem changes for allowing lockdep to validate device_lock() usage. Thanks to PeterZ for setting me straight on the current capabilities of the lockdep API, and Greg acked it as well. On the CXL ACPI side this update adds support for CXL _OSC so that platform firmware knows that it is safe to still grant Linux native control of PCIe hotplug and error handling in the presence of CXL devices. A circular dependency problem was discovered between suspend and CXL memory for cases where the suspend image might be stored in CXL memory where that image also contains the PCI register state to restore to re-enable the device. Disable suspend for now until an architecture is defined to clarify that conflict. Lastly a collection of reworks, fixes, and cleanups to the CXL subsystem where support for snooping mailbox commands and properly handling the "mem_enable" flow are the highlights. Summary: - Add driver-core infrastructure for lockdep validation of device_lock(), and fixup a deadlock report that was previously hidden behind the 'lockdep no validate' policy. - Add CXL _OSC support for claiming native control of CXL hotplug and error handling. - Disable suspend in the presence of CXL memory unless and until a protocol is identified for restoring PCI device context from memory hosted on CXL PCI devices. - Add support for snooping CXL mailbox commands to protect against inopportune changes, like set-partition with the 'immediate' flag set. - Rework how the driver detects legacy CXL 1.1 configurations (CXL DVSEC / 'mem_enable') before enabling new CXL 2.0 decode configurations (CXL HDM Capability). - Miscellaneous cleanups and fixes from -next exposure" * tag 'cxl-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (47 commits) cxl/port: Enable HDM Capability after validating DVSEC Ranges cxl/port: Reuse 'struct cxl_hdm' context for hdm init cxl/port: Move endpoint HDM Decoder Capability init to port driver cxl/pci: Drop @info argument to cxl_hdm_decode_init() cxl/mem: Merge cxl_dvsec_ranges() and cxl_hdm_decode_init() cxl/mem: Skip range enumeration if mem_enable clear cxl/mem: Consolidate CXL DVSEC Range enumeration in the core cxl/pci: Move cxl_await_media_ready() to the core cxl/mem: Validate port connectivity before dvsec ranges cxl/mem: Fix cxl_mem_probe() error exit cxl/pci: Drop wait_for_valid() from cxl_await_media_ready() cxl/pci: Consolidate wait_for_media() and wait_for_media_ready() cxl/mem: Drop mem_enabled check from wait_for_media() nvdimm: Fix firmware activation deadlock scenarios device-core: Kill the lockdep_mutex nvdimm: Drop nd_device_lock() ACPI: NFIT: Drop nfit_device_lock() nvdimm: Replace lockdep_mutex with local lock classes cxl: Drop cxl_device_lock() cxl/acpi: Add root device lockdep validation ... commit 1243172d5894e2d8f277ee3c278180792de5c521 Author: Yu Kuai Date: Sat May 21 15:37:49 2022 +0800 nbd: use pr_err to output error message Instead of using the long printk(KERN_ERR "nbd: ...") to output error message, defining pr_fmt and using the short pr_err("") to do that. The replacemen is done by using the following command: sed -i 's/printk(KERN_ERR "nbd: /pr_err("/g' \ drivers/block/nbd.c This patch also rewrap to 80 columns where possible. Signed-off-by: Hou Tao Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220521073749.3146892-7-yukuai3@huawei.com Signed-off-by: Jens Axboe commit 858f1bf65d3d9c00b5e2d8ca87dc79ed88267c98 Author: Zhang Wensheng Date: Sat May 21 15:37:48 2022 +0800 nbd: fix possible overflow on 'first_minor' in nbd_dev_add() When 'index' is a big numbers, it may become negative which forced to 'int'. then 'index << part_shift' might overflow to a positive value that is not greater than '0xfffff', then sysfs might complains about duplicate creation. Because of this, move the 'index' judgment to the front will fix it and be better. Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices") Fixes: 940c264984fd ("nbd: fix possible overflow for 'first_minor' in nbd_dev_add()") Signed-off-by: Zhang Wensheng Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220521073749.3146892-6-yukuai3@huawei.com Signed-off-by: Jens Axboe commit 09dadb5985023e27d4740ebd17e6fea4640110e5 Author: Yu Kuai Date: Sat May 21 15:37:47 2022 +0800 nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000 Call Trace: __schedule+0x480/0x1050 ? _raw_spin_lock_irqsave+0x3e/0xb0 schedule+0x9c/0x1b0 blk_mq_freeze_queue_wait+0x9d/0xf0 ? ipi_rseq+0x70/0x70 blk_mq_freeze_queue+0x2b/0x40 nbd_add_socket+0x6b/0x270 [nbd] nbd_ioctl+0x383/0x510 [nbd] blkdev_ioctl+0x18e/0x3e0 __x64_sys_ioctl+0xac/0x120 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd8ff706577 RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577 RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0 R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0 "qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following message was found: block nbd0: Send disconnect failed -32 Which indicate that something is wrong with the server. Then, "qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear requests after commit 2516ab1543fd("nbd: only clear the queue on device teardown"). And in the meantime, request can't complete through timeout because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which means such request will never be completed in this situation. Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't complete multiple times, switch back to call nbd_clear_sock() in nbd_clear_sock_ioctl(), so that inflight requests can be cleared. Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com Signed-off-by: Jens Axboe commit 2895f1831e911ca87d4efdf43e35eb72a0c7e66e Author: Yu Kuai Date: Sat May 21 15:37:46 2022 +0800 nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed Otherwise io will hung because request will only be completed if the cmd has the flag 'NBD_CMD_INFLIGHT'. Fixes: 07175cb1baf4 ("nbd: make sure request completion won't concurrent") Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20220521073749.3146892-4-yukuai3@huawei.com Signed-off-by: Jens Axboe commit c55b2b983b0fa012942c3eb16384b2b722caa810 Author: Yu Kuai Date: Sat May 21 15:37:45 2022 +0800 nbd: fix race between nbd_alloc_config() and module removal When nbd module is being removing, nbd_alloc_config() may be called concurrently by nbd_genl_connect(), although try_module_get() will return false, but nbd_alloc_config() doesn't handle it. The race may lead to the leak of nbd_config and its related resources (e.g, recv_workq) and oops in nbd_read_stat() due to the unload of nbd module as shown below: BUG: kernel NULL pointer dereference, address: 0000000000000040 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: knbd16-recv recv_work [nbd] RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd] Call Trace: recv_work+0x3b/0xb0 [nbd] process_one_work+0x1ed/0x390 worker_thread+0x4a/0x3d0 kthread+0x12a/0x150 ret_from_fork+0x22/0x30 Fixing it by checking the return value of try_module_get() in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV), assign nbd->config only when nbd_alloc_config() succeeds to ensure the value of nbd->config is binary (valid or NULL). Also adding a debug message to check the reference counter of nbd_config during module removal. Signed-off-by: Hou Tao Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com Signed-off-by: Jens Axboe commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e Author: Yu Kuai Date: Sat May 21 15:37:44 2022 +0800 nbd: call genl_unregister_family() first in nbd_cleanup() Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address: 0000000000000098 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:down_write+0x1a/0x50 Call Trace: start_creating+0x89/0x130 debugfs_create_dir+0x1b/0x130 nbd_start_device+0x13d/0x390 [nbd] nbd_genl_connect+0x42f/0x748 [nbd] genl_family_rcv_msg_doit.isra.0+0xec/0x150 genl_rcv_msg+0xe5/0x1e0 netlink_rcv_skb+0x55/0x100 genl_rcv+0x29/0x40 netlink_unicast+0x1a8/0x250 netlink_sendmsg+0x21b/0x430 ____sys_sendmsg+0x2a4/0x2d0 ___sys_sendmsg+0x81/0xc0 __sys_sendmsg+0x62/0xb0 __x64_sys_sendmsg+0x1f/0x30 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Modules linked in: nbd(E-) Signed-off-by: Hou Tao Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com Signed-off-by: Jens Axboe commit 98d40e76652e9aeb3aec4065f600d633ed335e94 Author: Hannes Reinecke Date: Tue May 24 07:56:30 2022 +0200 block: document BLK_STS_AGAIN usage BLK_STS_AGAIN should only be used if RQF_NOWAIT is set and the bio would block. So we'd better document that to avoid accidental misuse. Signed-off-by: Hannes Reinecke Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220524055631.85480-2-hare@suse.de Signed-off-by: Jens Axboe commit 403d50341cce6b5481a92eb481e6df60b1f49b55 Author: Christoph Hellwig Date: Tue May 24 16:39:19 2022 +0200 block: take destination bvec offsets into account in bio_copy_data_iter Appartly bcache can copy into bios that do not just contain fresh pages but can have offsets into the bio_vecs. Restore support for tht in bio_copy_data_iter. Fixes: f8b679a070c5 ("block: rewrite bio_copy_data_iter to use bvec_kmap_local and memcpy_to_bvec") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220524143919.1155501-1-hch@lst.de Signed-off-by: Jens Axboe commit 621433b7e25d6d42e5f75bd8c4a62d6c7251511b Author: Hyunchul Lee Date: Fri May 27 08:50:54 2022 +0900 ksmbd: smbd: relax the count of sges required Remove the condition that the count of sges must be greater than or equal to SMB_DIRECT_MAX_SEND_SGES(8). Because ksmbd needs sges only for SMB direct header, SMB2 transform header, SMB2 response, and optional payload. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Reviewed-by: Tom Talpey Signed-off-by: Steve French commit 9bae058ab57f88c7c1ad61797ee16a5abeda42c2 Merge: 4dc160a52da13 70132763d5d2e Author: Jakub Kicinski Date: Fri May 27 18:29:53 2022 -0700 Merge branch 'net-ipa-fix-page-free-in-two-spots' Alex Elder says: ==================== net: ipa: fix page free in two spots When a receive buffer is not wrapped in an SKB and passed to the network stack, the (compound) page gets freed within the IPA driver. This is currently quite rare. The pages are freed using __free_pages(), but they should instead be freed using page_put(). This series fixes this, in two spots. These patches work for the current linus/master branch, but won't apply cleanly to earlier stable branches. (Nevertheless, the fix is a trivial substitution everwhere __free_pages() is called.) ==================== Link: https://lore.kernel.org/r/20220526152314.1405629-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa Author: Alex Elder Date: Thu May 26 10:23:14 2022 -0500 net: ipa: fix page free in ipa_endpoint_replenish_one() Currently the (possibly compound) pages used for receive buffers are freed using __free_pages(). But according to this comment above the definition of that function, that's wrong: If you want to use the page's reference count to decide when to free the allocation, you should allocate a compound page, and use put_page() instead of __free_pages(). Convert the call to __free_pages() in ipa_endpoint_replenish_one() to use put_page() instead. Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 155c0c90bca918de6e4327275dfc1d97fd604115 Author: Alex Elder Date: Thu May 26 10:23:13 2022 -0500 net: ipa: fix page free in ipa_endpoint_trans_release() Currently the (possibly compound) page used for receive buffers are freed using __free_pages(). But according to this comment above the definition of that function, that's wrong: If you want to use the page's reference count to decide when to free the allocation, you should allocate a compound page, and use put_page() instead of __free_pages(). Convert the call to __free_pages() in ipa_endpoint_trans_release() to use put_page() instead. Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 4dc160a52da1330d54d561f9dac8a9e0ef333895 Author: Alexandru Tachici Date: Thu May 26 17:13:18 2022 +0300 dt-bindings: net: Update ADIN PHY maintainers Update the dt-bindings maintainers section. Signed-off-by: Alexandru Tachici Link: https://lore.kernel.org/r/20220526141318.77146-1-alexandru.tachici@analog.com Signed-off-by: Jakub Kicinski commit a9f94826e4bb6402e67f3eb849dee0811f1de6da Merge: d075c0c1be279 781121a7f6d11 Author: Linus Torvalds Date: Fri May 27 18:17:03 2022 -0700 Merge tag 'clang-format-for-linus-v5.19-rc1' of https://github.com/ojeda/linux Pull clang-format updates from Miguel Ojeda: "clang-format modernization and cleanups. A few changes from Brian Norris and Mickaël Salaün to start taking advantage of some clang-format 11 features, plus a few cleanups and the usual update of the macro list" * tag 'clang-format-for-linus-v5.19-rc1' of https://github.com/ojeda/linux: clang-format: Fix space after for_each macros clang-format: Fix goto labels indentation clang-format: Update to clang-format >= 6 clang-format: Extend the for_each list with tools/ clang-format: Simplify command with `sort -u` clang-format: Use POSIX locale for `sort` clang-format: Update with v5.18-rc7's `for_each` macro list commit d075c0c1be279c5f4c6688ac0442fff6494e56bc Merge: bf272460d7441 e4e62bbc6aba4 Author: Linus Torvalds Date: Fri May 27 18:06:49 2022 -0700 Merge tag 'v5.19-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Test in-place en/decryption with two sglists in testmgr - Fix process vs softirq race in cryptd Algorithms: - Add arm64 acceleration for sm4 - Add s390 acceleration for chacha20 Drivers: - Add polarfire soc hwrng support in mpsf - Add support for TI SoC AM62x in sa2ul - Add support for ATSHA204 cryptochip in atmel-sha204a - Add support for PRNG in caam - Restore support for storage encryption in qat - Restore support for storage encryption in hisilicon/sec" * tag 'v5.19-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (116 commits) hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() crypto: hisilicon/sec - delete the flag CRYPTO_ALG_ALLOCATES_MEMORY crypto: qat - add support for 401xx devices crypto: qat - re-enable registration of algorithms crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag crypto: qat - add param check for DH crypto: qat - add param check for RSA crypto: qat - remove dma_free_coherent() for DH crypto: qat - remove dma_free_coherent() for RSA crypto: qat - fix memory leak in RSA crypto: qat - add backlog mechanism crypto: qat - refactor submission logic crypto: qat - use pre-allocated buffers in datapath crypto: qat - set to zero DH parameters before free crypto: s390 - add crypto library interface for ChaCha20 crypto: talitos - Uniform coding style with defined variable crypto: octeontx2 - simplify the return expression of otx2_cpt_aead_cbc_aes_sha_setkey() crypto: cryptd - Protect per-CPU resource by disabling BH. crypto: sun8i-ce - do not fallback if cryptlen is less than sg length crypto: sun8i-ce - rework debugging ... commit 6b51935a26518baa8370c192d5a5520dfefec183 Merge: 2c262b21de6dc caff1fa4118ce Author: Jakub Kicinski Date: Fri May 27 17:17:52 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2022-05-28 We've added 2 non-merge commits during the last 1 day(s) which contain a total of 2 files changed, 6 insertions(+), 10 deletions(-). The main changes are: 1) Fix ldx_probe_mem instruction in interpreter by properly zero-extending the bpf_probe_read_kernel() read content, from Menglong Dong. 2) Fix stacktrace_build_id BPF selftest given urandom_read has been renamed into urandom_read_iter in random driver, from Song Liu. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix probe read error in ___bpf_prog_run() selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read ==================== Link: https://lore.kernel.org/r/20220527235042.8526-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit caff1fa4118cec4dfd4336521ebd22a6408a1e3e Author: Menglong Dong Date: Tue May 24 10:12:27 2022 +0800 bpf: Fix probe read error in ___bpf_prog_run() I think there is something wrong with BPF_PROBE_MEM in ___bpf_prog_run() in big-endian machine. Let's make a test and see what will happen if we want to load a 'u16' with BPF_PROBE_MEM. Let's make the src value '0x0001', the value of dest register will become 0x0001000000000000, as the value will be loaded to the first 2 byte of DST with following code: bpf_probe_read_kernel(&DST, SIZE, (const void *)(long) (SRC + insn->off)); Obviously, the value in DST is not correct. In fact, we can compare BPF_PROBE_MEM with LDX_MEM_H: DST = *(SIZE *)(unsigned long) (SRC + insn->off); If the memory load is done by LDX_MEM_H, the value in DST will be 0x1 now. And I think this error results in the test case 'test_bpf_sk_storage_map' failing: test_bpf_sk_storage_map:PASS:bpf_iter_bpf_sk_storage_map__open_and_load 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:attach_iter 0 nsec test_bpf_sk_storage_map:PASS:create_iter 0 nsec test_bpf_sk_storage_map:PASS:read 0 nsec test_bpf_sk_storage_map:FAIL:ipv6_sk_count got 0 expected 3 $10/26 bpf_iter/bpf_sk_storage_map:FAIL The code of the test case is simply, it will load sk->sk_family to the register with BPF_PROBE_MEM and check if it is AF_INET6. With this patch, now the test case 'bpf_iter' can pass: $10 bpf_iter:OK Fixes: 2a02759ef5f8 ("bpf: Add support for BTF pointers to interpreter") Signed-off-by: Menglong Dong Signed-off-by: Daniel Borkmann Reviewed-by: Jiang Biao Reviewed-by: Hao Peng Cc: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20220524021228.533216-1-imagedong@tencent.com commit bf272460d744112bacd4c4d562592decbf0edf64 Merge: aef1ff1592742 44a48081fc031 Author: Linus Torvalds Date: Fri May 27 16:05:57 2022 -0700 Merge tag '5.19-rc-smb3-client-fixes-updated' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client updates from Steve French: - multichannel fixes to improve reconnect after network failure - improved caching of root directory contents (extending benefit of directory leases) - two DFS fixes - three fixes for improved debugging - an NTLMSSP fix for mounts t0 older servers - new mount parm to allow disabling creating sparse files - various cleanup fixes and minor fixes pointed out by coverity * tag '5.19-rc-smb3-client-fixes-updated' of git://git.samba.org/sfrench/cifs-2.6: (24 commits) smb3: remove unneeded null check in cifs_readdir cifs: fix ntlmssp on old servers cifs: cache the dirents for entries in a cached directory cifs: avoid parallel session setups on same channel cifs: use new enum for ses_status cifs: do not use tcpStatus after negotiate completes smb3: add mount parm nosparse smb3: don't set rc when used and unneeded in query_info_compound smb3: check for null tcon cifs: fix minor compile warning Add various fsctl structs Add defines for various newer FSCTLs smb3: add trace point for oplock not found cifs: return the more nuanced writeback error on close() smb3: add trace point for lease not found issue cifs: smbd: fix typo in comment cifs: set the CREATE_NOT_FILE when opening the directory in use_cached_dir() cifs: check for smb1 in open_cached_dir() cifs: move definition of cifs_fattr earlier in cifsglob.h cifs: print TIDs as hex ... commit aef1ff15927421a55312b4b9b2881a89a344bd80 Merge: 35cdd8656eac4 e471e5942c006 Author: Linus Torvalds Date: Fri May 27 15:59:21 2022 -0700 Merge tag 'jfs-5.19' of https://github.com/kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "One bug fix and some code cleanup" * tag 'jfs-5.19' of https://github.com/kleikamp/linux-shaggy: fs/jfs: Remove dead code fs: jfs: fix possible NULL pointer dereference in dbFree() commit 35cdd8656eac470b9abc9de8d4bd268fbc0fb34b Merge: ea6c3bc6ed93d f42e8e5088b9e Author: Linus Torvalds Date: Fri May 27 15:49:30 2022 -0700 Merge tag 'libnvdimm-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm and DAX updates from Dan Williams: "New support for clearing memory errors when a file is in DAX mode, alongside with some other fixes and cleanups. Previously it was only possible to clear these errors using a truncate or hole-punch operation to trigger the filesystem to reallocate the block, now, any page aligned write can opportunistically clear errors as well. This change spans x86/mm, nvdimm, and fs/dax, and has received the appropriate sign-offs. Thanks to Jane for her work on this. Summary: - Add support for clearing memory error via pwrite(2) on DAX - Fix 'security overwrite' support in the presence of media errors - Miscellaneous cleanups and fixes for nfit_test (nvdimm unit tests)" * tag 'libnvdimm-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: pmem: implement pmem_recovery_write() pmem: refactor pmem_clear_poison() dax: add .recovery_write dax_operation dax: introduce DAX_RECOVERY_WRITE dax access mode mce: fix set_mce_nospec to always unmap the whole page x86/mce: relocate set{clear}_mce_nospec() functions acpi/nfit: rely on mce->misc to determine poison granularity testing: nvdimm: asm/mce.h is not needed in nfit.c testing: nvdimm: iomap: make __nfit_test_ioremap a macro nvdimm: Allow overwrite in the presence of disabled dimms tools/testing/nvdimm: remove unneeded flush_workqueue commit 1e90e2628cec11c080db3260833f515cc32fc27c Merge: b26ff91371833 5f76955ab1e43 Author: Dmitry Torokhov Date: Fri May 27 15:48:45 2022 -0700 Merge branch 'next' into for-linus Prepare input updates for 5.19 merge window. commit ea6c3bc6ed93dd032568427e92424f6d33deb99b Merge: 6b0e34a0307e0 f93afd8e7567f Author: Linus Torvalds Date: Fri May 27 15:39:47 2022 -0700 Merge tag 'mfd-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Device Support - Add support for {Power,Home} Keys to MediaTek MT6359 - Add support for SC2730 to Spreadtrum SPRD SC27XX SPI - Add support for additional Alder Lake-P I2C Controllers to Intel LPSS PCI Fix-ups: - Convert GPIO to GPIOD (hi655x-pmic) - Only register devices that exist (cros_ec_dev) - Remove unused code (syscon, reg-mux) - Rework .remove() API to return void (twl-core, rt4831) - Trivial - whitespace, spelling, coding style (tps65218, sprd-sc27xx-spi, google,cros-ec) - DT binding changes (samsung,exynos5433-lpass, rockchip,rk805, rockchip,rk808, rockchip,rk809, rockchip,rk817, rockchip,rk818, wlf,arizona) Bug Fixes: - Fix error handling bugs (ipaq-micro, davinci_voicecodec)" * tag 'mfd-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: dt-bindings: cros-ec: Fix a typo in description dt-bindings: mfd: wlf,arizona: Add spi-max-frequency mfd: rt4831: Improve error reporting for problems during .remove() mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() mfd: intel-lpss: Add support for ADL-P i2c6 and i2c7 dt-bindings: mfd: rk808: Convert bindings to yaml mfd: twl4030: Make twl4030_exit_irq() return void mfd: twl6030: Make twl6030_exit_irq() return void dt-bindings: mfd: samsung,exynos5433-lpass: Fix 'dma-channels/requests' properties mfd: sprd: Jugle {of,spi}_device_id tables into numerical order mfd: sprd: Add SC2730 PMIC to SPI device ID table dt-bindings: Drop undocumented i.MX iomuxc-gpr bindings in examples mfd: cros_ec_dev: Only register PCHG device if present mfd: mt6397-core: Add resources for PMIC keys for MT6359 mfd: mt6359: Add missing defines necessary for mtk-pmic-keys support mfd: ipaq-micro: Fix error check return value of platform_get_irq() mfd: hi655x-pmic: Replace legacy gpio interface for gpiod interface mfd: tps65218: Fix trivial typo in comment commit 6b0e34a0307e046c0662d7dcaba2a2c9993c4339 Merge: 3cc30140dbe2d 71cc785d29552 Author: Linus Torvalds Date: Fri May 27 15:33:24 2022 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Mainly driver updates this time around. There's a single patch to the core clk framework that simplifies a runtime PM call. Otherwise the majority of the diff falls to a few SoC drivers: Qualcomm, STM32 and MediaTek. Those SoCs gain some new hardware support and what comes along with that is quite a few lines of data and some clk_ops code. Beyond the new hardware support we have the usual pile of driver updates that add missing clks on already supported SoCs or fix up problems like bad clk tree descriptions. It's nice to see that more drivers are moving to clk_hw based APIs too. New Drivers: - Add STM32MP13 RCC driver (Reset Clock Controller) - MediaTek MT8186 SoC clk support - Airoha EN7523 SoC system clocks - Clock driver for exynosautov9 SoC - Renesas R-Car V4H and RZ/V2M SoCs - Renesas RZ/G2UL SoC - LPASS clk driver for Qualcomm sc7280 SoC - GCC clk driver for Qualcomm SC8280XP SoC Updates: - SDCC uses floor clk ops on Qualcomm MSM8976 - Add modem reset and fix RPM clks on Qualcomm MSM8976 - Add the two missing CLKOUT clocks for U8500/DB8500 SoC - Mark some clks critical on Ingenic X1000 - Convert ux500 to clk_hw - Move MediaTek driver to clk_hw provider APIs - Use i2c driver probe_new to avoid id scans - Convert a number of Rockchip dt bindings to YAML - Mark hclk_vo critical on Rockchip rk3568 - Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage - Various cleanups like memory allocation error checks and plugged leaks - Allwinner H6 RTC clock support - Allwinner H616 32 kHz clock support - Add the Universal Flash Storage clock on Renesas R-Car S4-8 - Add I2C, SSIF-2 (sound), USB, CANFD, OSTM (timer), WDT, SPI Multi I/O Bus, RSPI, TSU (thermal), and ADC clocks and resets on Renesas RZ/G2UL - Add display clock support on Renesas RZ/G2L - Add RPC (QSPI/HyperFlash) clocks on Renesas R-Car E3 and D3 - Add 27 MHz phy PLL ref clock on i.MX - Add mcore_booted module parameter to tell kernel M core has already booted for i.MX - Remove snvs clock on i.MX because it was for secure world only - Add dt bindings for i.MX8MN GPT - Add DISP2 pixel clock for i.MX8MP - Add clkout1/2 for i.MX8MP - Fix parent clock of ubs_root_clk for i.MX8MP - Implement better RCG parking on Qualcomm SoCs using the shared RCG clk ops - Kerneldoc fixes - Switch Tegra BPMP to determine_rate clk op - Add a pointer to dt schema for generic clock bindings" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (168 commits) Revert "clk: qcom: regmap-mux: add pipe clk implementation" Revert "clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" Revert "clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc() clk: stm32mp13: add safe mux management clk: stm32mp13: add multi mux function clk: stm32mp13: add all STM32MP13 kernel clocks clk: stm32mp13: add all STM32MP13 peripheral clocks clk: stm32mp13: manage secured clocks clk: stm32mp13: add composite clock clk: stm32mp13: add stm32 divider clock clk: stm32mp13: add stm32_gate management clk: stm32mp13: add stm32_mux clock management clk: stm32: Introduce STM32MP13 RCC drivers (Reset Clock Controller) dt-bindings: rcc: stm32: add new compatible for STM32MP13 SoC clk: ti: clkctrl: replace usage of found with dedicated list iterator variable clk: ti: composite: Prefer kcalloc over open coded arithmetic dt-bindings: clock: exynosautov9: correct count of NR_CLK clk: mediatek: mt8173: Switch to clk_hw provider APIs clk: mediatek: Switch to clk_hw provider APIs ... commit 3cc30140dbe2df9b5ac000898e0ae3d1df980f2c Merge: 8291eaafed36f 32f479d05a445 Author: Linus Torvalds Date: Fri May 27 15:25:10 2022 -0700 Merge tag 'pci-v5.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci updates from Bjorn Helgaas: "Resource management: - Restrict E820 clipping to PCI host bridge windows (Bjorn Helgaas) - Log E820 clipping better (Bjorn Helgaas) - Add kernel cmdline options to enable/disable E820 clipping (Hans de Goede) - Disable E820 reserved region clipping for IdeaPads, Yoga, Yoga Slip, Acer Spin 5, Clevo Barebone systems where clipping leaves no usable address space for touchpads, Thunderbolt devices, etc (Hans de Goede) - Disable E820 clipping by default starting in 2023 (Hans de Goede) PCI device hotplug: - Include files to remove implicit dependencies (Christophe Leroy) - Only put Root Ports in D3 if they can signal and wake from D3 so AMD Yellow Carp doesn't miss hotplug events (Mario Limonciello) Power management: - Define pci_restore_standard_config() only for CONFIG_PM_SLEEP since it's unused otherwise (Krzysztof Kozlowski) - Power up devices completely, including anything platform firmware needs to do, during runtime resume (Rafael J. Wysocki) - Move pci_resume_bus() to PM callbacks so we observe the required bridge power-up delays (Rafael J. Wysocki) - Drop unneeded runtime_d3cold device flag (Rafael J. Wysocki) - Split pci_raw_set_power_state() between pci_power_up() and a new pci_set_low_power_state() (Rafael J. Wysocki) - Set current_state to D3cold if config read returns ~0, indicating the device is not accessible (Rafael J. Wysocki) - Do not call pci_update_current_state() from pci_power_up() so BARs and ASPM config are restored correctly (Rafael J. Wysocki) - Write 0 to PMCSR in pci_power_up() in all cases (Rafael J. Wysocki) - Split pci_power_up() to pci_set_full_power_state() to avoid some redundant operations (Rafael J. Wysocki) - Skip restoring BARs if device is not in D0 (Rafael J. Wysocki) - Rearrange and clarify pci_set_power_state() (Rafael J. Wysocki) - Remove redundant BAR restores from pci_pm_thaw_noirq() (Rafael J. Wysocki) Virtualization: - Acquire device lock before config space access lock to avoid AB/BA deadlock with sriov_numvfs_store() (Yicong Yang) Error handling: - Clear MULTI_ERR_COR/UNCOR_RCV bits, which a race could previously leave permanently set (Kuppuswamy Sathyanarayanan) Peer-to-peer DMA: - Whitelist Intel Skylake-E Root Ports regardless of which devfn they are (Shlomo Pongratz) ASPM: - Override L1 acceptable latency advertised by Intel DG2 so ASPM L1 can be enabled (Mika Westerberg) Cadence PCIe controller driver: - Set up device-specific register to allow PTM Responder to be enabled by the normal architected bit (Christian Gmeiner) - Override advertised FLR support since the controller doesn't implement FLR correctly (Parshuram Thombare) Cadence PCIe endpoint driver: - Correct bitmap size for the ob_region_map of outbound window usage (Dan Carpenter) Freescale i.MX6 PCIe controller driver: - Fix PERST# assertion/deassertion so we observe the required delays before accessing device (Francesco Dolcini) Freescale Layerscape PCIe controller driver: - Add "big-endian" DT property (Hou Zhiqiang) - Update SCFG DT property (Hou Zhiqiang) - Add "aer", "pme", "intr" DT properties (Li Yang) - Add DT compatible strings for ls1028a (Xiaowei Bao) Intel VMD host bridge driver: - Assign VMD IRQ domain before enumeration to avoid IOMMU interrupt remapping errors when MSI-X remapping is disabled (Nirmal Patel) - Revert VMD workaround that kept MSI-X remapping enabled when IOMMU remapping was enabled (Nirmal Patel) Marvell MVEBU PCIe controller driver: - Add of_pci_get_slot_power_limit() to parse the 'slot-power-limit-milliwatt' DT property (Pali Rohár) - Add mvebu support for sending Set_Slot_Power_Limit message (Pali Rohár) MediaTek PCIe controller driver: - Fix refcount leak in mtk_pcie_subsys_powerup() (Miaoqian Lin) MediaTek PCIe Gen3 controller driver: - Reset PHY and MAC at probe time (AngeloGioacchino Del Regno) Microchip PolarFlare PCIe controller driver: - Add chained_irq_enter()/chained_irq_exit() calls to mc_handle_msi() and mc_handle_intx() to avoid lost interrupts (Conor Dooley) - Fix interrupt handling race (Daire McNamara) NVIDIA Tegra194 PCIe controller driver: - Drop tegra194 MSI register save/restore, which is unnecessary since the DWC core does it (Jisheng Zhang) Qualcomm PCIe controller driver: - Add SM8150 SoC DT binding and support (Bhupesh Sharma) - Fix pipe clock imbalance (Johan Hovold) - Fix runtime PM imbalance on probe errors (Johan Hovold) - Fix PHY init imbalance on probe errors (Johan Hovold) - Convert DT binding to YAML (Dmitry Baryshkov) - Update DT binding to show that resets aren't required for MSM8996/APQ8096 platforms (Dmitry Baryshkov) - Add explicit register names per chipset in DT binding (Dmitry Baryshkov) - Add sc7280-specific clock and reset definitions to DT binding (Dmitry Baryshkov) Rockchip PCIe controller driver: - Fix bitmap size when searching for free outbound region (Dan Carpenter) Rockchip DesignWare PCIe controller driver: - Remove "snps,dw-pcie" from rockchip-dwc DT "compatible" property because it's not fully compatible with rockchip (Peter Geis) - Reset rockchip-dwc controller at probe (Peter Geis) - Add rockchip-dwc INTx support (Peter Geis) Synopsys DesignWare PCIe controller driver: - Return error instead of success if DMA mapping of MSI area fails (Jiantao Zhang) Miscellaneous: - Change pci_set_dma_mask() documentation references to dma_set_mask() (Alex Williamson)" * tag 'pci-v5.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (64 commits) dt-bindings: PCI: qcom: Add schema for sc7280 chipset dt-bindings: PCI: qcom: Specify reg-names explicitly dt-bindings: PCI: qcom: Do not require resets on msm8996 platforms dt-bindings: PCI: qcom: Convert to YAML PCI: qcom: Fix unbalanced PHY init on probe errors PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix pipe clock imbalance PCI: qcom: Add SM8150 SoC support dt-bindings: pci: qcom: Document PCIe bindings for SM8150 SoC x86/PCI: Disable E820 reserved region clipping starting in 2023 x86/PCI: Disable E820 reserved region clipping via quirks x86/PCI: Add kernel cmdline options to use/ignore E820 reserved regions PCI: microchip: Fix potential race in interrupt handling PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits PCI: cadence: Clear FLR in device capabilities register PCI: cadence: Allow PTM Responder to be enabled PCI: vmd: Revert 2565e5b69c44 ("PCI: vmd: Do not disable MSI-X remapping if interrupt remapping is enabled by IOMMU.") PCI: vmd: Assign VMD IRQ domain before enumeration PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() PCI: rockchip-dwc: Add legacy interrupt support ... commit 2d1fe8a86bf5e0663866fd0da83c2af1e1b0e362 Author: Chao Yu Date: Fri May 27 12:13:30 2022 +0800 f2fs: fix to tag gcing flag on page during file defragment In order to garantee migrated data be persisted during checkpoint, otherwise out-of-order persistency between data and node may cause data corruption after SPOR. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 054cb2891b9cc21bf08fb6380e638c056748098f Author: Yufen Yu Date: Thu May 26 10:21:06 2022 +0800 f2fs: replace F2FS_I(inode) and sbi by the local variable We have define 'fi' at the begin of the functions, just use it, rather than use F2FS_I(inode) again. Signed-off-by: Yufen Yu Reviewed-by: Chao Yu [Jaegeuk Kim: replace sbi] Signed-off-by: Jaegeuk Kim commit 8a1e75c53c7a514dbd4f3c61ceb6f6d7d11dfd6d Merge: 440517772bec2 cd414d5ac1fde Author: Arnd Bergmann Date: Fri May 27 22:21:08 2022 +0200 Merge tag 'v5.19-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/late Clock properties for cru nodes to match the yaml-converted bindings and renaming of Quartz-A bluetooth pin nodename to not conflict with Yaml constraints. * tag 'v5.19-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: rename Quartz64-A bluetooth gpios arm64: dts: rockchip: add clocks property to cru node rk3368 arm64: dts: rockchip: add clocks property to cru node rk3308 arm64: dts: rockchip: add clocks to rk356x cru Link: https://lore.kernel.org/r/7695907.Sb9uPGUboI@phil Signed-off-by: Arnd Bergmann commit 440517772bec24f618ec98bc608024ad1b37e80f Merge: 4a4e81ddb8b0e 840fc447d78e3 Author: Arnd Bergmann Date: Fri May 27 22:20:31 2022 +0200 Merge tag 'v5.19-rockchip-dts32-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/late Amba and clock fixes to conform better to actual dt-bindings. * tag 'v5.19-rockchip-dts32-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: add clocks property to cru node rk3228 ARM: dts: rockchip: add clocks property to cru node rk3036 ARM: dts: rockchip: add clocks property to cru node rk3066a/rk3188 ARM: dts: rockchip: add clocks property to cru node rk3288 ARM: dts: rockchip: Remove "amba" bus nodes from rv1108 ARM: dts: rockchip: add clocks property to cru node rv1108 Link: https://lore.kernel.org/r/4798587.jE0xQCEvom@phil Signed-off-by: Arnd Bergmann commit 4a4e81ddb8b0eb412bcfb90c24ba0d5d0d913483 Merge: 6fe1953e008d0 9b59588d8be91 Author: Arnd Bergmann Date: Fri May 27 22:19:46 2022 +0200 Merge tag 'v5.19-rockchip-drivers2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/late Refcount leak for a used of-node in the grf-init. * tag 'v5.19-rockchip-drivers2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: Fix refcount leak in rockchip_grf_init Link: https://lore.kernel.org/r/4541398.Icojqenx9y@phil Signed-off-by: Arnd Bergmann commit 8291eaafed36f575f23951f3ce18407f480e9ecf Merge: 77fb622de1393 fa020a2b87d24 Author: Linus Torvalds Date: Fri May 27 11:40:49 2022 -0700 Merge tag 'mm-stable-2022-05-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - Two follow-on fixes for the post-5.19 series "Use pageblock_order for cma and alloc_contig_range alignment", from Zi Yan. - A series of z3fold cleanups and fixes from Miaohe Lin. - Some memcg selftests work from Michal Koutný - Some swap fixes and cleanups from Miaohe Lin - Several individual minor fixups * tag 'mm-stable-2022-05-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (25 commits) mm/shmem.c: suppress shift warning mm: Kconfig: reorganize misplaced mm options mm: kasan: fix input of vmalloc_to_page() mm: fix is_pinnable_page against a cma page mm: filter out swapin error entry in shmem mapping mm/shmem: fix infinite loop when swap in shmem error at swapoff time mm/madvise: free hwpoison and swapin error entry in madvise_free_pte_range mm/swapfile: fix lost swap bits in unuse_pte() mm/swapfile: unuse_pte can map random data if swap read fails selftests: memcg: factor out common parts of memory.{low,min} tests selftests: memcg: remove protection from top level memcg selftests: memcg: adjust expected reclaim values of protected cgroups selftests: memcg: expect no low events in unprotected sibling selftests: memcg: fix compilation mm/z3fold: fix z3fold_page_migrate races with z3fold_map mm/z3fold: fix z3fold_reclaim_page races with z3fold_free mm/z3fold: always clear PAGE_CLAIMED under z3fold page lock mm/z3fold: put z3fold page back into unbuddied list when reclaim or migration fails revert "mm/z3fold.c: allow __GFP_HIGHMEM in z3fold_alloc" mm/z3fold: throw warning on failure of trylock_page in z3fold_alloc ... commit 77fb622de1393b1d54f24f4f7ed98f84feeda502 Merge: 6f664045c8688 24c8e27e63224 Author: Linus Torvalds Date: Fri May 27 11:29:35 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-05-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Six hotfixes. The page_table_check one from Miaohe Lin is considered a minor thing so it isn't marked for -stable. The remainder address pre-5.19 issues and are cc:stable" * tag 'mm-hotfixes-stable-2022-05-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/page_table_check: fix accessing unmapped ptep kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] mm/page_alloc: always attempt to allocate at least one page during bulk allocation hugetlb: fix huge_pmd_unshare address update zsmalloc: fix races between asynchronous zspage free and page migration Revert "mm/cma.c: remove redundant cma_mutex lock" commit 6f664045c8688c40ad0591abd6ab89db9ecd7945 Merge: 8bdc2a190105e 3159d79b56c15 Author: Linus Torvalds Date: Fri May 27 11:22:03 2022 -0700 Merge tag 'mm-nonmm-stable-2022-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc updates from Andrew Morton: "The non-MM patch queue for this merge window. Not a lot of material this cycle. Many singleton patches against various subsystems. Most notably some maintenance work in ocfs2 and initramfs" * tag 'mm-nonmm-stable-2022-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (65 commits) kcov: update pos before writing pc in trace function ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock ocfs2: dlmfs: don't clear USER_LOCK_ATTACHED when destroying lock fs/ntfs: remove redundant variable idx fat: remove time truncations in vfat_create/vfat_mkdir fat: report creation time in statx fat: ignore ctime updates, and keep ctime identical to mtime in memory fat: split fat_truncate_time() into separate functions MAINTAINERS: add Muchun as a memcg reviewer proc/sysctl: make protected_* world readable ia64: mca: drop redundant spinlock initialization tty: fix deadlock caused by calling printk() under tty_port->lock relay: remove redundant assignment to pointer buf fs/ntfs3: validate BOOT sectors_per_clusters lib/string_helpers: fix not adding strarray to device's resource list kernel/crash_core.c: remove redundant check of ck_cmdline ELF, uapi: fixup ELF_ST_TYPE definition ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() ipc: update semtimedop() to use hrtimer ipc/sem: remove redundant assignments ... commit 8bdc2a190105e862dfe7a4033f2fd385b7e58ae8 Author: Jason A. Donenfeld Date: Thu May 26 11:35:47 2022 +0200 crypto: poly1305 - cleanup stray CRYPTO_LIB_POLY1305_RSIZE When CRYPTO_LIB_POLY1305 is unset, CRYPTO_LIB_POLY1305_RSIZE is still set in the Kconfig, cluttering things. Fix this by making CRYPTO_LIB_POLY1305_RSIZE depend on CRYPTO_LIB_POLY1305. Suggested-by: Linus Torvalds Signed-off-by: Jason A. Donenfeld Signed-off-by: Linus Torvalds commit e68b823ab0ba03323805e54743d16200ba0224d4 Author: Baolin Wang Date: Fri May 27 12:51:38 2022 +0800 arm64/hugetlb: Fix building errors in huge_ptep_clear_flush() Fix the arm64 build error which was caused by commit ae07562909f3 ("mm: change huge_ptep_clear_flush() to return the original pte") interacting with commit fb396bb459c1 ("arm64/hugetlb: Drop TLB flush from get_clear_flush()"): arch/arm64/mm/hugetlbpage.c: In function ‘huge_ptep_clear_flush’: arch/arm64/mm/hugetlbpage.c:515:9: error: implicit declaration of function ‘get_clear_flush’; did you mean ‘ptep_clear_flush’? [-Werror=implicit-function-declaration] 515 | return get_clear_flush(vma->vm_mm, addr, ptep, pgsize, ncontig); | ^~~~~~~~~~~~~~~ | ptep_clear_flush Due to the new get_clear_contig() has dropped TLB flush, we should add an explicit TLB flush in huge_ptep_clear_flush() to keep original semantics when changing to use new get_clear_contig(). Fixes: fb396bb459c1 ("arm64/hugetlb: Drop TLB flush from get_clear_flush()"). Fixes: ae07562909f3 ("mm: change huge_ptep_clear_flush() to return the original pte") Reported-and-tested-by: Linux Kernel Functional Testing Reported-by: Sudip Mukherjee Suggested-by: Catalin Marinas Signed-off-by: Baolin Wang Reviewed-by: Gavin Shan Reviewed-by: Anshuman Khandual Cc: Catalin Marinas Cc: Anshuman Khandual Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 189b0ddc245139af81198d1a3637cac74f96e13a Author: David Howells Date: Thu May 26 07:34:52 2022 +0100 pipe: Fix missing lock in pipe_resize_ring() pipe_resize_ring() needs to take the pipe->rd_wait.lock spinlock to prevent post_one_notification() from trying to insert into the ring whilst the ring is being replaced. The occupancy check must be done after the lock is taken, and the lock must be taken after the new ring is allocated. The bug can lead to an oops looking something like: BUG: KASAN: use-after-free in post_one_notification.isra.0+0x62e/0x840 Read of size 4 at addr ffff88801cc72a70 by task poc/27196 ... Call Trace: post_one_notification.isra.0+0x62e/0x840 __post_watch_notification+0x3b7/0x650 key_create_or_update+0xb8b/0xd20 __do_sys_add_key+0x175/0x340 __x64_sys_add_key+0xbe/0x140 do_syscall_64+0x5c/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Reported by Selim Enes Karaduman @Enesdex working with Trend Micro Zero Day Initiative. Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17291 Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit cd414d5ac1fdeecf0617737e688a1af00858253a Author: Peter Geis Date: Wed May 11 11:01:14 2022 -0400 arm64: dts: rockchip: rename Quartz64-A bluetooth gpios The bluetooth binding for the Quartz64 Model A has incorrectly named host-wakeup and device-wakeup gpios. Rename them to clear some dtbs_check warnings. Signed-off-by: Peter Geis Link: https://lore.kernel.org/r/20220511150117.113070-4-pgwipeout@gmail.com Signed-off-by: Heiko Stuebner commit 3d65818cd6cf2edc8fc742f982731c54be14e5b8 Author: Johan Jonker Date: Tue Mar 29 20:05:50 2022 +0200 arm64: dts: rockchip: add clocks property to cru node rk3368 Add clocks and clock-names because the device has to have at least one input clock. Also in case someone wants to add properties that start with assign-xxx to fix warnings like: 'clocks' is a dependency of 'assigned-clocks' Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220329180550.31043-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit 2d363912168fe4b2786de7a6ced12b53bc7f4a00 Author: Johan Jonker Date: Tue Mar 29 20:43:39 2022 +0200 arm64: dts: rockchip: add clocks property to cru node rk3308 Add clocks and clock-names to the rk3308 cru node, because the device has to have at least one input clock. Also in case someone wants to add properties that start with assign-xxx to fix warnings like: 'clocks' is a dependency of 'assigned-clocks' With the addition of new properties also sort the node properties a little bit. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220329184339.1134-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit cd2d081d18de396cb45636c215dc589a330b3f4e Author: Peter Geis Date: Wed May 11 11:01:13 2022 -0400 arm64: dts: rockchip: add clocks to rk356x cru The rk356x cru requires a 24m clock input to function. Add the clocks properties to the cru to clear some dtbs_check warnings. Signed-off-by: Peter Geis Link: https://lore.kernel.org/r/20220511150117.113070-3-pgwipeout@gmail.com Signed-off-by: Heiko Stuebner commit 840fc447d78e3d4e4048c307ec8f6649d2abb9e7 Author: Johan Jonker Date: Wed Mar 30 14:19:22 2022 +0200 ARM: dts: rockchip: add clocks property to cru node rk3228 Add clocks and clock-names to the rk3228 cru node, because the device has to have at least one input clock. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220330121923.24240-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit 8dd85bffc577c90bd29428215494fa68413ffa1f Author: Johan Jonker Date: Wed Mar 30 13:48:46 2022 +0200 ARM: dts: rockchip: add clocks property to cru node rk3036 Add clocks and clock-names to the rk3036 cru node, because the device has to have at least one input clock. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220330114847.18633-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit 25f417b56384a3a3f65b7c7439a9797966b926e9 Author: Johan Jonker Date: Tue Mar 29 13:13:23 2022 +0200 ARM: dts: rockchip: add clocks property to cru node rk3066a/rk3188 Add clocks property to rk3066a/rk3188 cru node to fix warnings like: 'clocks' is a dependency of 'assigned-clocks' Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220329111323.3569-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit 9d66847be3f8290e3142184af0b1806aae6269e2 Author: Johan Jonker Date: Tue Mar 29 13:36:57 2022 +0200 ARM: dts: rockchip: add clocks property to cru node rk3288 Add clocks property to rk3288 cru node to fix warnings like: 'clocks' is a dependency of 'assigned-clocks'. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220329113657.4567-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit e8cead54a6c73415d99f9feea3c38f892df786b8 Author: Johan Jonker Date: Wed Mar 30 15:16:08 2022 +0200 ARM: dts: rockchip: Remove "amba" bus nodes from rv1108 The "amba" bus nodes wrapping all the DMA-330 nodes serve no useful purpose, and certainly bear no relation at all to the actual underlying interconnect topology. They appear to be cargo-cult copying from a design misstep in the very early days of FDT adoption on ARM, which was righted with the "arm,primecell" compatible, and the last trace of the idea finally purged by commit 2ef7d5f342c1 ("ARM, ARM64: dts: drop "arm,amba-bus" in favor of "simple-bus""). As such, they can simply be removed and the DMA-330 nodes fitted into the normal sort order. The node names should be generic, so rename it to "dma-controller". Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220330131608.30040-3-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit f7230dcfb44e80fadfa67efe94071cb2542433b6 Author: Johan Jonker Date: Wed Mar 30 15:16:07 2022 +0200 ARM: dts: rockchip: add clocks property to cru node rv1108 Add clocks and clock-names to the rv1108 cru node, because the device has to have at least one input clock. Signed-off-by: Johan Jonker Link: https://lore.kernel.org/r/20220330131608.30040-2-jbx6244@gmail.com Signed-off-by: Heiko Stuebner commit 44a48081fc03187d3c047077f3ad3eb3a3eaf8fb Author: Steve French Date: Wed May 25 23:56:07 2022 -0500 smb3: remove unneeded null check in cifs_readdir Coverity pointed out an unneeded check. Addresses-Coverity: 1518030 ("Null pointer dereferences") Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit fa020a2b87d24016723fff4a4237deb612478a32 Author: Andrew Morton Date: Wed May 25 15:17:09 2022 -0700 mm/shmem.c: suppress shift warning mm/shmem.c:1948 shmem_getpage_gfp() warn: should '(((1) << 12) / 512) << folio_order(folio)' be a 64 bit type? On i386, so an unsigned long is 32-bit, but i_blocks is a 64-bit blkcnt_t. Reported-by: kernel test robot Reported-by: Jessica Clarke Signed-off-by: Andrew Morton commit 0710d0122abc93adcb9a70a78f1625c491f6ad91 Author: Vlastimil Babka Date: Wed May 25 13:25:59 2022 +0200 mm: Kconfig: reorganize misplaced mm options After commits 7b42f1041c98 ("mm: Kconfig: move swap and slab config options to the MM section") and 519bcb797907 ("mm: Kconfig: group swap, slab, hotplug and thp options into submenus") we now have nicely organized mm related config options. I have noticed some that were still misplaced, so this moves them from various places into the new structure: VM_EVENT_COUNTERS, COMPAT_BRK, MMAP_ALLOW_UNINITIALIZED to mm/Kconfig and general MM section. SLUB_STATS to mm/Kconfig and the slab submenu. DEBUG_SLAB, SLUB_DEBUG, SLUB_DEBUG_ON to mm/Kconfig.debug and the Kernel hacking / Memory Debugging submenu. Link: https://lkml.kernel.org/r/20220525112559.1139-1-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Johannes Weiner Signed-off-by: Andrew Morton commit fbf4df0699926cf620b2f722ddc213826e248962 Author: Kefeng Wang Date: Wed May 25 20:08:04 2022 +0800 mm: kasan: fix input of vmalloc_to_page() When print virtual mapping info for vmalloc address, it should pass the addr not page, fix it. Link: https://lkml.kernel.org/r/20220525120804.38155-1-wangkefeng.wang@huawei.com Fixes: c056a364e954 ("kasan: print virtual mapping info in reports") Signed-off-by: Kefeng Wang Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 1c563432588dbffa71e67ca6e37c826f9fa86e04 Author: Minchan Kim Date: Tue May 24 10:15:25 2022 -0700 mm: fix is_pinnable_page against a cma page Pages in the CMA area could have MIGRATE_ISOLATE as well as MIGRATE_CMA so the current is_pinnable_page() could miss CMA pages which have MIGRATE_ISOLATE. It ends up pinning CMA pages as longterm for the pin_user_pages() API so CMA allocations keep failing until the pin is released. CPU 0 CPU 1 - Task B cma_alloc alloc_contig_range pin_user_pages_fast(FOLL_LONGTERM) change pageblock as MIGRATE_ISOLATE internal_get_user_pages_fast lockless_pages_from_mm gup_pte_range try_grab_folio is_pinnable_page return true; So, pinned the page successfully. page migration failure with pinned page .. .. After 30 sec unpin_user_page(page) CMA allocation succeeded after 30 sec. The CMA allocation path protects the migration type change race using zone->lock but what GUP path need to know is just whether the page is on CMA area or not rather than exact migration type. Thus, we don't need zone->lock but just checks migration type in either of (MIGRATE_ISOLATE and MIGRATE_CMA). Adding the MIGRATE_ISOLATE check in is_pinnable_page could cause rejecting of pinning pages on MIGRATE_ISOLATE pageblocks even though it's neither CMA nor movable zone if the page is temporarily unmovable. However, such a migration failure by unexpected temporal refcount holding is general issue, not only come from MIGRATE_ISOLATE and the MIGRATE_ISOLATE is also transient state like other temporal elevated refcount problem. Link: https://lkml.kernel.org/r/20220524171525.976723-1-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: John Hubbard Acked-by: Paul E. McKenney Cc: David Hildenbrand Signed-off-by: Andrew Morton commit ba6851b45d2d5b07436d8fc43451bad354dc4884 Author: Miaohe Lin Date: Thu May 19 20:50:30 2022 +0800 mm: filter out swapin error entry in shmem mapping There might be swapin error entries in shmem mapping. Filter them out to avoid "Bad swap file entry" complaint. Link: https://lkml.kernel.org/r/20220519125030.21486-6-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Naoya Horiguchi Cc: Alistair Popple Cc: David Hildenbrand Cc: David Howells Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: NeilBrown Cc: Peter Xu Cc: Ralph Campbell Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6cec2b95dadf77cdc1256fae1c5dfd4a2b467e61 Author: Miaohe Lin Date: Thu May 19 20:50:29 2022 +0800 mm/shmem: fix infinite loop when swap in shmem error at swapoff time When swap in shmem error at swapoff time, there would be a infinite loop in the while loop in shmem_unuse_inode(). It's because swapin error is deliberately ignored now and thus info->swapped will never reach 0. So we can't escape the loop in shmem_unuse(). In order to fix the issue, swapin_error entry is stored in the mapping when swapin error occurs. So the swapcache page can be freed and the user won't end up with a permanently mounted swap because a sector is bad. If the page is accessed later, the user process will be killed so that corrupted data is never consumed. On the other hand, if the page is never accessed, the user won't even notice it. Link: https://lkml.kernel.org/r/20220519125030.21486-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reported-by: Naoya Horiguchi Reviewed-by: Naoya Horiguchi Cc: Alistair Popple Cc: David Hildenbrand Cc: David Howells Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: NeilBrown Cc: Peter Xu Cc: Ralph Campbell Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7b49514fa1dbe05813f099179ebe3d982f45e87e Author: Miaohe Lin Date: Thu May 19 20:50:28 2022 +0800 mm/madvise: free hwpoison and swapin error entry in madvise_free_pte_range Once the MADV_FREE operation has succeeded, callers can expect they might get zero-fill pages if accessing the memory again. Therefore it should be safe to delete the hwpoison entry and swapin error entry. There is no reason to kill the process if it has called MADV_FREE on the range. Link: https://lkml.kernel.org/r/20220519125030.21486-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Suggested-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Naoya Horiguchi Cc: David Howells Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: NeilBrown Cc: Peter Xu Cc: Ralph Campbell Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 14a762dd1977cf811516fd97b0262b747cac88f7 Author: Miaohe Lin Date: Thu May 19 20:50:27 2022 +0800 mm/swapfile: fix lost swap bits in unuse_pte() This is observed by code review only but not any real report. When we turn off swapping we could have lost the bits stored in the swap ptes. The new rmap-exclusive bit is fine since that turned into a page flag, but not for soft-dirty and uffd-wp. Add them. Link: https://lkml.kernel.org/r/20220519125030.21486-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Suggested-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Alistair Popple Cc: David Howells Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: NeilBrown Cc: Ralph Campbell Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9f186f9e5fa9ebdaef909fd45f825a6ce281f13c Author: Miaohe Lin Date: Thu May 19 20:50:26 2022 +0800 mm/swapfile: unuse_pte can map random data if swap read fails Patch series "A few fixup patches for mm", v4. This series contains a few patches to avoid mapping random data if swap read fails and fix lost swap bits in unuse_pte. Also we free hwpoison and swapin error entry in madvise_free_pte_range and so on. More details can be found in the respective changelogs. This patch (of 5): There is a bug in unuse_pte(): when swap page happens to be unreadable, page filled with random data is mapped into user address space. In case of error, a special swap entry indicating swap read fails is set to the page table. So the swapcache page can be freed and the user won't end up with a permanently mounted swap because a sector is bad. And if the page is accessed later, the user process will be killed so that corrupted data is never consumed. On the other hand, if the page is never accessed, the user won't even notice it. Link: https://lkml.kernel.org/r/20220519125030.21486-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220519125030.21486-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: David Hildenbrand Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: Vlastimil Babka Cc: David Howells Cc: NeilBrown Cc: Alistair Popple Cc: Suren Baghdasaryan Cc: Peter Xu Cc: Ralph Campbell Cc: Naoya Horiguchi Signed-off-by: Andrew Morton commit f079a020ba95b568329806aa13c62e6103cade3c Author: Michal Koutný Date: Wed May 18 18:18:59 2022 +0200 selftests: memcg: factor out common parts of memory.{low,min} tests The memory protection test setup and runtime is almost equal for memory.low and memory.min cases. It makes modification of the common parts prone to mistakes, since the protections are similar not only in setup but also in principle, factor the common part out. Past exceptions between the tests: - missing memory.min is fine (kept), - test_memcg_low protected orphaned pagecache (adapted like test_memcg_min and we keep the processes of protected memory running). The evaluation in two tests is different (OOM of allocator vs low events of protégés), this is kept different. Link: https://lkml.kernel.org/r/20220518161859.21565-6-mkoutny@suse.com Signed-off-by: Michal Koutný Acked-by: Roman Gushchin CC: Johannes Weiner Cc: Michal Hocko Cc: Shakeel Butt Cc: Richard Palethorpe Cc: David Vernet Signed-off-by: Andrew Morton commit 6a35919005d4146aee14339a6cd52286465e5023 Author: Michal Koutný Date: Wed May 18 18:18:58 2022 +0200 selftests: memcg: remove protection from top level memcg The reclaim is triggered by memory limit in a subtree, therefore the testcase does not need configured protection against external reclaim. Also, correct respective comments. Link: https://lkml.kernel.org/r/20220518161859.21565-5-mkoutny@suse.com Signed-off-by: Michal Koutný Acked-by: Roman Gushchin Cc: David Vernet Cc: Johannes Weiner Cc: Michal Hocko Cc: Richard Palethorpe Cc: Shakeel Butt Signed-off-by: Andrew Morton commit f10b6e9a8e6621f6db2acfbf722a6331f3afaa84 Author: Michal Koutný Date: Wed May 18 18:18:57 2022 +0200 selftests: memcg: adjust expected reclaim values of protected cgroups The numbers are not easy to derive in a closed form (certainly mere protections ratios do not apply), therefore use a simulation to obtain expected numbers. Link: https://lkml.kernel.org/r/20220518161859.21565-4-mkoutny@suse.com Signed-off-by: Michal Koutný Acked-by: Roman Gushchin Cc: David Vernet Cc: Johannes Weiner Cc: Michal Hocko Cc: Richard Palethorpe Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 1d09069f5313f7c35655dc6d405896f748ddc53f Author: Michal Koutný Date: Wed May 18 18:18:56 2022 +0200 selftests: memcg: expect no low events in unprotected sibling This is effectively a revert of commit cdc69458a5f3 ("cgroup: account for memory_recursiveprot in test_memcg_low()"). The case test_memcg_low will fail with memory_recursiveprot until resolved in reclaim code. However, this patch preserves the existing helpers and variables for later uses. Link: https://lkml.kernel.org/r/20220518161859.21565-3-mkoutny@suse.com Signed-off-by: Michal Koutný Reviewed-by: David Vernet Cc: Johannes Weiner Cc: Michal Hocko Cc: Richard Palethorpe Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit ff3b72a5d614702ec119f107bddd99cdad622b44 Author: Michal Koutný Date: Wed May 18 18:18:55 2022 +0200 selftests: memcg: fix compilation Patch series "memcontrol selftests fixups", v2. Flushing the patches to make memcontrol selftests check the events behavior we had consensus about (test_memcg_low fails). (test_memcg_reclaim, test_memcg_swap_max fail for me now but it's present even before the refactoring.) The two bigger changes are: - adjustment of the protected values to make tests succeed with the given tolerance, - both test_memcg_low and test_memcg_min check protection of memory in populated cgroups (actually as per Documentation/admin-guide/cgroup-v2.rst memory.min should not apply to empty cgroups, which is not the case currently. Therefore I unified tests with the populated case in order to to bring more broken tests). This patch (of 5): This fixes mis-applied changes from commit 72b1e03aa725 ("cgroup: account for memory_localevents in test_memcg_oom_group_leaf_events()"). Link: https://lkml.kernel.org/r/20220518161859.21565-1-mkoutny@suse.com Link: https://lkml.kernel.org/r/20220518161859.21565-2-mkoutny@suse.com Signed-off-by: Michal Koutný Reviewed-by: David Vernet Acked-by: Roman Gushchin Cc: Johannes Weiner Cc: Michal Hocko Cc: Richard Palethorpe Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 943fb61dd66f475c25b1ef5dddb647070f2e89a1 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: fix z3fold_page_migrate races with z3fold_map Think about the below scenario: CPU1 CPU2 z3fold_page_migrate z3fold_map z3fold_page_trylock ... z3fold_page_unlock /* slots still points to old zhdr*/ get_z3fold_header get slots from handle get old zhdr from slots z3fold_page_trylock return *old* zhdr encode_handle(new_zhdr, FIRST|LAST|MIDDLE) put_page(page) /* zhdr is freed! */ but zhdr is still used by caller! z3fold_map can map freed z3fold page and lead to use-after-free bug. To fix it, we add PAGE_MIGRATED to indicate z3fold page is migrated and soon to be released. So get_z3fold_header won't return such page. Link: https://lkml.kernel.org/r/20220429064051.61552-10-linmiaohe@huawei.com Fixes: 1f862989b04a ("mm/z3fold.c: support page migration") Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 04094226d6ce8c0cb590891e13872109aa6722f1 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: fix z3fold_reclaim_page races with z3fold_free Think about the below scenario: CPU1 CPU2 z3fold_reclaim_page z3fold_free spin_lock(&pool->lock) get_z3fold_header -- hold page_lock kref_get_unless_zero kref_put--zhdr->refcount can be 1 now !z3fold_page_trylock kref_put -- zhdr->refcount is 0 now release_z3fold_page WARN_ON(!list_empty(&zhdr->buddy)); -- we're on buddy now! spin_lock(&pool->lock); -- deadlock here! z3fold_reclaim_page might race with z3fold_free and will lead to pool lock deadlock and zhdr buddy non-empty warning. To fix this, defer getting the refcount until page_lock is held just like what __z3fold_alloc does. Note this has the side effect that we won't break the reclaim if we meet a soon to be released z3fold page now. Link: https://lkml.kernel.org/r/20220429064051.61552-9-linmiaohe@huawei.com Fixes: dcf5aedb24f8 ("z3fold: stricter locking and more careful reclaim") Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 4a1c3839108afcfec02f4d62d6862b2451b442ab Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: always clear PAGE_CLAIMED under z3fold page lock Think about the below race window: CPU1 CPU2 z3fold_reclaim_page z3fold_free test_and_set_bit PAGE_CLAIMED failed to reclaim page z3fold_page_lock(zhdr); add back to the lru list; z3fold_page_unlock(zhdr); get_z3fold_header page_claimed=test_and_set_bit PAGE_CLAIMED clear_bit(PAGE_CLAIMED, &page->private); if (!page_claimed) /* it's false true */ free_handle is not called free_handle won't be called in this case. So z3fold_buddy_slots will leak. Fix it by always clear PAGE_CLAIMED under z3fold page lock. Link: https://lkml.kernel.org/r/20220429064051.61552-8-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 6cf9a34967ed544ca4c0949e9928dc78fca57ef3 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: put z3fold page back into unbuddied list when reclaim or migration fails When doing z3fold page reclaim or migration, the page is removed from unbuddied list. If reclaim or migration succeeds, it's fine as page is released. But in case it fails, the page is not put back into unbuddied list now. The page will be leaked until next compaction work, reclaim or migration is done. Link: https://lkml.kernel.org/r/20220429064051.61552-7-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit f4bad643c1d602f7154cf0d8eeb509136a55dccb Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 revert "mm/z3fold.c: allow __GFP_HIGHMEM in z3fold_alloc" Revert commit f1549cb5ab2b ("mm/z3fold.c: allow __GFP_HIGHMEM in z3fold_alloc"). z3fold can't support GFP_HIGHMEM page now. page_address is used directly at all places. Moreover, z3fold_header is on per cpu unbuddied list which could be accessed anytime. So we should remove the support of GFP_HIGHMEM allocation for z3fold. Link: https://lkml.kernel.org/r/20220429064051.61552-6-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Vitaly Wool Signed-off-by: Andrew Morton commit 2c0f351434785626beb5cb49962b4e873459fd38 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: throw warning on failure of trylock_page in z3fold_alloc If trylock_page fails, the page won't be non-lru movable page. When this page is freed via free_z3fold_page, it will trigger bug on PageMovable check in __ClearPageMovable. Throw warning on failure of trylock_page to guard against such rare case just as what zsmalloc does. Link: https://lkml.kernel.org/r/20220429064051.61552-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Vitaly Wool Signed-off-by: Andrew Morton commit df6f0f1d0cf091947bb621cfdada4c82c1f05c4b Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: remove buggy use of stale list for allocation Currently if z3fold couldn't find an unbuddied page it would first try to pull a page off the stale list. But this approach is problematic. If init z3fold page fails later, the page should be freed via free_z3fold_page to clean up the relevant resource instead of using __free_page directly. And if page is successfully reused, it will BUG_ON later in __SetPageMovable because it's already non-lru movable page, i.e. PAGE_MAPPING_MOVABLE is already set in page->mapping. In order to fix all of these issues, we can simply remove the buggy use of stale list for allocation because can_sleep should always be false and we never really hit the reusing code path now. Link: https://lkml.kernel.org/r/20220429064051.61552-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 7c61c35bbd6a888416e5a6de8ff8782a70d013d4 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: fix possible null pointer dereferencing alloc_slots could fail to allocate memory under heavy memory pressure. So we should check zhdr->slots against NULL to avoid future null pointer dereferencing. Link: https://lkml.kernel.org/r/20220429064051.61552-3-linmiaohe@huawei.com Fixes: fc5488651c7d ("z3fold: simplify freeing slots") Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 4c6bdb36408fbe4697eb9f1d95a3ddc1d2348448 Author: Miaohe Lin Date: Fri Apr 29 14:40:43 2022 +0800 mm/z3fold: fix sheduling while atomic Patch series "A few fixup patches for z3fold". This series contains a few fixup patches to fix sheduling while atomic, fix possible null pointer dereferencing, fix various race conditions and so on. More details can be found in the respective changelogs. This patch (of 9): z3fold's page_lock is always held when calling alloc_slots. So gfp should be GFP_ATOMIC to avoid "scheduling while atomic" bug. Link: https://lkml.kernel.org/r/20220429064051.61552-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220429064051.61552-2-linmiaohe@huawei.com Fixes: fc5488651c7d ("z3fold: simplify freeing slots") Signed-off-by: Miaohe Lin Reviewed-by: Vitaly Wool Signed-off-by: Andrew Morton commit 86d28b0709279ccc636ef9ba267b7f3bcef79a4b Author: Zi Yan Date: Thu May 26 19:15:31 2022 -0400 mm: split free page with properly free memory accounting and without race In isolate_single_pageblock(), free pages are checked without holding zone lock, but they can go away in split_free_page() when zone lock is held. Check the free page and its order again in split_free_page() when zone lock is held. Recheck the page if the free page is gone under zone lock. In addition, in split_free_page(), the free page was deleted from the page list without changing free page accounting. Add the missing free page accounting code. Fix the type of order parameter in split_free_page(). Link: https://lore.kernel.org/lkml/20220525103621.987185e2ca0079f7b97b856d@linux-foundation.org/ Link: https://lkml.kernel.org/r/20220526231531.2404977-2-zi.yan@sent.com Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity") Signed-off-by: Zi Yan Reported-by: Doug Berger Link: https://lore.kernel.org/linux-mm/c3932a6f-77fe-29f7-0c29-fe6b1c67ab7b@gmail.com/ Cc: David Hildenbrand Cc: Qian Cai Cc: Vlastimil Babka Cc: Mel Gorman Cc: Eric Ren Cc: Mike Rapoport Cc: Oscar Salvador Cc: Christophe Leroy Cc: Marek Szyprowski Cc: Michael Walle Signed-off-by: Andrew Morton commit 9b209e557d698f24317d2619d8628b98b6728e4f Author: Zi Yan Date: Thu May 26 19:15:30 2022 -0400 mm: page-isolation: skip isolated pageblock in start_isolate_page_range() start_isolate_page_range() first isolates the first and the last pageblocks in the range and ensure pages across range boundaries are split during isolation. But it missed the case when the range is <= a pageblock and the first and the last pageblocks are the same one, so the second isolate_single_pageblock() will always fail. To fix it, skip the pageblock isolation in second isolate_single_pageblock(). Link: https://lkml.kernel.org/r/20220526231531.2404977-1-zi.yan@sent.com Fixes: 88ee134320b8 ("mm: fix a potential infinite loop in start_isolate_page_range()") Signed-off-by: Zi Yan Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Link: https://lore.kernel.org/linux-mm/ac65adc0-a7e4-cdfe-a0d8-757195b86293@samsung.com/ Reported-by: Michael Walle Tested-by: Michael Walle Link: https://lore.kernel.org/linux-mm/8ca048ca8b547e0dd1c95387ee05c23d@walle.cc/ Cc: Christophe Leroy Cc: David Hildenbrand Cc: Doug Berger Cc: Eric Ren Cc: Mel Gorman Cc: Mike Rapoport Cc: Oscar Salvador Cc: Qian Cai Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9dde6cadb92b5670b23b97ec53091df0530ec38b Author: Arnaldo Carvalho de Melo Date: Fri Aug 7 08:45:47 2020 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes in: db1af12929c99d15 ("x86/msr-index: Define INTEGRITY_CAPABILITIES MSR") 089be16d5992dd0b ("x86/msr: Add PerfCntrGlobal* registers") f52ba93190457aa2 ("tools/power turbostat: Add Power Limit4 support") Addressing these tools/perf build warnings: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2022-05-26 12:50:01.228612839 -0300 +++ after 2022-05-26 12:50:07.699776166 -0300 @@ -116,6 +116,7 @@ [0x0000026f] = "MTRRfix4K_F8000", [0x00000277] = "IA32_CR_PAT", [0x00000280] = "IA32_MC0_CTL2", + [0x000002d9] = "INTEGRITY_CAPS", [0x000002ff] = "MTRRdefType", [0x00000309] = "CORE_PERF_FIXED_CTR0", [0x0000030a] = "CORE_PERF_FIXED_CTR1", @@ -176,6 +177,7 @@ [0x00000586] = "IA32_RTIT_ADDR3_A", [0x00000587] = "IA32_RTIT_ADDR3_B", [0x00000600] = "IA32_DS_AREA", + [0x00000601] = "VR_CURRENT_CONFIG", [0x00000606] = "RAPL_POWER_UNIT", [0x0000060a] = "PKGC3_IRTL", [0x0000060b] = "PKGC6_IRTL", @@ -260,6 +262,10 @@ [0xc0000102 - x86_64_specific_MSRs_offset] = "KERNEL_GS_BASE", [0xc0000103 - x86_64_specific_MSRs_offset] = "TSC_AUX", [0xc0000104 - x86_64_specific_MSRs_offset] = "AMD64_TSC_RATIO", + [0xc000010f - x86_64_specific_MSRs_offset] = "AMD_DBG_EXTN_CFG", + [0xc0000300 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS", + [0xc0000301 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_CTL", + [0xc0000302 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_CLR", }; #define x86_AMD_V_KVM_MSRs_offset 0xc0010000 @@ -318,4 +324,5 @@ [0xc00102b4 - x86_AMD_V_KVM_MSRs_offset] = "AMD_CPPC_STATUS", [0xc00102f0 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN_CTL", [0xc00102f1 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN", + [0xc0010300 - x86_AMD_V_KVM_MSRs_offset] = "AMD_SAMP_BR_FROM", }; $ Now one can trace systemwide asking to see backtraces to where those MSRs are being read/written, see this example with a previous update: # perf trace -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" ^C# If we use -v (verbose mode) we can see what it does behind the scenes: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" Using CPUID AuthenticAMD-25-21-0 0x6a0 0x6a8 New filter for msr:read_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) 0x6a0 0x6a8 New filter for msr:write_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) mmap size 528384B ^C# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Cc: Adrian Hunter Cc: Hans de Goede Cc: Ian Rogers Cc: Jiri Olsa Cc: Len Brown Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Sumeet Pawnikar Cc: Tony Luck Link: https://lore.kernel.org/lkml/Yo+i%252Fj5+UtE9dcix@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 12fdd6c009da0d029ae54cff67242be02ea42a7a Author: Leo Yan Date: Sat May 21 21:04:46 2022 +0800 perf scripts python: Support Arm CoreSight trace data disassembly This commit adds python script to parse CoreSight tracing event and print out source line and disassembly, it generates readable program execution flow for easier humans inspecting. The script receives CoreSight tracing packet with below format: +------------+------------+------------+ packet(n): | addr | ip | cpu | +------------+------------+------------+ packet(n+1): | addr | ip | cpu | +------------+------------+------------+ packet::addr presents the start address of the coming branch sample, and packet::ip is the last address of the branch smple. Therefore, a code section between branches starts from packet(n)::addr and it stops at packet(n+1)::ip. As results we combines the two continuous packets to generate the address range for instructions: [ sample(n)::addr .. sample(n+1)::ip ] The script supports both objdump or llvm-objdump for disassembly with specifying option '-d'. If doesn't specify option '-d', the script simply outputs source lines and symbols. Below shows usages with llvm-objdump or objdump to output disassembly. # perf script -s scripts/python/arm-cs-trace-disasm.py -- -d llvm-objdump-11 -k ./vmlinux ARM CoreSight Trace Data Assembler Dump ffff800008eb3198 : ffff800008eb3310: c0 38 00 35 cbnz w0, 0xffff800008eb3a28 ffff800008eb3314: 9f 3f 03 d5 dsb sy ffff800008eb3318: df 3f 03 d5 isb ffff800008eb331c: f5 5b 42 a9 ldp x21, x22, [sp, #32] ffff800008eb3320: fb 73 45 a9 ldp x27, x28, [sp, #80] ffff800008eb3324: e0 82 40 39 ldrb w0, [x23, #32] ffff800008eb3328: 60 00 00 34 cbz w0, 0xffff800008eb3334 ffff800008eb332c: e0 03 19 aa mov x0, x25 ffff800008eb3330: 8c fe ff 97 bl 0xffff800008eb2d60 main 6728/6728 [0004] 0.000000000 etm4_enable_hw+0x198 [kernel.kallsyms] ffff800008eb2d60 : ffff800008eb2d60: 1f 20 03 d5 nop ffff800008eb2d64: 1f 20 03 d5 nop ffff800008eb2d68: 3f 23 03 d5 hint #25 ffff800008eb2d6c: 00 00 40 f9 ldr x0, [x0] ffff800008eb2d70: 9f 3f 03 d5 dsb sy ffff800008eb2d74: 00 c0 3e 91 add x0, x0, #4016 ffff800008eb2d78: 1f 00 00 b9 str wzr, [x0] ffff800008eb2d7c: bf 23 03 d5 hint #29 ffff800008eb2d80: c0 03 5f d6 ret main 6728/6728 [0004] 0.000000000 etm4_cs_lock.isra.0.part.0+0x20 # perf script -s scripts/python/arm-cs-trace-disasm.py -- -d objdump -k ./vmlinux ARM CoreSight Trace Data Assembler Dump ffff800008eb3310 : ffff800008eb3310: 350038c0 cbnz w0, ffff800008eb3a28 ffff800008eb3314: d5033f9f dsb sy ffff800008eb3318: d5033fdf isb ffff800008eb331c: a9425bf5 ldp x21, x22, [sp, #32] ffff800008eb3320: a94573fb ldp x27, x28, [sp, #80] ffff800008eb3324: 394082e0 ldrb w0, [x23, #32] ffff800008eb3328: 34000060 cbz w0, ffff800008eb3334 ffff800008eb332c: aa1903e0 mov x0, x25 ffff800008eb3330: 97fffe8c bl ffff800008eb2d60 main 6728/6728 [0004] 0.000000000 etm4_enable_hw+0x198 [kernel.kallsyms] ffff800008eb2d60 : ffff800008eb2d60: d503201f nop ffff800008eb2d64: d503201f nop ffff800008eb2d68: d503233f paciasp ffff800008eb2d6c: f9400000 ldr x0, [x0] ffff800008eb2d70: d5033f9f dsb sy ffff800008eb2d74: 913ec000 add x0, x0, #0xfb0 ffff800008eb2d78: b900001f str wzr, [x0] ffff800008eb2d7c: d50323bf autiasp ffff800008eb2d80: d65f03c0 ret main 6728/6728 [0004] 0.000000000 etm4_cs_lock.isra.0.part.0+0x20 Signed-off-by: Leo Yan Co-authored-by: Al Grant Co-authored-by: Mathieu Poirier Co-authored-by: Tor Jeremiassen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Eelco Chaudron Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Tanmay Jagdale Cc: coresight@lists.linaro.org Cc: zengshun . wu Link: https://lore.kernel.org/r/20220521130446.4163597-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit c4f462235c0f61a0eff2ca0f965a3fdceb80347d Author: Leo Yan Date: Sat May 21 21:04:45 2022 +0800 perf scripting python: Expose dso and map information This change adds dso build_id and corresponding map's start and end address. The info of dso build_id can be used to find dso file path, and we can validate if a branch address falls into the range of map's start and end addresses. In addition, the map's start address can be used as an offset for disassembly. Signed-off-by: Leo Yan Acked-by: Adrian Hunter Cc: Al Grant Cc: Alexander Shishkin Cc: Eelco Chaudron Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephen Brennan Cc: Tanmay Jagdale Cc: coresight@lists.linaro.org Cc: zengshun . wu Link: https://lore.kernel.org/r/20220521130446.4163597-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit f4df0dbbe62ee8e4405a57b27ccd54393971c773 Author: Zhengjun Xing Date: Wed May 25 22:04:10 2022 +0800 perf jevents: Fix event syntax error caused by ExtSel In the origin code, when "ExtSel" is 1, the eventcode will change to "eventcode |= 1 << 21”. For event “UNC_Q_RxL_CREDITS_CONSUMED_VN0.DRS", its "ExtSel" is "1", its eventcode will change from 0x1E to 0x20001E, but in fact the eventcode should <=0x1FF, so this will cause the parse fail: # perf stat -e "UNC_Q_RxL_CREDITS_CONSUMED_VN0.DRS" -a sleep 0.1 event syntax error: '.._RxL_CREDITS_CONSUMED_VN0.DRS' \___ value too big for format, maximum is 511 On the perf kernel side, the kernel assumes the valid bits are continuous. It will adjust the 0x100 (bit 8 for perf tool) to bit 21 in HW. DEFINE_UNCORE_FORMAT_ATTR(event_ext, event, "config:0-7,21"); So the perf tool follows the kernel side and just set bit8 other than bit21. Fixes: fedb2b518239cbc0 ("perf jevents: Add support for parsing uncore json files") Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220525140410.1706851-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 2be00431c576f7fc2299673301134b0d190699a9 Author: James Clark Date: Wed May 25 16:41:14 2022 +0100 perf tools arm64: Add support for VG register Add the name of the VG register so it can be used in --user-regs The event will fail to open if the register is requested but not available so only add it to the mask if the kernel supports sve and also if it supports that specific register. Committer notes: Add conditional definition of HWCAP_SVE, as suggested by Leo Yan, to build on older systems where this is not available in the system headers. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Alexander Shishkin Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Brown Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220525154114.718321-6-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 24c8e27e63224ce832b4723cb60632d3eddb55de Author: Miaohe Lin Date: Thu May 26 19:33:50 2022 +0800 mm/page_table_check: fix accessing unmapped ptep ptep is unmapped too early, so ptep could theoretically be accessed while it's unmapped. This might become a problem if/when CONFIG_HIGHPTE becomes available on riscv. Fix it by deferring pte_unmap() until page table checking is done. [akpm@linux-foundation.org: account for ptep alteration, per Matthew] Link: https://lkml.kernel.org/r/20220526113350.30806-1-linmiaohe@huawei.com Fixes: 80110bbfbba6 ("mm/page_table_check: check entries at pmd levels") Signed-off-by: Miaohe Lin Acked-by: Pasha Tatashin Cc: Qi Zheng Cc: Matthew Wilcox Cc: David Rientjes Signed-off-by: Andrew Morton commit 3e35142ef99fe6b4fe5d834ad43ee13cca10a2dc Author: Naveen N. Rao Date: Thu May 19 14:42:37 2022 +0530 kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] Since commit d1bcae833b32f1 ("ELF: Don't generate unused section symbols") [1], binutils (v2.36+) started dropping section symbols that it thought were unused. This isn't an issue in general, but with kexec_file.c, gcc is placing kexec_arch_apply_relocations[_add] into a separate .text.unlikely section and the section symbol ".text.unlikely" is being dropped. Due to this, recordmcount is unable to find a non-weak symbol in .text.unlikely to generate a relocation record against. Address this by dropping the weak attribute from these functions. Instead, follow the existing pattern of having architectures #define the name of the function they want to override in their headers. [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=d1bcae833b32f1 [akpm@linux-foundation.org: arch/s390/include/asm/kexec.h needs linux/module.h] Link: https://lkml.kernel.org/r/20220519091237.676736-1-naveen.n.rao@linux.vnet.ibm.com Signed-off-by: Michael Ellerman Signed-off-by: Naveen N. Rao Cc: "Eric W. Biederman" Cc: Signed-off-by: Andrew Morton commit c572e4888ad1be123c1516ec577ad30a700bbec4 Author: Mel Gorman Date: Thu May 26 10:12:10 2022 +0100 mm/page_alloc: always attempt to allocate at least one page during bulk allocation Peter Pavlisko reported the following problem on kernel bugzilla 216007. When I try to extract an uncompressed tar archive (2.6 milion files, 760.3 GiB in size) on newly created (empty) XFS file system, after first low tens of gigabytes extracted the process hangs in iowait indefinitely. One CPU core is 100% occupied with iowait, the other CPU core is idle (on 2-core Intel Celeron G1610T). It was bisected to c9fa563072e1 ("xfs: use alloc_pages_bulk_array() for buffers") but XFS is only the messenger. The problem is that nothing is waking kswapd to reclaim some pages at a time the PCP lists cannot be refilled until some reclaim happens. The bulk allocator checks that there are some pages in the array and the original intent was that a bulk allocator did not necessarily need all the requested pages and it was best to return as quickly as possible. This was fine for the first user of the API but both NFS and XFS require the requested number of pages be available before making progress. Both could be adjusted to call the page allocator directly if a bulk allocation fails but it puts a burden on users of the API. Adjust the semantics to attempt at least one allocation via __alloc_pages() before returning so kswapd is woken if necessary. It was reported via bugzilla that the patch addressed the problem and that the tar extraction completed successfully. This may also address bug 215975 but has yet to be confirmed. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216007 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215975 Link: https://lkml.kernel.org/r/20220526091210.GC3441@techsingularity.net Fixes: 387ba26fb1cb ("mm/page_alloc: add a bulk page allocator") Signed-off-by: Mel Gorman Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: Jan Kara Cc: Vlastimil Babka Cc: Jesper Dangaard Brouer Cc: Chuck Lever Cc: [5.13+] Signed-off-by: Andrew Morton commit 48381273f8734d28ef56a5bdf1966dd8530111bc Author: Mike Kravetz Date: Tue May 24 13:50:03 2022 -0700 hugetlb: fix huge_pmd_unshare address update The routine huge_pmd_unshare() is passed a pointer to an address associated with an area which may be unshared. If unshare is successful this address is updated to 'optimize' callers iterating over huge page addresses. For the optimization to work correctly, address should be updated to the last huge page in the unmapped/unshared area. However, in the common case where the passed address is PUD_SIZE aligned, the address is incorrectly updated to the address of the preceding huge page. That wastes CPU cycles as the unmapped/unshared range is scanned twice. Link: https://lkml.kernel.org/r/20220524205003.126184-1-mike.kravetz@oracle.com Fixes: 39dde65c9940 ("shared page table for hugetlb page") Signed-off-by: Mike Kravetz Acked-by: Muchun Song Cc: Signed-off-by: Andrew Morton commit 40f567bbb3b0639d2ec7d1c6ad4b1b018f80cf19 Author: Jia-Ju Bai Date: Fri May 27 23:28:18 2022 +0800 md: bcache: check the return value of kzalloc() in detached_dev_do_request() The function kzalloc() in detached_dev_do_request() can fail, so its return value should be checked. Fixes: bc082a55d25c ("bcache: fix inaccurate io state for detached bcache devices") Reported-by: TOTE Robot Signed-off-by: Jia-Ju Bai Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20220527152818.27545-4-colyli@suse.de Signed-off-by: Jens Axboe commit 7d6b902ea0e02b2a25c480edf471cbaa4ebe6b3c Author: Coly Li Date: Fri May 27 23:28:16 2022 +0800 bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() The local variables check_state (in bch_btree_check()) and state (in bch_sectors_dirty_init()) should be fully filled by 0, because before allocating them on stack, they were dynamically allocated by kzalloc(). Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20220527152818.27545-2-colyli@suse.de Signed-off-by: Jens Axboe commit 59ed76fe2f981bccde37bdddb465f260a96a2404 Author: Song Liu Date: Thu May 26 12:16:08 2022 -0700 selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read Kernel function urandom_read is replaced with urandom_read_iter. Therefore, kprobe on urandom_read is not working any more: [root@eth50-1 bpf]# ./test_progs -n 161 test_stacktrace_build_id:PASS:skel_open_and_load 0 nsec libbpf: kprobe perf_event_open() failed: No such file or directory libbpf: prog 'oncpu': failed to create kprobe 'urandom_read+0x0' \ perf event: No such file or directory libbpf: prog 'oncpu': failed to auto-attach: -2 test_stacktrace_build_id:FAIL:attach_tp err -2 161 stacktrace_build_id:FAIL Fix this by replacing urandom_read with urandom_read_iter in the test. Fixes: 1b388e7765f2 ("random: convert to using fops->read_iter()") Reported-by: Mykola Lysenko Signed-off-by: Song Liu Acked-by: David Vernet Link: https://lore.kernel.org/r/20220526191608.2364049-1-song@kernel.org Signed-off-by: Alexei Starovoitov commit 4dd99891649ea5248e6a60113df0e0d04967eef7 Author: Xiang wangx Date: Fri May 27 20:10:59 2022 +0800 ALSA: hda/via: Delete does not require return Void function return statements are not generally useful. Signed-off-by: Xiang wangx Link: https://lore.kernel.org/r/20220527121059.25221-1-wangxiang@cdjrlc.com Signed-off-by: Takashi Iwai commit 15dad62f4bdb5dc0f0efde8181d680db9963544c Author: Rik van der Kemp Date: Fri May 27 14:07:26 2022 +0200 ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop The 2022-model XPS 15 appears to use the same 4-speakers-on-ALC289 audio setup as the Dell XPS 15 9510, so requires the same quirk to enable woofer output. Tested on my own 9520. [ Move the entry to the right position in the SSID order -- tiwai ] BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216035 Cc: Signed-off-by: Rik van der Kemp Link: https://lore.kernel.org/r/181056a137b.d14baf90133058.8425453735588429828@upto11.nl Signed-off-by: Takashi Iwai commit 8c03a1c21d72210f81cb369cc528e3fde4b45411 Author: Zhihao Cheng Date: Tue May 10 20:31:26 2022 +0800 ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link]. Fixes: 493cfaeaa0c9b ("mtd: utilize new cdev_device_add helper function") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 14072ee33d5a2a07d735b667205f99d0a95de9f2 Author: Zhihao Cheng Date: Tue May 10 20:31:25 2022 +0800 ubi: fastmap: Check wl_pool for free peb before wear leveling UBI fetches free peb from wl_pool during wear leveling, so UBI should check wl_pool's empty status before wear leveling. Otherwise, UBI will miss wear leveling chances when free pebs are run out. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit d09e9a2bddba6c48e0fddb16c4383172ac593251 Author: Zhihao Cheng Date: Tue May 10 20:31:24 2022 +0800 ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty There at least 6 PEBs reserved on UBI device: 1. EBA_RESERVED_PEBS[1] 2. WL_RESERVED_PEBS[1] 3. UBI_LAYOUT_VOLUME_EBS[2] 4. MIN_FASTMAP_RESERVED_PEBS[2] When all ubi volumes take all their PEBs, there are 3 (EBA_RESERVED_PEBS + WL_RESERVED_PEBS + MIN_FASTMAP_RESERVED_PEBS - MIN_FASTMAP_TAKEN_PEBS[1]) free PEBs. Since commit f9c34bb529975fe ("ubi: Fix producing anchor PEBs") and commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering wear level rules") applied, there is only 1 (3 - FASTMAP_ANCHOR_PEBS[1] - FASTMAP_NEXT_ANCHOR_PEBS[1]) free PEB to fill pool and wl_pool, after filling pool, wl_pool is always empty. So, UBI could be stuck in an infinite loop: ubi_thread system_wq wear_leveling_worker <-------------------------------------------------- get_peb_for_wl | // fm_wl_pool, used = size = 0 | schedule_work(&ubi->fm_work) | | update_fastmap_work_fn | ubi_update_fastmap | ubi_refill_pools | // ubi->free_count - ubi->beb_rsvd_pebs < 5 | // wl_pool is not filled with any PEBs | schedule_erase(old_fm_anchor) | ubi_ensure_anchor_pebs | __schedule_ubi_work(wear_leveling_worker) | | __erase_worker | ensure_wear_leveling | __schedule_ubi_work(wear_leveling_worker) -------------------------- , which cause high cpu usage of ubi_bgt: top - 12:10:42 up 5 min, 2 users, load average: 1.76, 0.68, 0.27 Tasks: 123 total, 3 running, 54 sleeping, 0 stopped, 0 zombie PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1589 root 20 0 0 0 0 R 45.0 0.0 0:38.86 ubi_bgt0d 319 root 20 0 0 0 0 I 15.2 0.0 0:15.29 kworker/0:3-eve 371 root 20 0 0 0 0 I 14.9 0.0 0:12.85 kworker/3:3-eve 20 root 20 0 0 0 0 I 11.3 0.0 0:05.33 kworker/1:0-eve 202 root 20 0 0 0 0 I 11.3 0.0 0:04.93 kworker/2:3-eve In commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering wear level rules"), there are three key changes: 1) Choose the fastmap anchor when the most free PEBs are available. 2) Enable anchor move within the anchor area again as it is useful for distributing wear. 3) Import a candidate fm anchor and check this PEB's erase count during wear leveling. If the wear leveling limit is exceeded, use the used anchor area PEB with the lowest erase count to replace it. The anchor candidate can be removed, we can check fm_anchor PEB's erase count during wear leveling. Fix it by: 1) Removing 'fm_next_anchor' and check 'fm_anchor' during wear leveling. 2) Preferentially filling one free peb into fm_wl_pool in condition of ubi->free_count > ubi->beb_rsvd_pebs, then try to reserve enough free count for fastmap non anchor pebs after the above prerequisites are met. Then, there are at least 1 PEB in pool and 1 PEB in wl_pool after calling ubi_refill_pools() with all erase works done. Fetch a reproducer in [Link]. Fixes: 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs ... rules") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215407 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 532aef5912c2c2add9ae725bcb1d0924e609dd87 Author: Haowen Bai Date: Tue Mar 22 18:13:04 2022 +0800 ubifs: Use NULL instead of using plain integer as pointer This fixes the following sparse warnings: fs/ubifs/xattr.c:680:58: warning: Using plain integer as NULL pointer Signed-off-by: Haowen Bai Signed-off-by: Richard Weinberger commit 5bff56edab7f11bda31cfc708634a025bb265836 Author: Minghao Chi Date: Fri Apr 29 05:45:56 2022 +0000 ubifs: Simplify the return expression of run_gc() Simplify the return expression. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Reviewed-by: Tudor Ambarus Signed-off-by: Richard Weinberger commit c14adb1cf70a984ed081c67e9d27bc3caad9537c Author: Baokun Li Date: Tue Apr 12 17:38:16 2022 +0800 jffs2: fix memory leak in jffs2_do_fill_super If jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff888105a65340 (size 64): comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc_trace+0x475/0x8a0 [] jffs2_sum_init+0x96/0x1a0 [] jffs2_do_mount_fs+0x745/0x2120 [] jffs2_do_fill_super+0x35c/0x810 [] jffs2_fill_super+0x2b9/0x3b0 [...] unreferenced object 0xffff8881bd7f0000 (size 65536): comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes): bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ backtrace: [] kmalloc_order+0xda/0x110 [] kmalloc_order_trace+0x21/0x130 [] __kmalloc+0x711/0x8a0 [] jffs2_sum_init+0xd9/0x1a0 [] jffs2_do_mount_fs+0x745/0x2120 [] jffs2_do_fill_super+0x35c/0x810 [] jffs2_fill_super+0x2b9/0x3b0 [...] -------------------------------------------- This is because the resources allocated in jffs2_sum_init() are not released. Call jffs2_sum_exit() to release these resources to solve the problem. Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time improvement)") Signed-off-by: Baokun Li Signed-off-by: Richard Weinberger commit 22abf318c35bcf642625e4eff56cfec1df361f3b Author: Haowen Bai Date: Mon Apr 18 18:18:07 2022 +0800 jffs2: Use kzalloc instead of kmalloc/memset Use kzalloc rather than duplicating its implementation, which makes code simple and easy to understand. Signed-off-by: Haowen Bai [rw: Fixed printk string] Signed-off-by: Richard Weinberger commit 6fe1953e008d0225fea9ad14ab52bd5faaea6c95 Author: Krzysztof Kozlowski Date: Mon May 16 16:28:57 2022 +0200 arm64: dts: sprd: use new 'dma-channels' property The '#dma-channels' property was deprecated in favor of one defined by generic dma-common DT bindings. Add new property while keeping old one for backwards compatibility. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20220516142857.6419-4-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit 22a798d7b234c651f05cd37b487ac8071d0f4936 Author: Krzysztof Kozlowski Date: Mon May 16 16:28:56 2022 +0200 ARM: dts: da850: use new 'dma-channels' property The '#dma-channels' property was deprecated in favor of one defined by generic dma-common DT bindings. Add new property while keeping old one for backwards compatibility. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220516142857.6419-3-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit 286b8073541ba8a295620c64ab9827f5153ad19b Author: Krzysztof Kozlowski Date: Mon May 16 16:28:55 2022 +0200 ARM: dts: pxa: use new 'dma-channels/requests' properties The '#dma-channels' and '#dma-requests' properties were deprecated in favor of these defined by generic dma-common DT bindings. Add new properties while keeping old ones for backwards compatibility. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220516142857.6419-2-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit 526f3f3b102f05e97d5e51fb0dcf5037c7be9722 Author: Linus Walleij Date: Mon May 23 10:55:20 2022 +0200 soc: ixp4xx/qmgr: Fix unused match warning The kernel test robot found this inconsistency: >> drivers/soc/ixp4xx/ixp4xx-npe.c:737:34: warning: 'ixp4xx_npe_of_match' defined but not used [-Wunused-const-variable=] 737 | static const struct of_device_id ixp4xx_npe_of_match[] = { This is because the match is enclosed in the of_match_ptr() which compiles into NULL when OF is disabled and this is unnecessary. Fix it by dropping of_match_ptr() around the match. Reported-by: kernel test robot Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220523085520.913217-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit 75577fbecb2e6e5f633445f01006886c51dc7e76 Author: Alexander Sverdlin Date: Mon May 23 08:56:16 2022 +0200 ARM: ep93xx: Make ts72xx_register_flash() static ... and fix the warning/error: arch/arm/mach-ep93xx/ts72xx.c:154:13: error: no previous prototype for function 'ts72xx_register_flash' [-Werror,-Wmissing-prototypes] void __init ts72xx_register_flash(struct mtd_partition *parts, int n, ^ arch/arm/mach-ep93xx/ts72xx.c:154:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void __init ts72xx_register_flash(struct mtd_partition *parts, int n, ^ static Reported-by: kernel test robot Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/lkml/202202140141.HRZ3WZwi-lkp@intel.com/T/ Link: https://lore.kernel.org/r/20220523065616.325052-1-alexander.sverdlin@gmail.com' Signed-off-by: Arnd Bergmann commit 01ba87a4b792e36254b19b2bcfeb935356294f95 Author: Michael Walle Date: Wed May 18 16:15:42 2022 +0200 ARM: configs: enable support for Kontron KSwitch D10 The Kontron KSwitch D10 is based on a Microchip LAN9668 SoC. It is a managed ethernet network switch with either 8 copper ports or 6 copper ports and 2 SFP cages. Enable all required kconfig symbols, either as module where possible or compiled-in where it is not possible. Signed-off-by: Michael Walle Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20220518141542.531148-1-michael@walle.cc' Signed-off-by: Arnd Bergmann commit 2ef306e16e7b60b614707272cff4276f7732b25a Merge: fd82d925f206c 821cb05f6b4b0 Author: Arnd Bergmann Date: Fri May 27 15:56:48 2022 +0200 Merge tag 'at91-dt-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/late AT91 DT #2 for 5.19: - at91: more DT compliance updates for RTC and RTT nodes - at91: sama7g5: add microphone support * tag 'at91-dt-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama7g5ek: add node for PDMC0 ARM: dts: at91: sama7g5: add nodes for PDMC ARM: dts: at91: Use the generic "rtc" node name for the rtt IPs ARM: dts: at91: Add the required 'atmel, rtt-rtc-time-reg' property Link: https://lore.kernel.org/r/20220517153252.92393-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit fd82d925f206c5f4db72b1d2da62a2f8086096c5 Merge: 8a7322a3a05f7 46a65cd376f9f Author: Arnd Bergmann Date: Fri May 27 15:56:29 2022 +0200 Merge tag 'at91-soc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/late AT91 SoC #2 for 5.19: - One Kconfig fix for random build error * tag 'at91-soc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: pm: Fix rand build error Link: https://lore.kernel.org/r/20220517150832.89451-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit 8a7322a3a05f75e8a4902bdf8129aecd37d54fe9 Author: Genjian Zhang Date: Tue May 17 15:39:46 2022 +0800 ep93xx: clock: Do not return the address of the freed memory Avoid return freed memory addresses,Modified to the actual error return value of clk_register(). Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK") Signed-off-by: Genjian Zhang Acked-by: Alexander Sverdlin Signed-off-by: Arnd Bergmann commit 3e11194631275937bc40da49b98aa1a74dd1ee67 Merge: 16477cdfefdb4 2fa1533f79d3f Author: Arnd Bergmann Date: Fri May 27 15:52:46 2022 +0200 Merge branch 'hpe/gxp-soc' into arm/late Patch series from Nick Hawkins: "The GXP is the HPE BMC SoC that is used in the majority of HPE current generation servers. Traditionally the asic will last multiple generations of server before being replaced. Info about SoC: HPE GXP is the name of the HPE Soc. This SoC is used to implement many BMC features at HPE. It supports ARMv7 architecture based on the Cortex A9 core. It is capable of using an AXI bus to which a memory controller is attached. It has multiple SPI interfaces to connect boot flash and BIOS flash. It uses a 10/100/1000 MAC for network connectivity. It has multiple i2c engines to drive connectivity with a host infrastructure. The initial patches enable the watchdog and timer enabling the host to be able to boot." * hpe/gxp-soc: MAINTAINERS: Introduce HPE GXP Architecture ARM: dts: Introduce HPE GXP Device tree dt-bindings: arm: hpe: add GXP Support dt-bindings: timer: hpe,gxp-timer: Add HPE GXP Timer and Watchdog clocksource/drivers/timer-gxp: Add HPE GXP Timer watchdog: hpe-wdt: Introduce HPE GXP Watchdog ARM: configs: multi_v7_defconfig: Add HPE GXP ARCH ARM: hpe: Introduce the HPE GXP architecture Signed-off-by: Arnd Bergmann commit b9684a71fca793213378dd410cd11675d973eaa1 Author: Christoph Hellwig Date: Fri May 27 07:58:06 2022 +0200 block, loop: support partitions without scanning Historically we did distinguish between a flag that surpressed partition scanning, and a combinations of the minors variable and another flag if any partitions were supported. This was generally confusing and doesn't make much sense, but some corner case uses of the loop driver actually do want to support manually added partitions on a device that does not actively scan for partitions. To make things worsee the loop driver also wants to dynamically toggle the scanning for partitions on a live gendisk, which makes the disk->flags updates non-atomic. Introduce a new GD_SUPPRESS_PART_SCAN bit in disk->state that disables just scanning for partitions, and toggle that instead of GENHD_FL_NO_PART in the loop driver. Fixes: 1ebe2e5f9d68 ("block: remove GENHD_FL_EXT_DEVT") Reported-by: Ming Lei Signed-off-by: Christoph Hellwig Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220527055806.1972352-1-hch@lst.de Signed-off-by: Jens Axboe commit dcf280e6f80be280ca7dd1b058f038654e4a18dd Author: Michael Ellerman Date: Fri May 27 21:15:41 2022 +1000 powerpc/64: Include cache.h directly in paca.h paca.h uses ____cacheline_aligned without directly including cache.h, where it's defined. For Book3S builds that's OK because paca.h includes lppaca.h, and it does include cache.h. But Book3E builds have been getting cache.h indirectly via printk.h, which is dicey, and in fact that include was recently removed, leading to build errors such as: ld: fs/isofs/dir.o:(.bss+0x0): multiple definition of `____cacheline_aligned'; fs/isofs/namei.o:(.bss+0x0): first defined here So include cache.h directly to fix the build error. Fixes: 534aa1dc975a ("printk: stop including cache.h from printk.h") Reported-by: Guenter Roeck Signed-off-by: Michael Ellerman commit 2c262b21de6dc93ac4d8c7a4cea0da4226b451fb Author: Carlo Lobrano Date: Fri May 27 10:29:06 2022 +0200 net: usb: qmi_wwan: add Telit 0x1250 composition Add support for Telit LN910Cx 0x1250 composition 0x1250: rmnet, tty, tty, tty, tty Signed-off-by: Carlo Lobrano Acked-by: Bjørn Mork Signed-off-by: David S. Miller commit 79dfeb2916d7deb7ed11e2fb782d109d445a0cd4 Author: Raju Lakkaraju Date: Fri May 27 09:47:28 2022 +0530 net: lan743x: PCI11010 / PCI11414 fix Fix the MDIO interface declarations to reflect what is currently supported by the PCI11010 / PCI11414 devices (C22 for RGMII and C22_C45 for SGMII) Signed-off-by: Raju Lakkaraju Signed-off-by: David S. Miller commit 809631e2bff5aba056df75cc4e43127dbd0278c9 Author: John Ogness Date: Thu May 26 22:36:56 2022 +0206 Revert "printk: wake up all waiters" This reverts commit 938ba4084abcf6fdd21d9078513c52f8fb9b00d0. The wait queue @log_wait never has exclusive waiters, so there is no need to use wake_up_interruptible_all(). Using wake_up_interruptible() was the correct function to wake all waiters. Since there are no exclusive waiters, erroneously changing wake_up_interruptible() to wake_up_interruptible_all() did not result in any behavior change. However, using wake_up_interruptible_all() on a wait queue without exclusive waiters is fundamentally wrong. Go back to using wake_up_interruptible() to wake all waiters. Signed-off-by: John Ogness Acked-by: Steven Rostedt (Google) Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220526203056.81123-1-john.ogness@linutronix.de commit 2028a255f4df3af9e759f01f958d3237f825f256 Author: Borislav Petkov Date: Fri May 20 21:27:29 2022 +0200 x86/extable: Annotate ex_handler_msr_mce() as a dead end Fix vmlinux.o: warning: objtool: fixup_exception+0x2d6: unreachable instruction Signed-off-by: Borislav Petkov Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220520192729.23969-1-bp@alien8.de commit 620f8d3bd3d5e82dff8cc591c831827d4beeae2e Author: Peter Zijlstra Date: Sat May 7 13:35:37 2022 +0200 context_tracking: Always inline empty stubs Because GCC is seriously challenged.. vmlinux.o: warning: objtool: enter_from_user_mode+0x85: call to context_tracking_enabled() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x8f: call to context_tracking_enabled() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x85: call to context_tracking_enabled() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x85: call to context_tracking_enabled() leaves .noinstr.text section Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mark Rutland Link: https://lkml.kernel.org/r/20220526105958.134113388@infradead.org commit 1894a4030582472336c2873cb07911ce67e0d14e Author: Peter Zijlstra Date: Sat May 7 13:37:45 2022 +0200 x86: Always inline on_thread_stack() and current_top_of_stack() Becaues GCC clearly lost it's marbles again... vmlinux.o: warning: objtool: enter_from_user_mode+0x4e: call to on_thread_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x53: call to on_thread_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x4e: call to on_thread_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x4e: call to on_thread_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: enter_from_user_mode+0x4e: call to current_top_of_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x53: call to current_top_of_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x4e: call to current_top_of_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x4e: call to current_top_of_stack() leaves .noinstr.text section Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220526105958.071435483@infradead.org commit 656d054e0a15ec327bd82801ccd58201e59f6896 Author: Peter Zijlstra Date: Mon May 2 12:30:20 2022 +0200 jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds When building x86_64 with JUMP_LABEL=n it's possible for instrumentation to sneak into noinstr: vmlinux.o: warning: objtool: exit_to_user_mode+0x14: call to static_key_count.constprop.0() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_exit_to_user_mode+0x2d: call to static_key_count.constprop.0() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_exit_to_user_mode+0x1b: call to static_key_count.constprop.0() leaves .noinstr.text section Switch to arch_ prefixed atomic to avoid the explicit instrumentation. Reported-by: kernel test robot Signed-off-by: Peter Zijlstra (Intel) commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 Author: Peter Zijlstra Date: Mon May 2 12:15:23 2022 +0200 x86/cpu: Elide KCSAN for cpu_has() and friends As x86 uses the headers, the regular forms of all bitops are instrumented with explicit calls to KASAN and KCSAN checks. As these are explicit calls, these are not suppressed by the noinstr function attribute. This can result in calls to those check functions in noinstr code, which objtool warns about: vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section Prevent this by using the arch_*() bitops, which are the underlying bitops without explciit instrumentation. [null: Changelog] Reported-by: kernel test robot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org commit 385bd430c011a8cb8278e61c32d602d11e06f414 Author: Peter Zijlstra Date: Mon May 2 11:15:14 2022 +0200 objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn fs/ntfs3/ntfs3.prelink.o: warning: objtool: ni_read_frame() falls through to next function ni_readpage_cmpr.cold() That is in fact: 000000000000124a : 124a: 44 89 e0 mov %r12d,%eax 124d: 0f b6 55 98 movzbl -0x68(%rbp),%edx 1251: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 1254: R_X86_64_32S .data+0x1380 1258: 48 89 c6 mov %rax,%rsi 125b: e8 00 00 00 00 call 1260 125c: R_X86_64_PLT32 __ubsan_handle_shift_out_of_bounds-0x4 1260: 48 8d 7d cc lea -0x34(%rbp),%rdi 1264: e8 00 00 00 00 call 1269 1265: R_X86_64_PLT32 __tsan_read4-0x4 1269: 8b 45 cc mov -0x34(%rbp),%eax 126c: e9 00 00 00 00 jmp 1271 126d: R_X86_64_PC32 .text+0x19109 1271: 48 8b 75 a0 mov -0x60(%rbp),%rsi 1275: 48 63 d0 movslq %eax,%rdx 1278: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 127b: R_X86_64_32S .data+0x13a0 127f: 89 45 88 mov %eax,-0x78(%rbp) 1282: e8 00 00 00 00 call 1287 1283: R_X86_64_PLT32 __ubsan_handle_shift_out_of_bounds-0x4 1287: 8b 45 88 mov -0x78(%rbp),%eax 128a: e9 00 00 00 00 jmp 128f 128b: R_X86_64_PC32 .text+0x19098 128f: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 1292: R_X86_64_32S .data+0x11f0 1296: e8 00 00 00 00 call 129b 1297: R_X86_64_PLT32 __ubsan_handle_builtin_unreachable-0x4 000000000000129b : Tell objtool that __ubsan_handle_builtin_unreachable() is a noreturn. Reported-by: kernel test robot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220502091514.GB479834@worktop.programming.kicks-ass.net commit 5f3da8c08508df82823566c32f753071c8ad36af Author: Josh Poimboeuf Date: Tue Apr 19 09:05:09 2022 -0700 objtool: Add CONFIG_HAVE_UACCESS_VALIDATION Allow an arch specify that it has objtool uaccess validation with CONFIG_HAVE_UACCESS_VALIDATION. For now, doing so unconditionally selects CONFIG_OBJTOOL. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/d393d5e2fe73aec6e8e41d5c24f4b6fe8583f2d8.1650384225.git.jpoimboe@redhat.com commit e19d11267f0e6c8aff2d15d2dfed12365b4c9184 Author: Fanjun Kong Date: Thu May 26 22:20:39 2022 +0800 x86/mm: Use PAGE_ALIGNED(x) instead of IS_ALIGNED(x, PAGE_SIZE) The already provides the PAGE_ALIGNED() macro. Let's use this macro instead of IS_ALIGNED() and passing PAGE_SIZE directly. No change in functionality. [ mingo: Tweak changelog. ] Signed-off-by: Fanjun Kong Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220526142038.1582839-1-bh1scw@gmail.com commit f7081834b2d5bbc77d67073d8ab490bfeaf3c13b Author: Bo Liu Date: Fri May 27 02:14:00 2022 -0400 x86: Fix all occurences of the "the the" typo Rather than waiting for the bots to fix these one-by-one, fix all occurences of "the the" throughout arch/x86. Signed-off-by: Bo Liu Signed-off-by: Ingo Molnar Cc: Paolo Bonzini Link: https://lore.kernel.org/r/20220527061400.5694-1-liubo03@inspur.com commit 8b4dd2d8627e88dc3bd71bf29c48aaae2b69572b Author: Haowen Bai Date: Fri May 27 18:03:54 2022 +0800 perf/core: Remove unused local variable Drop LIST_HEAD() where the variable it declares is never used. Compiler probably never warned us, because the LIST_HEAD() initializer is technically 'usage'. [ mingo: Tweak changelog. ] Signed-off-by: Haowen Bai Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/1653645835-29206-1-git-send-email-baihaowen@meizu.com commit 55919b32d14bfa8e47d0fe44f73ba069d1a2b3df Merge: 02ded5a173619 b53c116642502 Author: David S. Miller Date: Fri May 27 11:08:12 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following contain more Netfilter fixes for net: 1) syzbot warning in nfnetlink bind, from Florian. 2) Refetch conntrack after __nf_conntrack_confirm(), from Florian Westphal. 3) Move struct nf_ct_timeout back at the bottom of the ctnl_time, to where it before recent update, also from Florian. 4) Add NL_SET_BAD_ATTR() to nf_tables netlink for proper set element commands error reporting. ==================== Signed-off-by: David S. Miller commit b53c116642502b0c85ecef78bff4f826a7dd4145 Author: Pablo Neira Ayuso Date: Fri May 20 00:02:06 2022 +0200 netfilter: nf_tables: set element extended ACK reporting support Report the element that causes problems via netlink extended ACK for set element commands. Signed-off-by: Pablo Neira Ayuso commit aeed55a08d0b2bf2e3986b110b04d2a5aca192a6 Author: Florian Westphal Date: Fri May 20 00:02:05 2022 +0200 netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit syzbot reports: BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42 [..] list_del include/linux/list.h:148 [inline] cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617 No reproducer so far. Looking at recent changes in this area its clear that the free_head must not be at the end of the structure because nf_ct_timeout structure has variable size. Reported-by: Fixes: 78222bacfca9 ("netfilter: cttimeout: decouple unlink and free on netns destruction") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 56b14ecec97f39118bf85c9ac2438c5a949509ed Author: Florian Westphal Date: Fri May 20 00:02:04 2022 +0200 netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger. Reported-by: Fixes: 71d8c47fc653 ("netfilter: conntrack: introduce clash resolution on insertion race") Fixes: 2ad9d7747c10 ("netfilter: conntrack: free extension area immediately") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ffd219efd9ee1ceccc7ccfa9361fd40705680fc3 Author: Florian Westphal Date: Fri May 20 00:02:03 2022 +0200 netfilter: nfnetlink: fix warn in nfnetlink_unbind syzbot reports following warn: WARNING: CPU: 0 PID: 3600 at net/netfilter/nfnetlink.c:703 nfnetlink_unbind+0x357/0x3b0 net/netfilter/nfnetlink.c:694 The syzbot generated program does this: socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3 setsockopt(3, SOL_NETLINK, NETLINK_DROP_MEMBERSHIP, [1], 4) = 0 ... which triggers 'WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == 0)' check. Instead of counting, just enable reporting for every bind request and check if we still have listeners on unbind. While at it, also add the needed bounds check on nfnl_group2type[] access. Reported-by: Reported-by: Fixes: 2794cdb0b97b ("netfilter: nfnetlink: allow to detect if ctnetlink listeners exist") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 49f8b459fc1de5e3712b57c8ccefae9ec45270f8 Author: Juergen Gross Date: Tue May 24 13:46:30 2022 +0200 xen: switch gnttab_end_foreign_access() to take a struct page pointer Instead of a virtual kernel address use a pointer of the associated struct page as second parameter of gnttab_end_foreign_access(). Most users have that pointer available already and are creating the virtual address from it, risking problems in case the memory is located in highmem. gnttab_end_foreign_access() itself won't need to get the struct page from the address again. Suggested-by: Jan Beulich Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross commit 57963a92a70b037aa22544fbc34742e5be689c04 Merge: 317f29c14d0cc 9c04a8ff03def Author: Thomas Gleixner Date: Fri May 27 10:32:08 2022 +0200 Merge tag 'timers-v5.19-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevent/clocksource driver updates from Daniel Lezcano: - Add Mediatek MT8186 DT bindings (Allen-KH Cheng) - Remove dead code corresponding of the IXP4xx board removal (Linus Walleij) - Add CLOCK_EVT_FEAT_C3STOP flag for the RISC-V SBI timer (Samuel Holland) - Do not return an error if there are multiple definitions of the sp804 timers in the DT (Andre Przywara) - Add the missing SPDX identifier (Thomas Gleixner) - Remove an unncessary NULL check as it is done right before at probe time for the timer-ti-dm (Dan Carpenter) - Fix the irq_of_parse_and_map() return code check on onexas-nps (Krzysztof Kozlowski) Link: https://lore.kernel.org/lkml/b5a83e54-1ee1-f910-4be4-bc3bf1015243@linaro.org commit c9db1884050fa6524ae851347731ba2ff9c8d734 Author: Masahiro Yamada Date: Tue May 24 03:15:03 2022 +0900 kbuild: replace $(if A,A,B) with $(or A,B) in scripts/Makefile.modpost Similar cleanup to commit 5c8166419acf ("kbuild: replace $(if A,A,B) with $(or A,B)"). Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 68fef6704e38581f7462cb7aac349978fd4ca5cc Author: Masahiro Yamada Date: Tue May 24 01:46:26 2022 +0900 modpost: squash if...else-if in find_elf_symbol2() if ((addr - sym->st_value) < distance) { distance = addr - sym->st_value; near = sym; } else if ((addr - sym->st_value) == distance) { near = sym; } is equivalent to: if (addr - sym->st_value <= distance) { distance = addr - sym->st_value; near = sym; } (The else-if block can overwrite 'distance' with the same value). Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit c5c468dcc25efc0095361bb63b6255622e22f695 Author: Masahiro Yamada Date: Tue May 24 01:46:25 2022 +0900 modpost: reuse ARRAY_SIZE() macro for section_mismatch() Move ARRAY_SIZE() from file2alias.c to modpost.h to reuse it in section_mismatch(). Also, move the variable 'check' inside the for-loop. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 76954527fe05354add150737aa1b9a6baa4a6ee5 Author: Masahiro Yamada Date: Tue May 24 01:46:23 2022 +0900 modpost: remove the unused argument of check_sec_ref() check_sec_ref() does not use the first parameter 'mod'. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit d6b732666a1bae0df3c3ae06925043bba34502b1 Author: Masahiro Yamada Date: Tue May 24 01:46:22 2022 +0900 modpost: fix undefined behavior of is_arm_mapping_symbol() The return value of is_arm_mapping_symbol() is unpredictable when "$" is passed in. strchr(3) says: The strchr() and strrchr() functions return a pointer to the matched character or NULL if the character is not found. The terminating null byte is considered part of the string, so that if c is specified as '\0', these functions return a pointer to the terminator. When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is referenced (i.e. buffer overrun). Test code --------- char str1[] = "abc"; char str2[] = "ab"; strcpy(str1, "$"); strcpy(str2, "$"); printf("test1: %d\n", is_arm_mapping_symbol(str1)); printf("test2: %d\n", is_arm_mapping_symbol(str2)); Result ------ test1: 0 test2: 1 Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit b5beffa20d83c4e15306c991ffd00de0d8628338 Author: Alexander Lobakin Date: Tue May 24 17:27:18 2022 +0200 modpost: fix removing numeric suffixes With the `-z unique-symbol` linker flag or any similar mechanism, it is possible to trigger the following: ERROR: modpost: "param_set_uint.0" [vmlinux] is a static EXPORT_SYMBOL The reason is that for now the condition from remove_dot(): if (m && (s[n + m] == '.' || s[n + m] == 0)) which was designed to test if it's a dot or a '\0' after the suffix is never satisfied. This is due to that `s[n + m]` always points to the last digit of a numeric suffix, not on the symbol next to it (from a custom debug print added to modpost): param_set_uint.0, s[n + m] is '0', s[n + m + 1] is '\0' So it's off-by-one and was like that since 2014. Fix this for the sake of any potential upcoming features, but don't bother stable-backporting, as it's well hidden -- apart from that LD flag, it can be triggered only with GCC LTO which never landed upstream. Fixes: fcd38ed0ff26 ("scripts: modpost: fix compilation warning") Signed-off-by: Alexander Lobakin Reviewed-by: Petr Mladek Signed-off-by: Masahiro Yamada commit 2a4a62a14be1947fa945c5c11ebf67326381a568 Author: Vincent Whitchurch Date: Mon May 23 16:04:03 2022 +0200 um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame: init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc' ================================================================== Fixes: 858259cf7d1c443c83 ("uml: maintain own LDT entries") Signed-off-by: Vincent Whitchurch Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit 57ae0b67b747031bc41fb44643aa5344ab58607e Author: Johannes Berg Date: Fri May 20 19:45:36 2022 +0200 um: chan_user: Fix winch_tramp() return value The previous fix here was only partially correct, it did result in returning a proper error value in case of error, but it also clobbered the pid that we need to return from this function (not just zero for success). As a result, it returned 0 here, but later this is treated as a pid and used to kill the process, but since it's now 0 we kill(0, SIGKILL), which makes UML kill itself rather than just the helper thread. Fix that and make it more obvious by using a separate variable for the pid. Fixes: ccf1236ecac4 ("um: fix error return code in winch_tramp()") Reported-and-tested-by: Nathan Chancellor Signed-off-by: Johannes Berg Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit af9fb41ed315ce95f659f0b10b4d59a71975381d Author: Johannes Berg Date: Tue May 17 22:52:50 2022 +0200 um: virtio_uml: Fix broken device handling in time-travel If a device implementation crashes, virtio_uml will mark it as dead by calling virtio_break_device() and scheduling the work that will remove it. This still seems like the right thing to do, but it's done directly while reading the message, and if time-travel is used, this is in the time-travel handler, outside of the normal Linux machinery. Therefore, we cannot acquire locks or do normal "linux-y" things because e.g. lockdep will be confused about the context. Move handling this situation out of the read function and into the actual IRQ handler and response handling instead, so that in the case of time-travel we don't call it in the wrong context. Chances are the system will still crash immediately, since the device implementation crashing may also cause the time- travel controller to go down, but at least all of that now happens without strange warnings from lockdep. Fixes: c8177aba37ca ("um: time-travel: rework interrupt handling in ext mode") Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit d5a9597d6916a76663085db984cb8fe97f0a5c56 Author: Johannes Berg Date: Fri May 6 15:46:12 2022 +0200 um: line: Use separate IRQs per line Today, all possible serial lines (ssl*=) as well as all possible consoles (con*=) each share a single interrupt (with a fixed number) with others of the same type. Now, if you have two lines, say ssl0 and ssl1, and one of them is connected to an fd you cannot read (e.g. a file), but the other gets a read interrupt, then both of them get the interrupt since it's shared. Then, the read() call will return EOF, since it's a file being written and there's nothing to read (at least not at the current offset, at the end). Unfortunately, this is treated as a read error, and we close this line, losing all the possible output. It might be possible to work around this and make the IRQ sharing work, however, now that we have dynamically allocated IRQs that are easy to use, simply use that to achieve separating between the events; then there's no interrupt for that line and we never attempt the read in the first place, thus not closing the line. This manifested itself in the wifi hostap/hwsim tests where the parallel script communicates via one serial console and the kernel messages go to another (a file) and sending data on the communication console caused the kernel messages to stop flowing into the file. Reported-by: Jouni Malinen Signed-off-by: Johannes Berg Acked-By: anton ivanov Signed-off-by: Richard Weinberger commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28 Author: Miaoqian Lin Date: Thu May 26 18:52:08 2022 +0400 net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. mv88e6xxx_mdio_register() pass the device node to of_mdiobus_register(). We don't need the device node after it. Add missing of_node_put() to avoid refcount leak. Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") Signed-off-by: Miaoqian Lin Reviewed-by: Marek Behún Signed-off-by: David S. Miller commit 2419ac3272669240e70c967bacaa49be943b6344 Author: Vincent Whitchurch Date: Thu Apr 14 12:34:51 2022 +0200 um: Enable ARCH_HAS_GCOV_PROFILE_ALL Enable ARCH_HAS_GCOV_PROFILE_ALL so that CONFIG_GCOV_PROFILE_ALL can be selected on UML. I didn't need to explicitly disable GCOV on anything to get this to work on the configs I tested. Signed-off-by: Vincent Whitchurch Signed-off-by: Richard Weinberger commit 365719035526e8eda214a1cedb2e1c96e969a0d7 Author: Johannes Berg Date: Mon Mar 28 09:46:25 2022 +0200 um: Use asm-generic/dma-mapping.h If DMA (PCI over virtio) is enabled, then some drivers may enable CONFIG_DMA_OPS as well, and then we pull in the x86 definition of get_arch_dma_ops(), which uses the dma_ops symbol, which isn't defined. Since we don't have real DMA ops nor any kind of IOMMU fix this in the simplest possible way: pull in the asm-generic file instead of inheriting the x86 one. It's not clear why those drivers that do (e.g. VDPA) "select DMA_OPS", and if they'd even work with this, but chances are nobody will be wanting to do that anyway, so fixing the build failure is good enough. Reported-by: Randy Dunlap Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Johannes Berg Tested-by: Randy Dunlap Acked-by: Randy Dunlap Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit 5dd89d2fc438457811cbbec07999ce0d80051ff5 Author: Miaoqian Lin Date: Thu May 26 12:52:08 2022 +0400 net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. am65_cpsw_init_cpts() and am65_cpsw_nuss_probe() don't release the refcount in error case. Add missing of_node_put() to avoid refcount leak. Fixes: b1f66a5bee07 ("net: ethernet: ti: am65-cpsw-nuss: enable packet timestamping support") Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller commit b0cbccf4480bd251d7911e7fa1913e47769dc724 Author: Johannes Berg Date: Thu Mar 24 13:13:44 2022 +0100 um: daemon: Make default socket configurable Even if daemon network is deprecated, some configurations may still use it (e.g. Debian), and not want to default to the /tmp/uml.ctl socket location. Allow configuring the default socket location. Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Tested-by: Ritesh Raj Sarraf Signed-off-by: Richard Weinberger commit e7e7104e2d5ddf3806a28695670f21bef471f1e1 Author: Dan Carpenter Date: Thu May 26 11:02:42 2022 +0300 net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() The "fsp->location" variable comes from user via ethtool_get_rxnfc(). Check that it is valid to prevent an out of bounds read. Fixes: 7aab747e5563 ("net: ethernet: mediatek: add ethtool functions to configure RX flows of HW LRO") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 8d3a75078c83a26d2e637da4e8f95058a406f5e7 Author: Yuntao Wang Date: Sun May 22 22:12:40 2022 +0800 scripts/kallsyms: update usage message of the kallsyms program The kallsyms program supports --absolute-percpu option but does not display it in the usage message, fix it. Signed-off-by: Yuntao Wang Signed-off-by: Masahiro Yamada commit 23a0cb8e3225122496bfa79172005c587c2d64bf Author: Jing Leng Date: Tue May 17 18:51:28 2022 +0800 kbuild: Fix include path in scripts/Makefile.modpost When building an external module, if users don't need to separate the compilation output and source code, they run the following command: "make -C $(LINUX_SRC_DIR) M=$(PWD)". At this point, "$(KBUILD_EXTMOD)" and "$(src)" are the same. If they need to separate them, they run "make -C $(KERNEL_SRC_DIR) O=$(KERNEL_OUT_DIR) M=$(OUT_DIR) src=$(PWD)". Before running the command, they need to copy "Kbuild" or "Makefile" to "$(OUT_DIR)" to prevent compilation failure. So the kernel should change the included path to avoid the copy operation. Signed-off-by: Jing Leng [masahiro: I do not think "M=$(OUT_DIR) src=$(PWD)" is the official way, but this patch is a nice clean up anyway.] Signed-off-by: Masahiro Yamada commit 16aa835a25243114331fe816b3508120c5a88042 Author: Johannes Berg Date: Thu Mar 24 13:13:43 2022 +0100 um: xterm: Make default terminal emulator configurable Make the default terminal emulator configurable so e.g. Debian can set it to x-terminal-emulator instead of the current default of xterm. Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Tested-by: Ritesh Raj Sarraf Signed-off-by: Richard Weinberger commit 7e284070abe53d448517b80493863595af4ab5f0 Merge: 780d8ce716281 ca522482e3eaf Author: Linus Torvalds Date: Thu May 26 21:13:45 2022 -0700 Merge tag 'for-5.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Enable DM core bioset's per-cpu bio cache if QUEUE_FLAG_POLL set. This change improves DM's hipri bio polling (REQ_POLLED) performance by 7 - 20% depending on the system. - Update DM core to use jump_labels to further reduce cost of unlikely branches for zoned block devices, dm-stats and swap_bios throttling. - Various DM core changes to reduce bio-based DM overhead and simplify IO accounting. - Fundamental DM core improvements to dm_io reference counting and the elimination of using bio_split()+bio_chain() -- instead DM's bio-based IO accounting is updated to account that a split occurred. - Improve DM core's abnormal bio processing to do less work. - Improve DM core's hipri polling support to use a single list rather than an hlist. - Update DM core to pass NULL bdev to bio_alloc_clone() so that initialization that isn't useful for DM can be elided. - Add cond_resched to DM stats' various loops that loop over all entries. - Fix incorrect error code return from DM integrity's constructor. - Make DM crypt's printing of the key constant-time. - Update bio-based DM multipath to provide high-resolution timer to the Historical Service Time (HST) path selector. * tag 'for-5.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (26 commits) dm: pass NULL bdev to bio_alloc_clone dm cache metadata: remove unnecessary variable in __dump_mapping dm mpath: provide high-resolution timer to HST for bio-based dm crypt: make printing of the key constant-time dm integrity: fix error code in dm_integrity_ctr() dm stats: add cond_resched when looping over entries dm: improve abnormal bio processing dm: simplify bio-based IO accounting further dm: put all polled dm_io instances into a single list dm: improve dm_io reference counting dm: don't grab target io reference in dm_zone_map_bio dm: improve bio splitting and associated IO accounting dm: switch to bdev based IO accounting interfaces dm: pass dm_io instance to dm_io_acct directly dm: don't pass bio to __dm_start_io_acct and dm_end_io_acct dm: use bio_sectors in dm_aceept_partial_bio dm: simplify basic targets dm: conditionally enable branching for less used features dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio dm: move hot dm_io members to same cacheline as dm_target_io ... commit 780d8ce7162818cfe03e9a5e23b3af192a1d37bc Merge: 090b39af591cd 9c477178a0a18 Author: Linus Torvalds Date: Thu May 26 21:08:40 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Small collection of incremental improvement patches: - Minor code cleanup patches, comment improvements, etc from static tools - Clean the some of the kernel caps, reducing the historical stealth uAPI leftovers - Bug fixes and minor changes for rdmavt, hns, rxe, irdma - Remove unimplemented cruft from rxe - Reorganize UMR QP code in mlx5 to avoid going through the IB verbs layer - flush_workqueue(system_unbound_wq) removal - Ensure rxe waits for objects to be unused before allowing the core to free them - Several rc quality bug fixes for hfi1" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (67 commits) RDMA/rtrs-clt: Fix one kernel-doc comment RDMA/hfi1: Remove all traces of diagpkt support RDMA/hfi1: Consolidate software versions RDMA/hfi1: Remove pointless driver version RDMA/hfi1: Fix potential integer multiplication overflow errors RDMA/hfi1: Prevent panic when SDMA is disabled RDMA/hfi1: Prevent use of lock before it is initialized RDMA/rxe: Fix an error handling path in rxe_get_mcg() IB/core: Fix typo in comment RDMA/core: Fix typo in comment IB/hf1: Fix typo in comment IB/qib: Fix typo in comment IB/iser: Fix typo in comment RDMA/mlx4: Avoid flush_scheduled_work() usage IB/isert: Avoid flush_scheduled_work() usage RDMA/mlx5: Remove duplicate pointer assignment in mlx5_ib_alloc_implicit_mr() RDMA/qedr: Remove unnecessary synchronize_irq() before free_irq() RDMA/hns: Use hr_reg_read() instead of remaining roce_get_xxx() RDMA/hns: Use hr_reg_xxx() instead of remaining roce_set_xxx() RDMA/irdma: Add SW mechanism to generate completions on error ... commit 090b39af591cdde897664dfa5d3d5b0c78a197fb Merge: 6d29d7fe4f0c1 d37aa2efc89b3 Author: Linus Torvalds Date: Thu May 26 21:03:56 2022 -0700 Merge tag 'hardening-v5.19-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening fix from Kees Cook: "This fixes an unlucky build race condition when using the GCC plugins, noticed by a few folks. - Avoid GCC plugins needing utsrelease.h build target (Masahiro Yamada)" * tag 'hardening-v5.19-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: use KERNELVERSION for plugin version commit 6d29d7fe4f0c1e81c39622cce45cd397b23dc48f Merge: 7f50d4dfe816d 08af54b3e5729 Author: Linus Torvalds Date: Thu May 26 20:52:24 2022 -0700 Merge tag 'nfsd-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "We introduce 'courteous server' in this release. Previously NFSD would purge open and lock state for an unresponsive client after one lease period (typically 90 seconds). Now, after one lease period, another client can open and lock those files and the unresponsive client's lease is purged; otherwise if the unresponsive client's open and lock state is uncontended, the server retains that open and lock state for up to 24 hours, allowing the client's workload to resume after a lengthy network partition. A longstanding issue with NFSv4 file creation is also addressed. Previously a file creation can fail internally, returning an error to the client, but leave the newly created file in place as an artifact. The file creation code path has been reorganized so that internal failures and race conditions are less likely to result in an unwanted file creation. A fault injector has been added to help exercise paths that are run during kernel metadata cache invalidation. These caches contain information maintained by user space about exported filesystems. Many of our test workloads do not trigger cache invalidation. There is one patch that is needed to support PREEMPT_RT and a fix for an ancient 'sleep while spin-locked' splat that seems to have become easier to hit since v5.18-rc3" * tag 'nfsd-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (36 commits) NFSD: nfsd_file_put() can sleep NFSD: Add documenting comment for nfsd4_release_lockowner() NFSD: Modernize nfsd4_release_lockowner() NFSD: Fix possible sleep during nfsd4_release_lockowner() nfsd: destroy percpu stats counters after reply cache shutdown nfsd: Fix null-ptr-deref in nfsd_fill_super() nfsd: Unregister the cld notifier when laundry_wq create failed SUNRPC: Use RMW bitops in single-threaded hot paths NFSD: Clean up the show_nf_flags() macro NFSD: Trace filecache opens NFSD: Move documenting comment for nfsd4_process_open2() NFSD: Fix whitespace NFSD: Remove dprintk call sites from tail of nfsd4_open() NFSD: Instantiate a struct file when creating a regular NFSv4 file NFSD: Clean up nfsd_open_verified() NFSD: Remove do_nfsd_create() NFSD: Refactor NFSv4 OPEN(CREATE) NFSD: Refactor NFSv3 CREATE NFSD: Refactor nfsd_create_setattr() NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create() ... commit a54ce3703613e41fe1d98060b62ec09a3984dc28 Author: Vincent Ray Date: Wed May 25 17:17:46 2022 -0700 net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog In qdisc_run_begin(), smp_mb__before_atomic() used before test_bit() does not provide any ordering guarantee as test_bit() is not an atomic operation. This, added to the fact that the spin_trylock() call at the beginning of qdisc_run_begin() does not guarantee acquire semantics if it does not grab the lock, makes it possible for the following statement : if (test_bit(__QDISC_STATE_MISSED, &qdisc->state)) to be executed before an enqueue operation called before qdisc_run_begin(). As a result the following race can happen : CPU 1 CPU 2 qdisc_run_begin() qdisc_run_begin() /* true */ set(MISSED) . /* returns false */ . . /* sees MISSED = 1 */ . /* so qdisc not empty */ . __qdisc_run() . . . pfifo_fast_dequeue() ----> /* may be done here */ . | . clear(MISSED) | . . | . smp_mb __after_atomic(); | . . | . /* recheck the queue */ | . /* nothing => exit */ | enqueue(skb1) | . | qdisc_run_begin() | . | spin_trylock() /* fail */ | . | smp_mb__before_atomic() /* not enough */ | . ---- if (test_bit(MISSED)) return false; /* exit */ In the above scenario, CPU 1 and CPU 2 both try to grab the qdisc->seqlock at the same time. Only CPU 2 succeeds and enters the bypass code path, where it emits its skb then calls __qdisc_run(). CPU1 fails, sets MISSED and goes down the traditionnal enqueue() + dequeue() code path. But when executing qdisc_run_begin() for the second time, after enqueuing its skbuff, it sees the MISSED bit still set (by itself) and consequently chooses to exit early without setting it again nor trying to grab the spinlock again. Meanwhile CPU2 has seen MISSED = 1, cleared it, checked the queue and found it empty, so it returned. At the end of the sequence, we end up with skb1 enqueued in the backlog, both CPUs out of __dev_xmit_skb(), the MISSED bit not set, and no __netif_schedule() called made. skb1 will now linger in the qdisc until somebody later performs a full __qdisc_run(). Associated to the bypass capacity of the qdisc, and the ability of the TCP layer to avoid resending packets which it knows are still in the qdisc, this can lead to serious traffic "holes" in a TCP connection. We fix this by replacing the smp_mb__before_atomic() / test_bit() / set_bit() / smp_mb__after_atomic() sequence inside qdisc_run_begin() by a single test_and_set_bit() call, which is more concise and enforces the needed memory barriers. Fixes: 89837eb4b246 ("net: sched: add barrier to ensure correct ordering for lockless qdisc") Signed-off-by: Vincent Ray Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20220526001746.2437669-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit b58cdd4388b1d8f5bee9f5a3897a7e780d1eaa48 Author: Michael Walle Date: Thu May 26 01:12:39 2022 +0200 net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE At the moment, if devm_of_phy_get() returns an error the serdes simply isn't set. While it is bad to ignore an error in general, there is a particular bug that network isn't working if the serdes driver is compiled as a module. In that case, devm_of_phy_get() returns -EDEFER_PROBE and the error is silently ignored. The serdes is optional, it is not there if the port is using RGMII, in which case devm_of_phy_get() returns -ENODEV. Rearrange the error handling so that -ENODEV will be handled but other error codes will abort the probing. Fixes: d28d6d2e37d1 ("net: lan966x: add port module support") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20220525231239.1307298-1-michael@walle.cc Signed-off-by: Jakub Kicinski commit 4548ad7287c45047b2c1d536e110e0cfaccde1c9 Merge: 6c465408a7709 558254b0b602b Author: Jakub Kicinski Date: Thu May 26 20:43:05 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix UAF when creating non-stateful expression in set. 2) Set limit cost when cloning expression accordingly, from Phil Sutter. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_limit: Clone packet limits' cost value netfilter: nf_tables: disallow non-stateful expression in sets earlier ==================== Link: https://lore.kernel.org/r/20220526205411.315136-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 8d4a21b5ac9dad5d5221c60060b3ac28d22f57ca Author: sunliming Date: Thu May 26 15:29:57 2022 +0800 tracing: Fix comments for event_trigger_separate_filter() The parameter name in comments of event_trigger_separate_filter() is inconsistent with actual parameter name, fix it. Link: https://lkml.kernel.org/r/20220526072957.165655-1-sunliming@kylinos.cn Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit aef54851bf1d3e31f9c15e8134e859c2f343ceab Author: sunliming Date: Thu May 26 19:08:31 2022 +0800 x86/traceponit: Fix comment about irq vector tracepoints Commit: 4b9a8dca0e58 ("x86/idt: Remove the tracing IDT completely") removed the 'tracing IDT' from arch/x86/kernel/tracepoint.c, but left related comment. So that the comment become anachronistic. Just remove the comment. Link: https://lkml.kernel.org/r/20220526110831.175743-1-sunliming@kylinos.cn Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit feccde2a49ff88e3e197adf1f16ea852dd05d059 Author: sunliming Date: Wed May 25 09:28:27 2022 +0800 x86,tracing: Remove unused headers Commit 4b9a8dca0e58 ("x86/idt: Remove the tracing IDT completely") removed the tracing IDT from the file arch/x86/kernel/tracepoint.c, but left the related headers unused, remove it. Link: https://lkml.kernel.org/r/20220525012827.93464-1-sunliming@kylinos.cn Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit 7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 Author: Song Liu Date: Tue May 24 10:08:39 2022 -0700 ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX: ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI: ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10: ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14: ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3: 0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ] [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ] bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ] bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90 [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ] __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP: 0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP: 002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX: 00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI: 0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10: 00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14: 00000000069d2480 R15: 0000000000000001 [ ] [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace 0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2. run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because the entry is added to direct_functions, but not removed. Fix this by remove the entry from direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so we don't have to worry about it anymore. Link: https://lkml.kernel.org/r/20220524170839.900849-1-song@kernel.org Cc: stable@vger.kernel.org Fixes: 763e34e74bb7 ("ftrace: Add register_ftrace_direct()") Signed-off-by: Song Liu Signed-off-by: Steven Rostedt (Google) commit 0a54f556b035e5217e21724d82dd98ce695bd6d6 Author: sunliming Date: Tue May 24 14:39:37 2022 +0800 tracing: Fix comments of create_filter() The name in comments of parameter "filter_string" in function create_filter is annotated as "filter_str", just fix it. Link: https://lkml.kernel.org/r/20220524063937.52873-1-sunliming@kylinos.cn Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit bb5eb8f3b329789fbf22c85328dcf696a3e97ffb Author: Congyu Liu Date: Mon May 23 06:30:33 2022 +0000 tracing: Disable kcov on trace_preemptirq.c Functions in trace_preemptirq.c could be invoked from early interrupt code that bypasses kcov trace function's in_task() check. Disable kcov on this file to reduce random code coverage. Link: https://lkml.kernel.org/r/20220523063033.1778974-1-liu3101@purdue.edu Acked-by: Dmitry Vyukov Signed-off-by: Congyu Liu Signed-off-by: Steven Rostedt (Google) commit 154827f8e53d8c492b3fb0cb757fbcadb5d516b5 Author: Gautam Menghani Date: Sat May 21 23:18:26 2022 -0700 tracing: Initialize integer variable to prevent garbage return value Initialize the integer variable to 0 to fix the clang scan warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn] return ret; Link: https://lkml.kernel.org/r/20220522061826.1751-1-gautammenghani201@gmail.com Cc: stable@vger.kernel.org Fixes: 8993665abcce ("tracing/boot: Support multiple handlers for per-event histogram") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Gautam Menghani Signed-off-by: Steven Rostedt (Google) commit 50c697819d59c5013a66728940015348919a0c0c Author: Julia Lawall Date: Sat May 21 13:11:31 2022 +0200 ftrace: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lkml.kernel.org/r/20220521111145.81697-81-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Steven Rostedt (Google) commit 3a2bfec0b02f2226ff3376a5d2ff604d799bd7ea Author: Li kunyu Date: Wed May 18 10:36:40 2022 +0800 ftrace: Remove return value of ftrace_arch_modify_*() All instances of the function ftrace_arch_modify_prepare() and ftrace_arch_modify_post_process() return zero. There's no point in checking their return value. Just have them be void functions. Link: https://lkml.kernel.org/r/20220518023639.4065-1-kunyu@nfschina.com Signed-off-by: Li kunyu Signed-off-by: Steven Rostedt (Google) commit 2decd16f47e3df3234b5486fe89a9aa5a1102af1 Author: liqiong Date: Fri May 13 15:52:21 2022 +0800 tracing: Cleanup code by removing init "char *name" The pointer is assigned to "type->name" anyway. no need to initialize with "preemption". Link: https://lkml.kernel.org/r/20220513075221.26275-1-liqiong@nfschina.com Signed-off-by: liqiong Signed-off-by: Steven Rostedt (Google) commit 2d601b98643dd2846e2958d931826e7b7af44969 Author: liqiong Date: Thu May 12 22:32:30 2022 +0800 tracing: Change "char *" string form to "char []" The "char []" string form declares a single variable. It is better than "char *" which creates two variables in the final assembly. Link: https://lkml.kernel.org/r/20220512143230.28796-1-liqiong@nfschina.com Signed-off-by: liqiong Signed-off-by: Steven Rostedt (Google) commit 9c556e5a4dd5cfc0939a0575577d0517118f98af Author: Daniel Bristot de Oliveira Date: Tue May 10 11:45:25 2022 +0200 tracing/timerlat: Do not wakeup the thread if the trace stops at the IRQ There is no need to wakeup the timerlat/ thread if stop tracing is hit at the timerlat's IRQ handler. Return before waking up timerlat's thread. Link: https://lkml.kernel.org/r/b392356c91b56aedd2b289513cc56a84cf87e60d.1652175637.git.bristot@kernel.org Cc: Juri Lelli Cc: Clark Williams Cc: Ingo Molnar Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4dd2aea24ed7613735664feadc9879d37f718c23 Author: Daniel Bristot de Oliveira Date: Tue May 10 11:45:24 2022 +0200 tracing/timerlat: Print stacktrace in the IRQ handler if needed If print_stack and stop_tracing_us are set, and stop_tracing_us is hit with latency higher than or equal to print_stack, print the stack at the IRQ handler as it is useful to define the root cause for the IRQ latency. Link: https://lkml.kernel.org/r/fd04530ce98ae9270e41bb124ee5bf67b05ecfed.1652175637.git.bristot@kernel.org Cc: Juri Lelli Cc: Clark Williams Cc: Ingo Molnar Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit aa748949b4e665f473bc5abdc5f66029cb5f5522 Author: Daniel Bristot de Oliveira Date: Tue May 10 11:45:23 2022 +0200 tracing/timerlat: Notify IRQ new max latency only if stop tracing is set Currently, the notification of a new max latency is sent from timerlat's IRQ handler anytime a new max latency is found. While this behavior is not wrong, the send IPI overhead itself will increase the thread latency and that is not the desired effect (tracing overhead). Moreover, the thread will notify a new max latency again because the thread latency as it is always higher than the IRQ latency that woke it up. The only case in which it is helpful to notify a new max latency from IRQ is when stop tracing (for the IRQ) is set, as in this case, the thread will not be dispatched. Notify a new max latency from the IRQ handler only if stop tracing is set for the IRQ handler. Link: https://lkml.kernel.org/r/2c2d9a56c0886c8402ba320de32856cbbb10c2bb.1652175637.git.bristot@kernel.org Cc: Juri Lelli Cc: Ingo Molnar Reported-by: Clark Williams Fixes: a955d7eac177 ("trace: Add timerlat tracer") Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 43994049180704fd1faf78623fabd9a5cd443708 Author: Masami Hiramatsu Date: Wed May 4 12:36:31 2022 +0900 kprobes: Fix build errors with CONFIG_KRETPROBES=n Max Filippov reported: When building kernel with CONFIG_KRETPROBES=n kernel/kprobes.c compilation fails with the following messages: kernel/kprobes.c: In function ‘recycle_rp_inst’: kernel/kprobes.c:1273:32: error: implicit declaration of function ‘get_kretprobe’ kernel/kprobes.c: In function ‘kprobe_flush_task’: kernel/kprobes.c:1299:35: error: ‘struct task_struct’ has no member named ‘kretprobe_instances’ This came from the commit d741bf41d7c7 ("kprobes: Remove kretprobe hash") which introduced get_kretprobe() and kretprobe_instances member in task_struct when CONFIG_KRETPROBES=y, but did not make recycle_rp_inst() and kprobe_flush_task() depending on CONFIG_KRETPORBES. Since those functions are only used for kretprobe, move those functions into #ifdef CONFIG_KRETPROBE area. Link: https://lkml.kernel.org/r/165163539094.74407.3838114721073251225.stgit@devnote2 Reported-by: Max Filippov Fixes: d741bf41d7c7 ("kprobes: Remove kretprobe hash") Cc: "Naveen N . Rao" Cc: Anil S Keshavamurthy Cc: "David S . Miller" Cc: Peter Zijlstra Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu Tested-by: Max Filippov Signed-off-by: Steven Rostedt (Google) commit b27f266f74fbda4ee36c2b2b04d15992860cf23b Author: Wonhyuk Yang Date: Tue May 3 14:05:46 2022 +0900 tracing: Fix return value of trace_pid_write() Setting set_event_pid with trailing whitespace lead to endless write system calls like below. $ strace echo "123 " > /sys/kernel/debug/tracing/set_event_pid execve("/usr/bin/echo", ["echo", "123 "], ...) = 0 ... write(1, "123 \n", 5) = 4 write(1, "\n", 1) = 0 write(1, "\n", 1) = 0 write(1, "\n", 1) = 0 write(1, "\n", 1) = 0 write(1, "\n", 1) = 0 .... This is because, the result of trace_get_user's are not returned when it read at least one pid. To fix it, update read variable even if parser->idx == 0. The result of applied patch is below. $ strace echo "123 " > /sys/kernel/debug/tracing/set_event_pid execve("/usr/bin/echo", ["echo", "123 "], ...) = 0 ... write(1, "123 \n", 5) = 5 close(1) = 0 Link: https://lkml.kernel.org/r/20220503050546.288911-1-vvghjk1234@gmail.com Cc: Ingo Molnar Cc: Baik Song An Cc: Hong Yeon Kim Cc: Taeung Song Cc: linuxgeek@linuxgeek.io Cc: stable@vger.kernel.org Fixes: 4909010788640 ("tracing: Add set_event_pid directory for future use") Signed-off-by: Wonhyuk Yang Signed-off-by: Steven Rostedt (Google) commit 99696a2592bca641eb88cc9a80c90e591afebd0f Author: Keita Suzuki Date: Mon Apr 25 06:37:38 2022 +0000 tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref(). Link: https://lkml.kernel.org/r/20220425063739.3859998-1-keitasuzuki.park@sslab.ics.keio.ac.jp Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") CC: stable@vger.kernel.org Reviewed-by: Masami Hiramatsu Reviewed-by: Tom Zanussi Signed-off-by: Keita Suzuki Signed-off-by: Steven Rostedt (Google) commit cb24693d94ceaf658944ad2e922203c0503775d2 Author: Yuntao Wang Date: Fri Jan 21 09:56:23 2022 +0000 tracing: Use strim() to remove whitespace instead of doing it manually The tracing_set_trace_write() function just removes the trailing whitespace from the user supplied tracer name, but the leading whitespace should also be removed. In addition, if the user supplied tracer name contains only a few whitespace characters, the first one will not be removed using the current method, which results it a single whitespace character left in the buf. To fix all of these issues, we use strim() to correctly remove both the leading and trailing whitespace. Link: https://lkml.kernel.org/r/20220121095623.1826679-1-ytcoode@gmail.com Signed-off-by: Yuntao Wang Signed-off-by: Steven Rostedt (Google) commit 2889c658b2fbc7ad4c5d541734fdc1d97b130753 Author: Yuntao Wang Date: Thu Jan 20 06:59:49 2022 +0000 ftrace: Deal with error return code of the ftrace_process_locs() function The ftrace_process_locs() function may return -ENOMEM error code, which should be handled by the callers. Link: https://lkml.kernel.org/r/20220120065949.1813231-1-ytcoode@gmail.com Signed-off-by: Yuntao Wang Signed-off-by: Steven Rostedt (Google) commit e4931b824a6f36cae9cc5632709f015cfa748a25 Author: Yuntao Wang Date: Fri Jan 14 21:10:52 2022 +0800 tracing: Use trace_create_file() to simplify creation of tracefs entries Creating tracefs entries with tracefs_create_file() followed by pr_warn() is tedious and repetitive, we can use trace_create_file() to simplify this process and make the code more readable. Link: https://lkml.kernel.org/r/20220114131052.534382-1-ytcoode@gmail.com Acked-by: Masami Hiramatsu (Google) Signed-off-by: Yuntao Wang Signed-off-by: Steven Rostedt (Google) commit efc2efeba169ff37bbd425631985064365c614e0 Author: Darrick J. Wong Date: Fri May 27 10:34:04 2022 +1000 xfs: move xfs_attr_use_log_assist usage out of libxfs The LARP patchset added an awkward coupling point between libxfs and what would be libxlog, if the XFS log were actually its own library. Move the code that sets up logged xattr updates out of libxfs and into xfs_xattr.c so that libxfs no longer has to know about xlog_* functions. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit d9c61ccb3b09d8f892cccbf662ce0c870f8e4ade Author: Darrick J. Wong Date: Fri May 27 10:33:29 2022 +1000 xfs: move xfs_attr_use_log_assist out of xfs_log.c The LARP patchset added an awkward coupling point between libxfs and what would be libxlog, if the XFS log were actually its own library. Move the code that enables logged xattr updates out of "lib"xlog and into xfs_xattr.c so that it no longer has to know about xlog_* functions. While we're at it, give xfs_xattr.c its own header file. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 202865cc215d135762ea99abda7d87925b1cfc7a Author: Darrick J. Wong Date: Fri May 27 10:32:07 2022 +1000 xfs: warn about LARP once per mount Since LARP is an experimental debug-only feature, we should try to warn about it being in use once per mount, not once per reboot. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit df5660cf63bbafb5a1250954b91d9ec26558536f Author: Darrick J. Wong Date: Fri May 27 10:31:34 2022 +1000 xfs: implement per-mount warnings for scrub and shrink usage Currently, we don't have a consistent story around logging when an EXPERIMENTAL feature gets turned on at runtime -- online fsck and shrink log a message once per day across all mounts, and the recently merged LARP mode only ever does it once per insmod cycle or reboot. Because EXPERIMENTAL tags are supposed to go away eventually, convert the existing daily warnings into state flags that travel with the mount, and warn once per mount. Making this an opstate flag means that we'll be able to capture the experimental usage in the ftrace output too. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 374037966d661d62139a8b6fd33f42fc2038a1e6 Author: Darrick J. Wong Date: Fri May 27 10:29:51 2022 +1000 xfs: don't log every time we clear the log incompat flags There's no need to spam the logs every time we clear the log incompat flags -- if someone is periodically using one of these features, they'll be cleared every time the log tries to clean itself, which can get pretty chatty: $ dmesg | grep -i clear [ 5363.894711] XFS (sdd): Clearing log incompat feature flags. [ 5365.157516] XFS (sdd): Clearing log incompat feature flags. [ 5369.388543] XFS (sdd): Clearing log incompat feature flags. [ 5371.281246] XFS (sdd): Clearing log incompat feature flags. These aren't high value messages either -- nothing's gone wrong, and nobody's trying anything tricky. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 7f50d4dfe816dd916a7cbf39039674825c2b388b Merge: ba62a537b48d7 83da38d82b2f7 Author: Linus Torvalds Date: Thu May 26 17:27:49 2022 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: - A few sparse warning fixups and other cleanups I noticed when working on a recent TLB bug found on a new OpenRISC core bring up. - A few fixup's from me and Jason A Donenfeld to help shutdown OpenRISC platforms when running CI tests * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Allow power off handler overriding openrisc: Remove unused IMMU tlb workardound openrisc/fault: Fix symbol scope warnings openrisc/delay: Add include to fix symbol not declared warning openrisc/time: Fix symbol scope warnings openrisc/traps: Declare unhandled_exception for asmlinkage openrisc/traps: Remove die_if_kernel function openrisc/traps: Declare file scope symbols as static openrisc: Update litex defconfig to support glibc userland openrisc: Pretty print show_registers memory dumps openrisc: Add syscall details to emergency syscall debugging openrisc: Add support for liteuart emergency printing openrisc: Cleanup emergency print handling openrisc: Add gcc machine instruction flag configuration openrisc: define nop command for simulator reboot openrisc: remove bogus nops and shutdowns openrisc: fix typos in comments commit 910bbdf2f4d7df46781bc9b723048f5ebed3d0d7 Author: Darrick J. Wong Date: Fri May 27 10:27:19 2022 +1000 xfs: convert buf_cancel_table allocation to kmalloc_array While we're messing around with how recovery allocates and frees the buffer cancellation table, convert the allocation to use kmalloc_array instead of the old kmem_alloc APIs, and make it handle a null return, even though that's not likely. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 8db074bd84df5ccc88bff3f8f900f66f4b8349fa Author: Darrick J. Wong Date: Fri May 27 10:26:38 2022 +1000 xfs: don't leak xfs_buf_cancel structures when recovery fails If log recovery fails, we free the memory used by the buffer cancellation buckets, but we don't actually traverse each bucket list to free the individual xfs_buf_cancel objects. This leads to a memory leak, as reported by kmemleak in xfs/051: unreferenced object 0xffff888103629560 (size 32): comm "mount", pid 687045, jiffies 4296935916 (age 10.752s) hex dump (first 32 bytes): 08 d3 0a 01 00 00 00 00 08 00 00 00 01 00 00 00 ................ d0 f5 0b 92 81 88 ff ff 80 64 64 25 81 88 ff ff .........dd%.... backtrace: [] kmem_alloc+0x73/0x140 [xfs] [] xlog_recover_buf_commit_pass1+0x139/0x200 [xfs] [] xlog_recover_commit_trans+0x307/0x350 [xfs] [] xlog_recovery_process_trans+0xa5/0xe0 [xfs] [] xlog_recover_process_data+0x8d/0x140 [xfs] [] xlog_do_recovery_pass+0x19d/0x740 [xfs] [] xlog_do_log_recovery+0x6d/0x150 [xfs] [] xlog_do_recover+0x33/0x1d0 [xfs] [] xlog_recover+0xda/0x190 [xfs] [] xfs_log_mount+0x14c/0x360 [xfs] [] xfs_mountfs+0x50d/0xa60 [xfs] [] xfs_fs_fill_super+0x6a5/0x950 [xfs] [] get_tree_bdev+0x175/0x280 [] vfs_get_tree+0x1a/0x80 [] path_mount+0x6ff/0xaa0 [] __x64_sys_mount+0x103/0x140 Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 2723234923b3294dbcf6019c288c87465e927ed4 Author: Darrick J. Wong Date: Fri May 27 10:26:17 2022 +1000 xfs: refactor buffer cancellation table allocation Move the code that allocates and frees the buffer cancellation tables used by log recovery into the file that actually uses the tables. This is a precursor to some cleanups and a memory leak fix. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit ba62a537b48d7ae60524000efe01c9e76e2a5b2d Merge: ef98f9cfe20d8 6aa98f6217861 Author: Linus Torvalds Date: Thu May 26 17:24:32 2022 -0700 Merge tag 'arc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: - Basic eBPF support (Sergey) * tag 'arc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: bpf: define uapi for BPF_PROG_TYPE_PERF_EVENT program type ARC: disasm: handle ARCv2 case in kprobe get/set functions ARC: implement syscall tracepoints ARC: enable HAVE_REGS_AND_STACK_ACCESS_API feature commit a54f78def73d847cb060b18c4e4a3d1d26c9ca6d Author: Darrick J. Wong Date: Fri May 27 10:22:56 2022 +1000 xfs: don't leak btree cursor when insrec fails after a split The recent patch to improve btree cycle checking caused a regression when I rebased the in-memory btree branch atop the 5.19 for-next branch, because in-memory short-pointer btrees do not have AG numbers. This produced the following complaint from kmemleak: unreferenced object 0xffff88803d47dde8 (size 264): comm "xfs_io", pid 4889, jiffies 4294906764 (age 24.072s) hex dump (first 32 bytes): 90 4d 0b 0f 80 88 ff ff 00 a0 bd 05 80 88 ff ff .M.............. e0 44 3a a0 ff ff ff ff 00 df 08 06 80 88 ff ff .D:............. backtrace: [] xfbtree_dup_cursor+0x49/0xc0 [xfs] [] xfs_btree_dup_cursor+0x3b/0x200 [xfs] [] __xfs_btree_split+0x6ad/0x820 [xfs] [] xfs_btree_split+0x60/0x110 [xfs] [] xfs_btree_make_block_unfull+0x19a/0x1f0 [xfs] [] xfs_btree_insrec+0x3aa/0x810 [xfs] [] xfs_btree_insert+0xb3/0x240 [xfs] [] xfs_rmap_insert+0x99/0x200 [xfs] [] xfs_rmap_map_shared+0x192/0x5f0 [xfs] [] xfs_rmap_map_raw+0x6b/0x90 [xfs] [] xrep_rmap_stash+0xd5/0x1d0 [xfs] [] xrep_rmap_visit_bmbt+0xa0/0xf0 [xfs] [] xrep_rmap_scan_iext+0x56/0xa0 [xfs] [] xrep_rmap_scan_ifork+0xd8/0x160 [xfs] [] xrep_rmap_scan_inode+0x35/0x80 [xfs] [] xrep_rmap_find_rmaps+0x10e/0x270 [xfs] I noticed that xfs_btree_insrec has a bunch of debug code that return out of the function immediately, without freeing the "new" btree cursor that can be returned when _make_block_unfull calls xfs_btree_split. Fix the error return in this function to free the btree cursor. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 86d40f1e49e9a909d25c35ba01bea80dbcd758cb Author: Darrick J. Wong Date: Fri May 27 10:21:43 2022 +1000 xfs: purge dquots after inode walk fails during quotacheck xfs/434 and xfs/436 have been reporting occasional memory leaks of xfs_dquot objects. These tests themselves were the messenger, not the culprit, since they unload the xfs module, which trips the slub debugging code while tearing down all the xfs slab caches: ============================================================================= BUG xfs_dquot (Tainted: G W ): Objects remaining in xfs_dquot on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Slab 0xffffea000606de00 objects=30 used=5 fp=0xffff888181b78a78 flags=0x17ff80000010200(slab|head|node=0|zone=2|lastcpupid=0xfff) CPU: 0 PID: 3953166 Comm: modprobe Tainted: G W 5.18.0-rc6-djwx #rc6 d5824be9e46a2393677bda868f9b154d917ca6a7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-builder-01.us.oracle.com-4.el7.1 04/01/2014 Since we don't generally rmmod the xfs module between fstests, this means that xfs/434 is really just the canary in the coal mine -- something leaked a dquot, but we don't know who. After days of pounding on fstests with kmemleak enabled, I finally got it to spit this out: unreferenced object 0xffff8880465654c0 (size 536): comm "u10:4", pid 88, jiffies 4294935810 (age 29.512s) hex dump (first 32 bytes): 60 4a 56 46 80 88 ff ff 58 ea e4 5c 80 88 ff ff `JVF....X..\.... 00 e0 52 49 80 88 ff ff 01 00 01 00 00 00 00 00 ..RI............ backtrace: [] xfs_dquot_alloc+0x2c/0x530 [xfs] [] xfs_qm_dqread+0x6f/0x330 [xfs] [] xfs_qm_dqget+0x132/0x4e0 [xfs] [] xfs_qm_quotacheck_dqadjust+0xa0/0x3e0 [xfs] [] xfs_qm_dqusage_adjust+0x35d/0x4f0 [xfs] [] xfs_iwalk_ag_recs+0x348/0x5d0 [xfs] [] xfs_iwalk_run_callbacks+0x273/0x540 [xfs] [] xfs_iwalk_ag+0x5ed/0x890 [xfs] [] xfs_iwalk_ag_work+0xff/0x170 [xfs] [] xfs_pwork_work+0x79/0x130 [xfs] [] process_one_work+0x672/0x1040 [] worker_thread+0x59b/0xec0 [] kthread+0x29e/0x340 [] ret_from_fork+0x1f/0x30 Now we know that quotacheck is at fault, but even this report was canaryish -- it was triggered by xfs/494, which doesn't actually mount any filesystems. (kmemleak can be a little slow to notice leaks, even with fstests repeatedly whacking it to look for them.) Looking at the *previous* fstest, however, showed that the test run before xfs/494 was xfs/117. The tipoff to the problem is in this excerpt from dmesg: XFS (sda4): Quotacheck needed: Please wait. XFS (sda4): Metadata corruption detected at xfs_dinode_verify.part.0+0xdb/0x7b0 [xfs], inode 0x119 dinode XFS (sda4): Unmount and run xfs_repair XFS (sda4): First 128 bytes of corrupted metadata buffer: 00000000: 49 4e 81 a4 03 02 00 00 00 00 00 00 00 00 00 00 IN.............. 00000010: 00 00 00 01 00 00 00 00 00 90 57 54 54 1a 4c 68 ..........WTT.Lh 00000020: 81 f9 7d e1 6d ee 16 00 34 bd 7d e1 6d ee 16 00 ..}.m...4.}.m... 00000030: 34 bd 7d e1 6d ee 16 00 00 00 00 00 00 00 00 00 4.}.m........... 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 02 00 00 00 00 00 00 00 00 96 80 f3 ab ................ 00000060: ff ff ff ff da 57 7b 11 00 00 00 00 00 00 00 03 .....W{......... 00000070: 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 08 ................ XFS (sda4): Quotacheck: Unsuccessful (Error -117): Disabling quotas. The dinode verifier decided that the inode was corrupt, which causes iget to return with EFSCORRUPTED. Since this happened during quotacheck, it is obvious that the kernel aborted the inode walk on account of the corruption error and disabled quotas. Unfortunately, we neglect to purge the dquot cache before doing that, which is how the dquots leaked. The problems started 10 years ago in commit b84a3a, when the dquot lists were converted to a radix tree, but the error handling behavior was not correctly preserved -- in that commit, if the bulkstat failed and usrquota was enabled, the bulkstat failure code would be overwritten by the result of flushing all the dquots to disk. As long as that succeeds, we'd continue the quota mount as if everything were ok, but instead we're now operating with a corrupt inode and incorrect quota usage counts. I didn't notice this bug in 2019 when I wrote commit ebd126a, which changed quotacheck to skip the dqflush when the scan doesn't complete due to inode walk failures. Introduced-by: b84a3a96751f ("xfs: remove the per-filesystem list of dquots") Fixes: ebd126a651f8 ("xfs: convert quotacheck to use the new iwalk functions") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 56486f307100e8fc66efa2ebd8a71941fa10bf6f Author: Dave Chinner Date: Fri May 27 10:21:09 2022 +1000 xfs: assert in xfs_btree_del_cursor should take into account error xfs/538 on a 1kB block filesystem failed with this assert: XFS: Assertion failed: cur->bc_btnum != XFS_BTNUM_BMAP || cur->bc_ino.allocated == 0 || xfs_is_shutdown(cur->bc_mp), file: fs/xfs/libxfs/xfs_btree.c, line: 448 The problem was that an allocation failed unexpectedly in xfs_bmbt_alloc_block() after roughly 150,000 minlen allocation error injections, resulting in an EFSCORRUPTED error being returned to xfs_bmapi_write(). The error occurred on extent-to-btree format conversion allocating the new root block: RIP: 0010:xfs_bmbt_alloc_block+0x177/0x210 Call Trace: xfs_btree_new_iroot+0xdf/0x520 xfs_btree_make_block_unfull+0x10d/0x1c0 xfs_btree_insrec+0x364/0x790 xfs_btree_insert+0xaa/0x210 xfs_bmap_add_extent_hole_real+0x1fe/0x9a0 xfs_bmapi_allocate+0x34c/0x420 xfs_bmapi_write+0x53c/0x9c0 xfs_alloc_file_space+0xee/0x320 xfs_file_fallocate+0x36b/0x450 vfs_fallocate+0x148/0x340 __x64_sys_fallocate+0x3c/0x70 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa Why the allocation failed at this point is unknown, but is likely that we ran the transaction out of reserved space and filesystem out of space with bmbt blocks because of all the minlen allocations being done causing worst case fragmentation of a large allocation. Regardless of the cause, we've then called xfs_bmapi_finish() which calls xfs_btree_del_cursor(cur, error) to tear down the cursor. So we have a failed operation, error != 0, cur->bc_ino.allocated > 0 and the filesystem is still up. The assert fails to take into account that allocation can fail with an error and the transaction teardown will shut the filesystem down if necessary. i.e. the assert needs to check "|| error != 0" as well, because at this point shutdown is pending because the current transaction is dirty.... Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 5b55cbc2d72632e874e50d2e36bce608e55aaaea Author: Dave Chinner Date: Fri May 27 10:21:04 2022 +1000 xfs: don't assert fail on perag references on teardown Not fatal, the assert is there to catch developer attention. I'm seeing this occasionally during recoveryloop testing after a shutdown, and I don't want this to stop an overnight recoveryloop run as it is currently doing. Convert the ASSERT to a XFS_IS_CORRUPT() check so it will dump a corruption report into the log and cause a test failure that way, but it won't stop the machine dead. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 5672225e8f2a872a22b0cecedba7a6644af1fb84 Author: Dave Chinner Date: Fri May 27 10:20:45 2022 +1000 xfs: avoid unnecessary runtime sibling pointer endian conversions Commit dc04db2aa7c9 has caused a small aim7 regression, showing a small increase in CPU usage in __xfs_btree_check_sblock() as a result of the extra checking. This is likely due to the endian conversion of the sibling poitners being unconditional instead of relying on the compiler to endian convert the NULL pointer at compile time and avoiding the runtime conversion for this common case. Rework the checks so that endian conversion of the sibling pointers is only done if they are not null as the original code did. .... and these need to be "inline" because the compiler completely fails to inline them automatically like it should be doing. $ size fs/xfs/libxfs/xfs_btree.o* text data bss dec hex filename 51874 240 0 52114 cb92 fs/xfs/libxfs/xfs_btree.o.orig 51562 240 0 51802 ca5a fs/xfs/libxfs/xfs_btree.o.inline Just when you think the tools have advanced sufficiently we don't have to care about stuff like this anymore, along comes a reminder that *our tools still suck*. Fixes: dc04db2aa7c9 ("xfs: detect self referencing btree sibling pointers") Reported-by: kernel test robot Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit ef98f9cfe20d8ca063365d46d4ab2b85eeeb324f Merge: 44d35720c9a66 7390b94a3c2d9 Author: Linus Torvalds Date: Thu May 26 17:13:43 2022 -0700 Merge tag 'modules-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules updates from Luis Chamberlain: - It was time to tidy up kernel/module.c and one way of starting with that effort was to split it up into files. At my request Aaron Tomlin spearheaded that effort with the goal to not introduce any functional at all during that endeavour. The penalty for the split is +1322 bytes total, +112 bytes in data, +1210 bytes in text while bss is unchanged. One of the benefits of this other than helping make the code easier to read and review is summoning more help on review for changes with livepatching so kernel/module/livepatch.c is now pegged as maintained by the live patching folks. The before and after with just the move on a defconfig on x86-64: $ size kernel/module.o text data bss dec hex filename 38434 4540 104 43078 a846 kernel/module.o $ size -t kernel/module/*.o text data bss dec hex filename 4785 120 0 4905 1329 kernel/module/kallsyms.o 28577 4416 104 33097 8149 kernel/module/main.o 1158 8 0 1166 48e kernel/module/procfs.o 902 108 0 1010 3f2 kernel/module/strict_rwx.o 3390 0 0 3390 d3e kernel/module/sysfs.o 832 0 0 832 340 kernel/module/tree_lookup.o 39644 4652 104 44400 ad70 (TOTALS) - Aaron added module unload taint tracking (MODULE_UNLOAD_TAINT_TRACKING), to enable tracking unloaded modules which did taint the kernel. - Christophe Leroy added CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOC which lets architectures to request having modules data in vmalloc area instead of module area. There are three reasons why an architecture might want this: a) On some architectures (like book3s/32) it is not possible to protect against execution on a page basis. The exec stuff can be mapped by different arch segment sizes (on book3s/32 that is 256M segments). By default the module area is in an Exec segment while vmalloc area is in a NoExec segment. Using vmalloc lets you muck with module data as NoExec on those architectures whereas before you could not. b) By pushing more module data to vmalloc you also increase the probability of module text to remain within a closer distance from kernel core text and this reduces trampolines, this has been reported on arm first and powerpc folks are following that lead. c) Free'ing module_alloc() (Exec by default) area leaves this exposed as Exec by default, some architectures have some security enhancements to set this as NoExec on free, and splitting module data with text let's future generic special allocators be added to the kernel without having developers try to grok the tribal knowledge per arch. Work like Rick Edgecombe's permission vmalloc interface [0] becomes easier to address over time. [0] https://lore.kernel.org/lkml/20201120202426.18009-1-rick.p.edgecombe@intel.com/#r - Masahiro Yamada's symbol search enhancements * tag 'modules-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: (33 commits) module: merge check_exported_symbol() into find_exported_symbol_in_section() module: do not binary-search in __ksymtab_gpl if fsa->gplok is false module: do not pass opaque pointer for symbol search module: show disallowed symbol name for inherit_taint() module: fix [e_shstrndx].sh_size=0 OOB access module: Introduce module unload taint tracking module: Move module_assert_mutex_or_preempt() to internal.h module: Make module_flags_taint() accept a module's taints bitmap and usable outside core code module.h: simplify MODULE_IMPORT_NS powerpc: Select ARCH_WANTS_MODULES_DATA_IN_VMALLOC on book3s/32 and 8xx module: Remove module_addr_min and module_addr_max module: Add CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOC module: Introduce data_layout module: Prepare for handling several RB trees module: Always have struct mod_tree_root module: Rename debug_align() as strict_align() module: Rework layout alignment to avoid BUG_ON()s module: Move module_enable_x() and frob_text() in strict_rwx.c module: Make module_enable_x() independent of CONFIG_ARCH_HAS_STRICT_MODULE_RWX module: Move version support into a separate file ... commit 44d35720c9a660074b77ab9de37abf2c01c5b44f Merge: cdeffe87f790d 494dcdf46e5cd Author: Linus Torvalds Date: Thu May 26 16:57:20 2022 -0700 Merge tag 'sysctl-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "For two kernel releases now kernel/sysctl.c has been being cleaned up slowly, since the tables were grossly long, sprinkled with tons of #ifdefs and all this caused merge conflicts with one susbystem or another. This tree was put together to help try to avoid conflicts with these cleanups going on different trees at time. So nothing exciting on this pull request, just cleanups. Thanks a lot to the Uniontech and Huawei folks for doing some of this nasty work" * tag 'sysctl-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: (28 commits) sched: Fix build warning without CONFIG_SYSCTL reboot: Fix build warning without CONFIG_SYSCTL kernel/kexec_core: move kexec_core sysctls into its own file sysctl: minor cleanup in new_dir() ftrace: fix building with SYSCTL=y but DYNAMIC_FTRACE=n fs/proc: Introduce list_for_each_table_entry for proc sysctl mm: fix unused variable kernel warning when SYSCTL=n latencytop: move sysctl to its own file ftrace: fix building with SYSCTL=n but DYNAMIC_FTRACE=y ftrace: Fix build warning ftrace: move sysctl_ftrace_enabled to ftrace.c kernel/do_mount_initrd: move real_root_dev sysctls to its own file kernel/delayacct: move delayacct sysctls to its own file kernel/acct: move acct sysctls to its own file kernel/panic: move panic sysctls to its own file kernel/lockdep: move lockdep sysctls to its own file mm: move page-writeback sysctls to their own file mm: move oom_kill sysctls to their own file kernel/reboot: move reboot sysctls to its own file sched: Move energy_aware sysctls to topology.c ... commit cdeffe87f790dfd1baa193020411ce9a538446d7 Merge: 7182e897695d5 79f9fbe303520 Author: Linus Torvalds Date: Thu May 26 14:57:25 2022 -0700 Merge tag 'mailbox-v5.19' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: "api: - hrtimer fix qcom: - log pending irq during resume - minor cosmetic changes omap: - use pm_runtime_resume_and_get imx: - use pm_runtime_resume_and_get - remove redundant initializer mtk: - added GCE header for MT8186 - enable support for MT8186 tegra: - remove redundant NULL check - added hsp_sm_ops for send/recv api - support shared mailboxes stm: - remove unsupported "wakeup" irq pcc: - sanitize mbox allocated memory before use misc: - documentation fixes for arm_mhu and qcom-ipcc" * tag 'mailbox-v5.19' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n mailbox: forward the hrtimer if not queued and under a lock mailbox: qcom-ipcc: Log the pending interrupt during resume mailbox: pcc: Fix an invalid-load caught by the address sanitizer dt-bindings: mailbox: remove the IPCC "wakeup" IRQ mailbox: correct kerneldoc mailbox: omap: using pm_runtime_resume_and_get to simplify the code mailbox:imx: using pm_runtime_resume_and_get mailbox: mediatek: support mt8186 adsp mailbox dt-bindings: mailbox: mtk,adsp-mbox: add mt8186 compatible name mailbox: tegra-hsp: Add 128-bit shared mailbox support dt-bindings: tegra186-hsp: add type for shared mailboxes mailbox: tegra-hsp: Add tegra_hsp_sm_ops dt-bindings: gce: add the GCE header file for MT8186 mailbox: remove an unneeded NULL check on list iterator mailbox: imx: remove redundant initializer dt-bindings: mailbox: qcom-ipcc: simplify the example commit 7182e897695d5b70fb772736f1f08639ca0fff78 Merge: f1f88bb51f1ae 5a7cb9f3978d1 Author: Linus Torvalds Date: Thu May 26 14:51:38 2022 -0700 Merge tag 'gpio-updates-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We have lots of small changes all over the place, but no huge reworks or new drivers: - use ioread()/iowrite() interfaces instead of raw inb()/outb() in drivers - make irqchips immutable due to the new warning popping up when drivers try to modify the irqchip structures - add new compatibles to dt-bindings for realtek-otto, renesas-rcar and pca95xx - add support for new models to gpio-rcar, gpio-pca953x & gpio-realtek-otto - allow parsing of GPIO hogs represented as children nodes of gpio-uniphier - define a set of common GPIO consumer strings in dt-bindings - shrink code in gpio-ml-ioh by using more devres interfaces - pass arguments to devm_kcalloc() in correct order in gpio-sim - add new helpers for iterating over GPIO firmware nodes and descriptors to gpiolib core and use it in several drivers - drop unused syscon_regmap_lookup_by_compatible() function - correct format specifiers and signedness of variables in GPIO ACPI - drop unneeded error checks in gpio-ftgpio - stop using the deprecated of_gpio.h header in gpio-zevio - drop platform_data support in gpio-max732x - simplify Kconfig dependencies in gpio-vf610 - use raw spinlocks where needed to make PREEMPT_RT happy - fix return values in board files using gpio-pcf857x - convert more drivers to using fwnode instead of of_node - minor fixes and improvements in gpiolib core" * tag 'gpio-updates-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (55 commits) gpio: sifive: Make the irqchip immutable gpio: rcar: Make the irqchip immutable gpio: pcf857x: Make the irqchip immutable gpio: pca953x: Make the irqchip immutable gpio: dwapb: Make the irqchip immutable gpio: sim: Use correct order for the parameters of devm_kcalloc() gpio: ml-ioh: Convert to use managed functions pcim* and devm_* gpio: ftgpio: Remove unneeded ERROR check before clk_disable_unprepare gpio: ws16c48: Utilize iomap interface gpio: gpio-mm: Utilize iomap interface gpio: 104-idio-16: Utilize iomap interface gpio: 104-idi-48: Utilize iomap interface gpio: 104-dio-48e: Utilize iomap interface gpio: zevio: drop of_gpio.h header gpio: max77620: Make the irqchip immutable dt-bindings: gpio: pca95xx: add entry for pca6408 gpio: pca953xx: Add support for pca6408 gpio: max732x: Drop unused support for irq and setup code via platform data gpio: vf610: drop the SOC_VF610 dependency for GPIO_VF610 gpio: syscon: Remove usage of syscon_regmap_lookup_by_compatible ... commit f1f88bb51f1ae9d7eec9ef871355dea033bac02d Merge: b1c8312c6bd70 abd4fd43f2af0 Author: Linus Torvalds Date: Thu May 26 14:46:01 2022 -0700 Merge tag 'tag-chrome-platform-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "cros_ec: - Fix wrong error handling path - Clean-up patches cros_ec_chardev: - Re-introduce cros_ec_cmd_xfer to fix ABI broken cros_ec_lpcs: - Support the Framework Laptop cros_ec_typec: - Fix NULL dereference chromeos_acpi: - Add ChromeOS ACPI device driver - Fix Sphinx errors when `make htmldocs` misc: - Drop BUG_ON()s" * tag 'tag-chrome-platform-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: Use imperative mood for ChromeOS ACPI sysfs ABI descriptions platform/chrome: Use tables for values lists of ChromeOS ACPI sysfs ABI platform/chrome: cros_ec_spi: drop BUG_ON() if `din` isn't large enough platform/chrome: cros_ec_spi: drop unneeded BUG_ON() platform/chrome: cros_ec_i2c: drop BUG_ON() in cros_ec_pkt_xfer_i2c() platform/chrome: cros_ec_proto: drop BUG_ON() in cros_ec_get_host_event() platform/chrome: cros_ec_proto: drop BUG_ON() in cros_ec_prepare_tx() platform/chrome: correct cros_ec_prepare_tx() usage platform/chrome: cros_ec_proto: drop unneeded BUG_ON() in prepare_packet() platform/chrome: Add ChromeOS ACPI device driver platform/chrome: cros_ec_typec: Check for EC driver platform/chrome: cros_ec_lpcs: reserve the MEC LPC I/O ports first platform/chrome: cros_ec_lpcs: detect the Framework Laptop platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls platform/chrome: cros_ec: append newline to all logs platform/chrome: cros_ec: sort header inclusion alphabetically platform/chrome: cros_ec: determine `wake_enabled` in cros_ec_suspend() platform/chrome: cros_ec: remove unused variable `was_wake_device` platform/chrome: cros_ec: fix error handling in cros_ec_register() commit 4e2bbecd71d9c01e70ec184791b9594978735b5d Merge: 324373f476936 d9e418d0ca1c4 Author: Palmer Dabbelt Date: Thu May 26 14:35:07 2022 -0700 RISC-V: Various XIP fixes This fixes a handful of issues with the XIP support, which has bit rotted some lately. * palmer/riscv-xip: RISC-V: Fix the XIP build RISC-V: Split out the XIP fixups into their own file RISC-V: ignore xipImage RISC-V: Avoid empty create_*_mapping definitions commit b1c8312c6bd70e2c41f96183936fdb6f4f07cc0e Author: Sean Young Date: Thu May 26 08:59:40 2022 +0100 media: lirc: add missing exceptions for lirc uapi header file Commit e5499dd7253c ("media: lirc: revert removal of unused feature flags") reintroduced unused feature flags in the lirc uapi header, but failed to reintroduce the necessary exceptions for the docs. Fixes: e5499dd7253c ("media: lirc: revert removal of unused feature flags") Signed-off-by: Sean Young Signed-off-by: Linus Torvalds commit bf9095424d027e942e1d1ee74977e17b7df8e455 Merge: 98931dd95fd48 ffd1925a596ce Author: Linus Torvalds Date: Thu May 26 14:20:14 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "S390: - ultravisor communication device driver - fix TEID on terminating storage key ops RISC-V: - Added Sv57x4 support for G-stage page table - Added range based local HFENCE functions - Added remote HFENCE functions based on VCPU requests - Added ISA extension registers in ONE_REG interface - Updated KVM RISC-V maintainers entry to cover selftests support ARM: - Add support for the ARMv8.6 WFxT extension - Guard pages for the EL2 stacks - Trap and emulate AArch32 ID registers to hide unsupported features - Ability to select and save/restore the set of hypercalls exposed to the guest - Support for PSCI-initiated suspend in collaboration with userspace - GICv3 register-based LPI invalidation support - Move host PMU event merging into the vcpu data structure - GICv3 ITS save/restore fixes - The usual set of small-scale cleanups and fixes x86: - New ioctls to get/set TSC frequency for a whole VM - Allow userspace to opt out of hypercall patching - Only do MSR filtering for MSRs accessed by rdmsr/wrmsr AMD SEV improvements: - Add KVM_EXIT_SHUTDOWN metadata for SEV-ES - V_TSC_AUX support Nested virtualization improvements for AMD: - Support for "nested nested" optimizations (nested vVMLOAD/VMSAVE, nested vGIF) - Allow AVIC to co-exist with a nested guest running - Fixes for LBR virtualizations when a nested guest is running, and nested LBR virtualization support - PAUSE filtering for nested hypervisors Guest support: - Decoupling of vcpu_is_preempted from PV spinlocks" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (199 commits) KVM: x86: Fix the intel_pt PMI handling wrongly considered from guest KVM: selftests: x86: Sync the new name of the test case to .gitignore Documentation: kvm: reorder ARM-specific section about KVM_SYSTEM_EVENT_SUSPEND x86, kvm: use correct GFP flags for preemption disabled KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer x86/kvm: Alloc dummy async #PF token outside of raw spinlock KVM: x86: avoid calling x86 emulator without a decoded instruction KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave) s390/uv_uapi: depend on CONFIG_S390 KVM: selftests: x86: Fix test failure on arch lbr capable platforms KVM: LAPIC: Trace LAPIC timer expiration on every vmentry KVM: s390: selftest: Test suppression indication on key prot exception KVM: s390: Don't indicate suppression on dirtying, failing memop selftests: drivers/s390x: Add uvdevice tests drivers/s390/char: Add Ultravisor io device MAINTAINERS: Update KVM RISC-V entry to cover selftests support RISC-V: KVM: Introduce ISA extension register RISC-V: KVM: Cleanup stale TLB entries when host CPU changes RISC-V: KVM: Add remote HFENCE functions based on VCPU requests ... commit 558254b0b602b8605d7246a10cfeb584b1fcabfc Author: Phil Sutter Date: Tue May 24 14:50:01 2022 +0200 netfilter: nft_limit: Clone packet limits' cost value When cloning a packet-based limit expression, copy the cost value as well. Otherwise the new limit is not functional anymore. Fixes: 3b9e2ea6c11bf ("netfilter: nft_limit: move stateful fields out of expression data") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 520778042ccca019f3ffa136dd0ca565c486cedd Author: Pablo Neira Ayuso Date: Wed May 25 10:36:38 2022 +0200 netfilter: nf_tables: disallow non-stateful expression in sets earlier Since 3e135cd499bf ("netfilter: nft_dynset: dynamic stateful expression instantiation"), it is possible to attach stateful expressions to set elements. cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase") introduces conditional destruction on the object to accomodate transaction semantics. nft_expr_init() calls expr->ops->init() first, then check for NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful lookup expressions which points to a set, which might lead to UAF since the set is not properly detached from the set->binding for this case. Anyway, this combination is non-sense from nf_tables perspective. This patch fixes this problem by checking for NFT_STATEFUL_EXPR before expr->ops->init() is called. The reporter provides a KASAN splat and a poc reproducer (similar to those autogenerated by syzbot to report use-after-free errors). It is unknown to me if they are using syzbot or if they use similar automated tool to locate the bug that they are reporting. For the record, this is the KASAN splat. [ 85.431824] ================================================================== [ 85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20 [ 85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776 [ 85.434756] [ 85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G W 5.18.0+ #2 [ 85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Fixes: 0b2d8a7b638b ("netfilter: nf_tables: add helper functions for expression handling") Reported-and-tested-by: Aaron Adams Signed-off-by: Pablo Neira Ayuso commit 98931dd95fd489fcbfa97da563505a6f071d7c77 Merge: df202b452fe6c f403f22f8ccb1 Author: Linus Torvalds Date: Thu May 26 12:32:41 2022 -0700 Merge tag 'mm-stable-2022-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "Almost all of MM here. A few things are still getting finished off, reviewed, etc. - Yang Shi has improved the behaviour of khugepaged collapsing of readonly file-backed transparent hugepages. - Johannes Weiner has arranged for zswap memory use to be tracked and managed on a per-cgroup basis. - Munchun Song adds a /proc knob ("hugetlb_optimize_vmemmap") for runtime enablement of the recent huge page vmemmap optimization feature. - Baolin Wang contributes a series to fix some issues around hugetlb pagetable invalidation. - Zhenwei Pi has fixed some interactions between hwpoisoned pages and virtualization. - Tong Tiangen has enabled the use of the presently x86-only page_table_check debugging feature on arm64 and riscv. - David Vernet has done some fixup work on the memcg selftests. - Peter Xu has taught userfaultfd to handle write protection faults against shmem- and hugetlbfs-backed files. - More DAMON development from SeongJae Park - adding online tuning of the feature and support for monitoring of fixed virtual address ranges. Also easier discovery of which monitoring operations are available. - Nadav Amit has done some optimization of TLB flushing during mprotect(). - Neil Brown continues to labor away at improving our swap-over-NFS support. - David Hildenbrand has some fixes to anon page COWing versus get_user_pages(). - Peng Liu fixed some errors in the core hugetlb code. - Joao Martins has reduced the amount of memory consumed by device-dax's compound devmaps. - Some cleanups of the arch-specific pagemap code from Anshuman Khandual. - Muchun Song has found and fixed some errors in the TLB flushing of transparent hugepages. - Roman Gushchin has done more work on the memcg selftests. ... and, of course, many smaller fixes and cleanups. Notably, the customary million cleanup serieses from Miaohe Lin" * tag 'mm-stable-2022-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (381 commits) mm: kfence: use PAGE_ALIGNED helper selftests: vm: add the "settings" file with timeout variable selftests: vm: add "test_hmm.sh" to TEST_FILES selftests: vm: check numa_available() before operating "merge_across_nodes" in ksm_tests selftests: vm: add migration to the .gitignore selftests/vm/pkeys: fix typo in comment ksm: fix typo in comment selftests: vm: add process_mrelease tests Revert "mm/vmscan: never demote for memcg reclaim" mm/kfence: print disabling or re-enabling message include/trace/events/percpu.h: cleanup for "percpu: improve percpu_alloc_percpu event trace" include/trace/events/mmflags.h: cleanup for "tracing: incorrect gfp_t conversion" mm: fix a potential infinite loop in start_isolate_page_range() MAINTAINERS: add Muchun as co-maintainer for HugeTLB zram: fix Kconfig dependency warning mm/shmem: fix shmem folio swapoff hang cgroup: fix an error handling path in alloc_pagecache_max_30M() mm: damon: use HPAGE_PMD_SIZE tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate nodemask.h: fix compilation error with GCC12 ... commit dada03db9bb1984826e61cfcf1418ac73848324d Author: Daniel Bristot de Oliveira Date: Fri May 13 08:45:53 2022 +0200 rtla: Remove procps-ng dependency Daniel Wagner reported to me that readproc.h got deprecated. Also, while the procps-ng library was available on Fedora, it was not available on RHEL, which is a piece of evidence that it was not that used. rtla uses procps-ng only to find the PID of the tracers' workload. I used the procps-ng library to avoid reinventing the wheel. But in this case, reinventing the wheel took me less time than the time we already took trying to work around problems. Implement a function that reads /proc/ entries, checking if: - the entry is a directory - the directory name is composed only of digits (PID) - the directory contains the comm file - the comm file contains a comm that matches the tracers' workload prefix. - then return true; otherwise, return false. And use it instead of procps-ng. Link: https://lkml.kernel.org/r/e8276e122ee9eb2c5a0ba8e673fb6488b924b825.1652423574.git.bristot@kernel.org Cc: John Kacur Cc: Steven Rostedt Cc: Tao Zhou Fixes: b1696371d865 ("rtla: Helper functions for rtla") Reported-by: Daniel Wagner Reviewed-by: Daniel Wagner Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 941a53c39a151e9aceef153cdfaed0f166ba01b7 Author: Daniel Bristot de Oliveira Date: Fri Apr 29 18:28:13 2022 +0200 rtla: Fix __set_sched_attr error message rtla's function __set_sched_attr() was borrowed from stalld, but I forgot to update the error message to something meaningful for rtla. Update the error message from: boost_with_deadline failed to boost pid PID: STRERROR to a proper one: Failed to set sched attributes to the pid PID: STRERROR Link: https://lkml.kernel.org/r/a2d19b2c53f6512aefd1ee7f8c1bd19d4fc8b99d.1651247710.git.bristot@kernel.org Link: https://lore.kernel.org/r/eeded730413e7feaa13f946924bcf2cbf7dd9561.1650617571.git.bristot@kernel.org/ Fixes: b1696371d865 ("rtla: Helper functions for rtla") Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 22d146f7c1e97f4870e4497c0202939a031f740c Author: John Kacur Date: Fri Apr 29 18:28:12 2022 +0200 rtla: Minor grammar fix for rtla README - Change to "The rtla meta-tool includes" - Remove an unnecessary "But, " - Adjust the formatting of the paragraph resulting from the changes. - Simplify the wording for the libraries and tools. Link: https://lkml.kernel.org/r/437f0accdde53713ab3cce46f3564be00487e031.1651247710.git.bristot@kernel.org Link: https://lore.kernel.org/r/20220408161012.10544-1-jkacur@redhat.com/ Cc: Daniel Bristot de Oliveria Fixes: 79ce8f43ac5a ("rtla: Real-Time Linux Analysis tool") Acked-by: Daniel Bristot de Oliveira Signed-off-by: John Kacur Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 39c3d84cb5b52792a7323a338334d8d65b2dbe3f Author: John Kacur Date: Fri Apr 29 18:28:11 2022 +0200 rtla: Don't overwrite existing directory mode The mode on /usr/bin is often 555 these days, but make install on rtla overwrites this with 755 Fix this by preserving the current directory if it exists. Link: https://lkml.kernel.org/r/8c294a6961080a1970fd8b73f7bcf1e3984579e2.1651247710.git.bristot@kernel.org Link: https://lore.kernel.org/r/20220402043939.6962-1-jkacur@redhat.com Cc: Daniel Bristot de Oliveria Fixes: 79ce8f43ac5a ("rtla: Real-Time Linux Analysis tool") Acked-by: Daniel Bristot de Oliveira Signed-off-by: John Kacur Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 2a6b52ed72c822b5ee146a6a00ea66614fe02653 Author: Wan Jiabing Date: Fri Apr 29 18:28:10 2022 +0200 rtla: Avoid record NULL pointer dereference Fix the following null/deref_null.cocci errors: ./tools/tracing/rtla/src/osnoise_hist.c:870:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/osnoise_top.c:650:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/timerlat_hist.c:905:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/timerlat_top.c:700:31-36: ERROR: record is NULL but dereferenced. "record" is NULL before calling osnoise_init_trace_tool. Add a tag "out_free" to avoid dereferring a NULL pointer. Link: https://lkml.kernel.org/r/ae0e4500d383db0884eb2820286afe34ca303778.1651247710.git.bristot@kernel.org Link: https://lore.kernel.org/r/20220408151406.34823-1-wanjiabing@vivo.com/ Cc: kael_w@yeah.net Cc: Daniel Bristot de Oliveira Fixes: 51d64c3a1819 ("rtla: Add -e/--event support") Acked-by: Daniel Bristot de Oliveira Signed-off-by: Wan Jiabing Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit fe4d0d5dde457bb5832b866418b5036f4f0c8d13 Author: Daniel Bristot de Oliveira Date: Fri Apr 29 16:54:58 2022 +0200 rtla/Makefile: Properly handle dependencies Linus had a problem compiling RTLA, saying: "[...] I wish the tracing tools would do a bit more package checking and helpful error messages too, rather than just fail with: fatal error: tracefs.h: No such file or directory" Which is indeed not a helpful message. Update the Makefile, adding proper checks for the dependencies, with useful information about how to resolve possible problems. For example, the previous error is now reported as: $ make ******************************************** ** NOTICE: libtracefs version 1.3 or higher not found ** ** Consider installing the latest libtracefs from your ** distribution, e.g., 'dnf install libtracefs' on Fedora, ** or from source: ** ** https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/ ** ******************************************** These messages are inspired by the ones used on trace-cmd, as suggested by Stevel Rostedt. Link: https://lore.kernel.org/r/CAHk-=whxmA86E=csNv76DuxX_wYsg8mW15oUs3XTabu2Yc80yw@mail.gmail.com/ Changes from V1: - Moved the rst2man check to the install phase (when it is used). - Removed the procps-ng lib check [1] as it is being removed. [1] a0f9f8c1030c66305c9b921057c3d483064d5529.1651220820.git.bristot@kernel.org Link: https://lkml.kernel.org/r/3f1fac776c37e4b67c876a94e5a0e45ed022ff3d.1651238057.git.bristot@kernel.org Cc: Ingo Molnar Cc: Andrew Morton Reported-by: Linus Torvalds Suggested-by: Steven Rostedt Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit df202b452fe6c6d6f1351bad485e2367ef1e644e Merge: 16477cdfefdb4 5ce2176b81f77 Author: Linus Torvalds Date: Thu May 26 12:09:50 2022 -0700 Merge tag 'kbuild-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Add HOSTPKG_CONFIG env variable to allow users to override pkg-config - Support W=e as a shorthand for KCFLAGS=-Werror - Fix CONFIG_IKHEADERS build to support toybox cpio - Add scripts/dummy-tools/pahole to ease distro packagers' life - Suppress false-positive warnings from checksyscalls.sh for W=2 build - Factor out the common code of arch/*/boot/install.sh into scripts/install.sh - Support 'kernel-install' tool in scripts/prune-kernel - Refactor module-versioning to link the symbol versions at the final link of vmlinux and modules - Remove CONFIG_MODULE_REL_CRCS because module-versioning now works in an arch-agnostic way - Refactor modpost, Makefiles * tag 'kbuild-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (56 commits) genksyms: adjust the output format to modpost kbuild: stop merging *.symversions kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS modpost: extract symbol versions from *.cmd files modpost: add sym_find_with_module() helper modpost: change the license of EXPORT_SYMBOL to bool type modpost: remove left-over cross_compile declaration kbuild: record symbol versions in *.cmd files kbuild: generate a list of objects in vmlinux modpost: move *.mod.c generation to write_mod_c_files() modpost: merge add_{intree_flag,retpoline,staging_flag} to add_header scripts/prune-kernel: Use kernel-install if available kbuild: factor out the common installation code into scripts/install.sh modpost: split new_symbol() to symbol allocation and hash table addition modpost: make sym_add_exported() always allocate a new symbol modpost: make multiple export error modpost: dump Module.symvers in the same order of modules.order modpost: traverse the namespace_list in order modpost: use doubly linked list for dump_lists modpost: traverse unresolved symbols in order ... commit 9bdc1992c925a35c6f7200e8abe54e3f00ce7719 Author: Christian König Date: Tue May 10 18:29:35 2022 +0200 drm/amdgpu: add drm-client-id to fdinfo v2 This is enough to get gputop working :) v2: rebase and some addition cleanup Signed-off-by: Christian König Reviewed-by: Shashank Sharma (v1) Signed-off-by: Alex Deucher commit af0b541670090e87996e0894bd0e457edf617541 Author: Christian König Date: Wed May 11 11:06:26 2022 +0200 drm/amdgpu: Convert to common fdinfo format v5 Convert fdinfo format to one documented in drm-usage-stats.rst. It turned out that the existing implementation was actually completely nonsense. The calculated percentages indeed represented the usage of the engine, but with varying time slices. So 10% usage for application A could mean something completely different than 10% usage for application B. Completely nuke that and just use the now standardized nanosecond interface. v2: drop the documentation change for now, nuke percentage calculation v3: only account for each hw_ip, move the time_spend to the ctx mgr. v4: move general ctx changes into separate patch, rework the fdinfo to ctx_mgr interface so that all usages are calculated at once, drop some unecessary and dangerous refcount dance. v5: add one more comment how we calculate the time spend Signed-off-by: Tvrtko Ursulin Signed-off-by: Christian König Reviewed-by: Shashank Sharma Cc: Daniel Vetter Signed-off-by: Alex Deucher commit 08cffb3eb731fefd0dea12424cedbfa63c356ee0 Author: Christian König Date: Fri May 6 13:21:28 2022 +0200 drm/amdgpu: bump minor version number Increase the minor version number to indicate that the new flags are available. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher commit b6c65a2c92aa880e8050a91ca83288b85fc32575 Author: Christian König Date: Fri May 6 13:11:41 2022 +0200 drm/amdgpu: add AMDGPU_VM_NOALLOC v2 Add the AMDGPU_VM_NOALLOC flag to let userspace control MALL allocation. v2: also add the flag to the allowed flags. Signed-off-by: Christian König Reviewed-by: Alex Deucher (v1) Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher commit fab2cc8335839867a3db38f195441b9c7c6460f6 Author: Christian König Date: Fri May 6 13:08:34 2022 +0200 drm/amdgpu: add AMDGPU_GEM_CREATE_DISCARDABLE Add a AMDGPU_GEM_CREATE_DISCARDABLE flag to note that the content of a BO doesn't needs to be preserved during eviction. KFD was already using a similar functionality for SVM BOs so replace the internal flag with the new UAPI. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher commit 62e9bd20035b53ff6c679499c08546d96c6c60a7 Author: Alex Deucher Date: Tue May 24 23:23:59 2022 -0400 drm/amdgpu: add beige goby PCI ID Add a beige goby PCI ID. Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 39dbde650f9377f97ad985bfa16af93381766232 Author: Lijo Lazar Date: Tue May 24 17:35:55 2022 +0530 drm/amd/pm: Return auto perf level, if unsupported When powerplay is not enabled, return AUTO as default level. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6bd8d4b7d511f00a9e02f89b250fba3013200843 Author: Julia Lawall Date: Sat May 21 13:11:24 2022 +0200 drm/amdkfd: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Alex Deucher commit ab5a7fb6d2296b9486d17d1e24f4bde90822e644 Author: Julia Lawall Date: Sat May 21 13:11:14 2022 +0200 drm/amdgpu/gfx: fix typos in comments Spelling mistakes (triple letters) in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Alex Deucher commit 31ab27b14daaa75541a415c6794d6f3567fea44a Author: Dave Airlie Date: Mon May 23 10:24:18 2022 +1000 drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Submitting a cs with 0 chunks, causes an oops later, found trying to execute the wrong userspace driver. MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo [172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [172536.665188] #PF: supervisor read access in kernel mode [172536.665189] #PF: error_code(0x0000) - not-present page [172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 [172536.665195] Oops: 0000 [#1] SMP NOPTI [172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS [172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 [172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] [172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 [172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 [172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 [172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 [172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 [172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 [172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 [172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 [172536.665287] Call Trace: [172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] [172536.665338] drm_ioctl+0x201/0x3b0 [drm] [172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665372] ? selinux_file_ioctl+0x135/0x230 [172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] [172536.665403] __x64_sys_ioctl+0x83/0xb0 [172536.665406] do_syscall_64+0x33/0x40 [172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018 Signed-off-by: Dave Airlie Cc: stable@vger.kernel.org Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d534ca7128d7bf681ed6d462c09b9d6ffb3bed91 Author: Alex Deucher Date: Mon May 23 11:24:31 2022 -0400 drm/amdgpu: differentiate between LP and non-LP DDR memory Some applications want to know whether the memory is LP or not. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit a5457087eb10322864dedb7768b7a95332393efe Author: Candice Li Date: Fri May 20 20:51:53 2022 +0800 drm/amdgpu: Resolve pcie_bif RAS recovery bug Check shared buf instead of init flag for xgmi ta shared buf init during xgmi ta initialization. Signed-off-by: Candice Li Reviewed-by: John Clements Signed-off-by: Alex Deucher commit 1c755241463bab5d90404a782abf3baf7b7a3217 Author: Prike Liang Date: Fri May 20 11:04:35 2022 +0800 drm/amdgpu: clean up asd on the ta_firmware_header_v2_0 On the psp13 series use ta_firmware_header_v2_0 and the asd firmware was buildin ta, so needn't request asd firmware separately. Signed-off-by: Prike Liang Reviewed-by: Yifan Zhang Acked-by: Huang Rui Signed-off-by: Alex Deucher commit a0ccc717c4ab3ef572f023fdceffb4b6df496a0d Author: Alex Deucher Date: Mon May 16 14:12:33 2022 -0400 drm/amdgpu/discovery: validate VCN and SDMA instances Validate the VCN and SDMA instances against the driver structure sizes to make sure we don't get into a situation where the firmware reports more instances than the driver supports. Reviewed-by: Guchun Chen Acked-by: Christian König Signed-off-by: Alex Deucher commit 76818cdd11a25ac6cb1d98875719935d8d0e2e51 Author: Sung Joon Kim Date: Thu May 19 17:46:36 2022 -0400 drm/amd/display: add Coverage blend mode for overlay plane According to the KMS man page, there is a "Coverage" alpha blend mode that assumes the pixel color values have NOT been pre-multiplied and will be done when the actual blending to the background color values happens. Previously, this mode hasn't been enabled in our driver and it was assumed that all normal overlay planes are pre-multiplied by default. When a 3rd party app is used to input a image in a specific format, e.g. PNG, as a source of a overlay plane to blend with the background primary plane, the pixel color values are not pre-multiplied. So by adding "Coverage" blend mode, our driver will support those cases. Issue fixed: Overlay plane alpha channel blending is incorrect Issue tracker: https://gitlab.freedesktop.org/drm/amd/-/issues/1769 Reference: https://dri.freedesktop.org/docs/drm/gpu/drm-kms.html#plane-composition-properties Adding Coverage support also enables IGT kms_plane_alpha_blend Coverage subtests: 1. coverage-7efc 2. coverage-vs-premult-vs-constant Changes 1. Add DRM_MODE_BLEND_COVERAGE blend mode capability 2. Add "pre_multiplied_alpha" flag for Coverage case 3. Read the correct flag and set the DCN MPCC pre_multiplied register bit (only on overlay plane) Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1769 Signed-off-by: Sung Joon Kim Reviewed-by: Melissa Wen Signed-off-by: Alex Deucher commit a35faec3db0e13aac8ea720bc1a3503081dd5a3d Author: Dan Carpenter Date: Mon May 16 10:05:48 2022 +0300 drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds access. Fixes: e27c41d5b068 ("drm/amd/display: Support for DMUB HPD interrupt handling") Reviewed-by: Harry Wentland Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit caa5eadc140ca3748b2ae187da36383edc779300 Author: Evan Quan Date: Thu May 19 17:28:12 2022 +0800 drm/amdgpu: suppress some compile warnings Suppress two compile warnings about "no previous prototype". Reported-by: kernel test robot Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 396beb91a9eb86cbfa404e4220cca8f3ada70777 Author: Evan Quan Date: Wed Apr 6 14:14:50 2022 +0800 drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13 Correct the metrics version used for SMU 11.0.11/12/13. Fixes misreported GPU metrics (e.g., fan speed, etc.) depending on which version of SMU firmware is loaded. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1925 Signed-off-by: Evan Quan Signed-off-by: Alex Deucher commit 6a8170383c7acdf6fb8da1f3774fa2bc9191d628 Author: Jay Cornwall Date: Thu Dec 30 21:32:06 2021 +0800 drm/amdkfd: Add gfx11 trap handler Based on gfx10 with following changes: - GPR_ALLOC.VGPR_SIZE field moved (and size corrected in gfx10) - s_sendmsg_rtn_b64 replaces some s_sendmsg/s_getreg - Buffer instructions no longer have direct-to-LDS modifier Signed-off-by: Jay Cornwall Reviewed-by: Laurent Morichetti Signed-off-by: Eric Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 5e613723f804658feb689be1b3cb88ceeed234d3 Author: Eric Huang Date: Mon May 16 14:22:38 2022 -0400 drm/amdkfd: port cwsr trap handler from dkms branch Most of changes are for debugger feature, and it is to simplify trap handler support for new asics in the future. Signed-off-by: Eric Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6880ed280edf292c542aa87567547ffb9c222597 Author: Alan Liu Date: Tue May 17 22:30:00 2022 +0800 drm/amd/display: Add HDMI_ACP_SEND register Define HDMI_ACP_SEND register shift/mask. Signed-off-by: Alan Liu Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit b0f4d663fce6a4232d3c20ce820f919111b1c60b Author: Lijo Lazar Date: Thu May 19 10:50:25 2022 +0530 drm/amd/pm: Fix missing thermal throttler status On aldebaran, when thermal throttling happens due to excessive GPU temperature, the reason for throttling event is missed in warning message. This patch fixes it. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 49b74d12d1e02fc67b2854a593e589372d894e62 Author: Sunil Khatri Date: Tue May 17 11:33:45 2022 +0530 drm/amdgpu: add support of tmz for GC 10.3.7 Add support of IP GC 10.3.7 in amdgpu_gmc_tmz_set. Signed-off-by: Sunil Khatri Reviewed-by: Alexander Deucher Signed-off-by: Alex Deucher commit 0ef3dc7e97884a861db4cb3dfd721db71edb0236 Author: Sunil Khatri Date: Tue May 17 11:28:46 2022 +0530 drm/amdgpu: change code name to ip version for tmz set Use IP version rather then code name of IPs for tmz set. Signed-off-by: Sunil Khatri Reviewed-by: Alexander Deucher Signed-off-by: Alex Deucher commit 4d33e7040d70b50f1fb564f7020644ec5b45d6b7 Author: Sunil Khatri Date: Tue May 17 11:27:11 2022 +0530 drm/amdgpu: move amdgpu_gmc_tmz_set after ip_version populated To enable TMZ feature based on IP version needs adev->ip_version populated but its empty. Move amdgpu_gmc_tmz_set to a place where ip_version is populated. Signed-off-by: Sunil Khatri Reviewed-by: Alexander Deucher Signed-off-by: Alex Deucher commit 950d64250fba5fbb8c290f692de8ffdee380726c Author: Stanley.Yang Date: Wed Apr 27 12:16:51 2022 +0800 drm/amdgpu: support ras on SRIOV support umc/gfx/sdma ras on guest side Changed from V1: move sriov judgment in amdgpu_ras_interrupt_fatal_error_handler Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 2c270d3e71ed0b68b2f75c0b15645fb023b4032c Author: Dan Carpenter Date: Wed May 18 20:38:36 2022 +0300 drm/amdgpu/pm: smu_v13_0_4: delete duplicate condition There is no need to check if "clock_ranges' is non-NULL. It is checked already on the line before. Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit 3670c46f07d13ba42bb66948fde68495078457ec Author: Evan Quan Date: Fri May 13 11:03:07 2022 +0800 drm/amd/pm: enable memory temp reading for SMU 13.0.0 With the latest vbios, the memory temp reading is working. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 0aceb728f4e4790d80ce64e83bb8fad40693db13 Author: Evan Quan Date: Tue May 10 15:00:43 2022 +0800 drm/amd/pm: enable more dpm features for SMU 13.0.0 Enable OOB Monitor and SOC CG which are ready since 78.38.0. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6fd693817dcf07aed021b4196993822fad225664 Author: Evan Quan Date: Tue May 10 11:04:06 2022 +0800 drm/amd/pm: correct the softpptable ids used for SMU 13.0.0 To better match with the pptable_id settings from VBIOS. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1c65e54881f3a56f16783b0b772501a8ddeb8c10 Author: Evan Quan Date: Mon May 9 11:42:23 2022 +0800 drm/amd/pm: update SMU 13.0.0 driver_if header To align with 78.37.0 and later PMFWs. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 704d6bf605faf65555438c2fa0282c02dca1a7b6 Author: Evan Quan Date: Fri May 6 17:36:06 2022 +0800 drm/amd/pm: skip dpm disablement on suspend for SMU 13.0.0 Since PMFW will handle this properly. Driver involvement is unnecessary. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 72063c71c39162d897c7c6f47fdc26425cfba03b Author: Evan Quan Date: Thu May 5 11:49:14 2022 +0800 drm/amd/pm: enable more dpm features for SMU 13.0.0 Enable MP0CLK DPM and FW Dstate since they are already supported by latest 78.36.0 PMFW. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d2f4460a3d9502513419f06cc376c7ade49d5753 Author: Gong Yuanjun Date: Tue May 17 17:57:46 2022 +0800 drm/amd/pm: fix a potential gpu_metrics_table memory leak gpu_metrics_table is allocated in yellow_carp_init_smc_tables() but not freed in yellow_carp_fini_smc_tables(). Signed-off-by: Gong Yuanjun Signed-off-by: Alex Deucher commit a2b28708b645c5632dc93669ab06e97874c8244f Author: Gong Yuanjun Date: Tue May 17 17:57:00 2022 +0800 drm/radeon: fix a possible null pointer dereference In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. The failure status of drm_cvt_mode() on the other path is checked too. Signed-off-by: Gong Yuanjun Signed-off-by: Alex Deucher commit 10784fec9cbddad2ca6031b28c1ca1d041444dc5 Author: Haohui Mai Date: Tue May 17 04:24:38 2022 -0700 drm/amdgpu/gfx10: rework KIQ programming Make sure the queue is not longer active before programming the kiq EOP registers. Signed-off-by: Haohui Mai Signed-off-by: Alex Deucher commit 842035543c0bfa35b1471e74094a107673815b01 Author: Haohui Mai Date: Mon May 16 23:06:35 2022 -0700 drm/amdgpu: Set CP_HQD_PQ_CONTROL.RPTR_BLOCK_SIZE correctly Remove the accidental shifts on the values of RPTR_BLOCK_SIZE in gfx_v8-v11. The bug essentially always programs the corresponding fields to zero instead of the correct value. The hardware clamps the min value to 5 so this resulted in a value of 5 being programmed. Signed-off-by: Haohui Mai Signed-off-by: Alex Deucher commit 69493c034d2455204dfcd370de8c4dc204374a94 Author: Christian König Date: Fri May 13 13:54:02 2022 +0200 drm/amdgpu: cleanup ctx implementation Let each context have a pointer to the ctx manager and properly initialize the adev pointer inside the context manager. Reduce the BUG_ON() in amdgpu_ctx_add_fence() into a WARN_ON() and directly return the sequence number instead of writing into a parmeter. Signed-off-by: Christian König Reviewed-by: Shashank Sharma Signed-off-by: Alex Deucher commit a0af5dbdc914eae667fba8322cb02afc4ce3967b Author: Jonathan Kim Date: Thu May 12 20:38:18 2022 -0400 drm/amdkfd: simplify cpu hive assignment CPU hive assignment currently assumes when a GPU hive is connected_to_cpu, there is only one hive in the system. Only assign CPUs to the hive if they are explicitly directly connected to the GPU hive to get rid of the need for this assumption. It's more efficient to do this when querying IO links since other non-CRAT info has to be filled in anyways. Also, stop re-assigning the same CPU to the same GPU hive if it has already been done before. Signed-off-by: Jonathan Kim Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 2c2dd0555fd6bcea6d43ab3224c6af718b910e22 Author: Haohui Mai Date: Mon May 16 05:00:53 2022 -0700 drm/amdgpu: Clean up of initializing doorbells for gfx_v9 and gfx_v10 Clean up redundant, copy-paste code blocks during the initialization of the doorbells in mqd_init(). Signed-off-by: Haohui Mai Signed-off-by: Alex Deucher commit c51bdd1a9c34936c1a6b2f6eb79703c730cc0e6e Author: Aric Cyr Date: Sun May 8 23:31:34 2022 -0400 drm/amd/display: 3.2.186 This version brings along the following: - Improvements in link training fallback - Adding individual edp hotplug support - Fixes in DPIA HPD status, display clock change hang, etc. - FPU isolation work for DCN30 Acked-by: Qingqing Zhuo Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4d1d699f479dc8e01fbb6b7b5a8f2116de3a3883 Author: Michael Strauss Date: Fri May 6 17:17:55 2022 -0400 Revert "drm/amd/display: Refactor LTTPR cap retrieval" This reverts commit 3b90318d44f87a3582f876802253a7748d270385. [WHY] Regressions unintentionally caused by change, reverting until this can be resolved. Reviewed-by: Aric Cyr Acked-by: Qingqing Zhuo Signed-off-by: Michael Strauss Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a32cc8177eabcd3497721836241f3d456342be62 Author: Bhawanpreet Lakha Date: Thu May 5 16:16:47 2022 -0400 drm/amd/display: Fic incorrect pipe being used for clk update [Why] we save the prev_dppclk value using "dpp_inst" but when reading this value we use the index "i". In a case where a pipe is fused off we can end up reading the incorrect instance because i != dpp_inst in this case. [How] read the prev_dppclk using dpp_inst instead of i Reviewed-by: Dmytro Laktyushkin Acked-by: Qingqing Zhuo Signed-off-by: Bhawanpreet Lakha Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e4b0eac3e6242abf5f5ebcffdeb852e7ffa1c3d0 Author: Jasdeep Dhillon Date: Fri May 6 13:03:45 2022 -0400 drm/amd/display: Move FPU associated DCN30 code to DML folder [why & how] As part of the FPU isolation work documented in https://patchwork.freedesktop.org/series/93042/, isolate code that uses FPU in DCN30 to DML, where all FPU code should locate. Reviewed-by: Rodrigo Siqueira Acked-by: Qingqing Zhuo Signed-off-by: Jasdeep Dhillon Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 66a197203794339b028eedfa880bff9367fce783 Author: Nicholas Kazlauskas Date: Thu May 5 16:50:42 2022 -0400 drm/amd/display: Check zero planes for OTG disable W/A on clock change [Why] A display clock change hang can occur when switching between DIO and HPO enabled modes during the optimize_bandwidth in dc_commit_state_no_check call. This happens when going from 4k120 8bpc 420 to 4k144 10bpc 444. Display clock in the DIO case is 1200MHz, but pixel rate is 600MHz because the pixel format is 420. Display clock in the HPO case is less (800MHz?) because of ODM combine which results in a smaller divider. The DIO is still active in prepare but not active in the optimize which results in the hang occuring. During this change there are no planes on the stream so it's safe to apply the workaround, but dpms_off = false and signal type is not virtual. [How] Check for plane_count == 0, no planes on the stream. It's easiest to check pipe->plane_state == NULL as an equivalent check rather than trying to search for the stream status in the context associated with the stream, so let's do that. The primary, non MPO pipe should not have a NULL plane state. Reviewed-by: Dmytro Laktyushkin Acked-by: Qingqing Zhuo Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ab144f0b4ad615b86934ce9cbdd27b23f65ba3a4 Author: Derek Lai Date: Thu May 5 17:59:49 2022 +0800 drm/amd/display: Allow individual control of eDP hotplug support [Why] Second eDP can send display off notification through HPD but DC isn't hooked up to handle. Some primary eDP panels will toggle on/off incorrectly if it's enabled generically. [How] Extend the debug option to allow individually enabling hotplug either the first eDP or the second eDP in a dual eDP system. Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Derek Lai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 49947b906a6bd9668eaf4f9cf691973c25c26955 Author: David Galiffi Date: Tue May 3 18:30:25 2022 -0400 drm/amd/display: Check if modulo is 0 before dividing. [How & Why] If a value of 0 is read, then this will cause a divide-by-0 panic. Reviewed-by: Martin Leung Acked-by: Qingqing Zhuo Signed-off-by: David Galiffi Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3f69ee66f507a9e1180fd3a67b43807fae9b0e37 Author: Paul Hsieh Date: Tue May 3 14:26:41 2022 +0800 drm/amd/display: clear request when release aux engine [Why] when driver and dmub request aux engine at the same time, dmub grant the aux engine but driver fail. Then driver release aux engine but doesn't clear the request bit. Then aux engine will be occupied by driver forever. [How] When driver release aux engine, clear request bit as well. Reviewed-by: Anthony Koo Acked-by: Qingqing Zhuo Signed-off-by: Paul Hsieh Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 903940b0b7c7f48e9743c65ae7cd65267083539f Author: Alvin Lee Date: Mon May 2 15:04:31 2022 -0400 drm/amd/display: Clean up code in dc [Why & How] Code clean up in dc. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fc0b067df7ed973addbba8e136d9a729df86ccdc Author: Jimmy Kizito Date: Fri Apr 1 15:24:47 2022 -0400 drm/amd/display: Query DPIA HPD status. [Why] Driver needs up to date DPIA HPD status. [How] Use HPD query command to get DPIA HPD status. Reviewed-by: Meenakshikumar Somasundaram Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Jimmy Kizito Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d84c4d194ebad0f5d327da72404c37c7de2c1714 Author: Jimmy Kizito Date: Thu Apr 14 09:49:37 2022 -0400 drm/amd/display: Update link training fallback behaviour. [Why] Some displays may need several link training attempts before link training succeeds. [How] If training succeeds after falling back to lower link bandwidth, retry at original link bandwidth instead of abandoning link training whenever link bandwidth is less than stream bandwidth. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Jimmy Kizito Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 16477cdfefdb494235a675cc80563d736991d833 Merge: ecf0aa5317b0a b2441b3bdce6c Author: Linus Torvalds Date: Thu May 26 10:50:30 2022 -0700 Merge tag 'asm-generic-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "The asm-generic tree contains three separate changes for linux-5.19: - The h8300 architecture is retired after it has been effectively unmaintained for a number of years. This is the last architecture we supported that has no MMU implementation, but there are still a few architectures (arm, m68k, riscv, sh and xtensa) that support CPUs with and without an MMU. - A series to add a generic ticket spinlock that can be shared by most architectures with a working cmpxchg or ll/sc type atomic, including the conversion of riscv, csky and openrisc. This series is also a prerequisite for the loongarch64 architecture port that will come as a separate pull request. - A cleanup of some exported uapi header files to ensure they can be included from user space without relying on other kernel headers" * tag 'asm-generic-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: h8300: remove stale bindings and symlink sparc: add asm/stat.h to UAPI compile-test coverage powerpc: add asm/stat.h to UAPI compile-test coverage mips: add asm/stat.h to UAPI compile-test coverage riscv: add linux/bpf_perf_event.h to UAPI compile-test coverage kbuild: prevent exported headers from including , agpgart.h: do not include from exported header csky: Move to generic ticket-spinlock RISC-V: Move to queued RW locks RISC-V: Move to generic spinlocks openrisc: Move to ticket-spinlock asm-generic: qrwlock: Document the spinlock fairness requirements asm-generic: qspinlock: Indicate the use of mixed-size atomics asm-generic: ticket-lock: New generic ticket-based spinlock remove the h8300 architecture commit ecf0aa5317b0ad6bb015128a5b763c954fd58708 Merge: a0439cf4eca05 1a23accae82d7 Author: Linus Torvalds Date: Thu May 26 10:43:09 2022 -0700 Merge tag 'arm-multiplatform-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARMv4T/v5 multiplatform support from Arnd Bergmann: "This series has been 12 years in the making, it mostly finishes the work that was started with the founding of Linaro to clean up platform support in the kernel. The largest change here is a cleanup of the omap1 platform, which is the final ARM machine type to get converted to the common-clk subsystem. All the omap1 specific drivers are now made independent of the mach/*.h headers to allow the platform to be part of a generic ARMv4/v5 multiplatform kernel. The last bit that enables this support is still missing here while we wait for some last dependencies to make it into the mainline kernel through other subsystems. The s3c24xx, ixp4xx, iop32x, ep93xx and dove platforms were all almost at the point of allowing multiplatform kernels, this work gets completed here along with a few additional cleanup. At the same time, the s3c24xx and s3c64xx are now deprecated and expected to get removed in the future. The PXA and OMAP1 bits are in a separate branch because of dependencies. Once both branches are merged, only the three Intel StrongARM platforms (RiscPC, Footbridge/NetWinder and StrongARM1100) need separate kernels, and there are no plans to include these" * tag 'arm-multiplatform-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (61 commits) ARM: ixp4xx: Consolidate Kconfig fixing issue ARM: versatile: Add missing of_node_put in dcscb_init ARM: config: Refresh IXP4xx config after multiplatform ARM: omap1: add back omap_set_dma_priority() stub ARM: omap: fix missing declaration warnings ARM: omap: fix address space warnings from sparse ARM: spear: remove include/mach/ subdirectory ARM: davinci: remove include/mach/ subdirectory ARM: omap2: remove include/mach/ subdirectory integrator: remove empty ap_init_early() ARM: s3c: fix include path MAINTAINERS: omap1: Add Janusz as an additional maintainer ARM: omap1: htc_herald: fix typos in comments ARM: OMAP1: fix typos in comments ARM: OMAP1: clock: Remove noop code ARM: OMAP1: clock: Remove unused code ARM: OMAP1: clock: Fix UART rate reporting algorithm ARM: OMAP1: clock: Fix early UART rate issues ARM: OMAP1: Prepare for conversion of OMAP1 clocks to CCF ARM: omap1: fix build with no SoC selected ... commit 8a177a36da6c54c98b8685d4f914cb3637d53c0d Author: Tejun Heo Date: Fri May 13 20:55:45 2022 -1000 blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero. Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated. iolatency_pd_offline() can also dec the counter and trigger disabling. As this disabling happens without freezing the q, this can easily happen while some IOs are in flight and thus leak the counts. This can be easily demonstrated by turning on iolatency on an one empty cgroup while IOs are in flight in other cgroups and then removing the cgroup. Note that iolatency shouldn't have been enabled elsewhere in the system to ensure that removing the cgroup disables iolatency for the whole device. The following keeps flipping on and off iolatency on sda: echo +io > /sys/fs/cgroup/cgroup.subtree_control while true; do mkdir -p /sys/fs/cgroup/test echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency sleep 1 rmdir /sys/fs/cgroup/test sleep 1 done and there's concurrent fio generating direct rand reads: fio --name test --filename=/dev/sda --direct=1 --rw=randread \ --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k while monitoring with the following drgn script: while True: for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node') pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] if pd.value_() == 0: continue iolat = container_of(pd, 'struct iolatency_grp', 'pd') inflight = iolat.rq_wait.inflight.counter.value_() if inflight: print(f'inflight={inflight} {disk_name(blkg.q.disk).decode("utf-8")} ' f'{cgroup_path(css.cgroup).decode("utf-8")}') time.sleep(1) The monitoring output looks like the following: inflight=1 sda /user.slice inflight=1 sda /user.slice ... inflight=14 sda /user.slice inflight=13 sda /user.slice inflight=17 sda /user.slice inflight=15 sda /user.slice inflight=18 sda /user.slice inflight=17 sda /user.slice inflight=20 sda /user.slice inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19 inflight=19 sda /user.slice inflight=19 sda /user.slice If a cgroup with stuck inflight ends up getting throttled, the throttled IOs will never get issued as there's no completion event to wake it up leading to an indefinite hang. This patch fixes the bug by unifying enable handling into a work item which is automatically kicked off from iolatency_set_min_lat_nsec() which is called from both iolatency_set_limit() and iolatency_pd_offline() paths. Punting to a work item is necessary as iolatency_pd_offline() is called under spinlocks while freezing a request_queue requires a sleepable context. This also simplifies the code reducing LOC sans the comments and avoids the unnecessary freezes which were happening whenever a cgroup's latency target is newly set or cleared. Signed-off-by: Tejun Heo Cc: Josef Bacik Cc: Liu Bo Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter") Cc: stable@vger.kernel.org # v5.0+ Link: https://lore.kernel.org/r/Yn9ScX6Nx2qIiQQi@slm.duckdns.org Signed-off-by: Jens Axboe commit a0439cf4eca05fe562f19ece4b6761852d911adb Merge: cc3c470ae4ad7 2cc1cd26e9138 Author: Linus Torvalds Date: Thu May 26 10:37:02 2022 -0700 Merge tag 'arm-defconfig-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM defconfig updates from Arnd Bergmann: "Lots of smaller additions to the defconfig files for both 32-bit and 64-bit arm platforms, enabling drivers that are now usable on common hardware, and a few options to make it possible to boot a file system image using systemd" * tag 'arm-defconfig-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (39 commits) ARM: configs: Enable ASoC AC'97 glue ARM: configs: Enable audio on BeagleBone Black in multi_v7_defconfig ARM: configs: at91: Enable AUTOFS_FS required by systemd ARM: configs: at91: Enable options required for systemd ARM: configs: at91: sama7: enable CONFIG_RESET_CONTROLLER ARM: configs: at91: sama7: add MCHP PDMC and DMIC drivers ARM: configs: at91: sama7: Enable MTD_UBI_BLOCK ARM: configs: at91: sama7: Enable MTD_UBI_FASTMAP ARM: configs: at91: sama7: add xisc and csi2dc ARM: multi_v7_defconfig: add atmel video pipeline modules ARM: configs: at91: Remove MTD_BLOCK and use MTD_UBI_BLOCK for read only block FS arm64: defconfig: Enable the WM8524 codec driver arm64: defconfig: Enable modules for arm displays arm: nomadik: drop selecting obsolete CLKSRC_NOMADIK_MTU_SCHED_CLOCK arm64: defconfig: Enable Renesas RZ/V2M SoC arm64: defconfig: Enable ARCH_R9A07G043 arm64: defconfig: Enable configs for DisplayPort on J721e arm64: defconfig: Build Tegra ASRC module ARM: multi_v7_defconfig: enable CONFIG_ARCH_BCMBCA in armv7 defconfig arm: mediatek: select arch timer for mt7629 ... commit cc3c470ae4ad758b8ddad825ab199f7eaa8b0a9e Merge: ae862183285cb d4a3b442335b0 Author: Linus Torvalds Date: Thu May 26 10:32:47 2022 -0700 Merge tag 'arm-drivers-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM driver updates from Arnd Bergmann: "There are minor updates to SoC specific drivers for chips by Rockchip, Samsung, NVIDIA, TI, NXP, i.MX, Qualcomm, and Broadcom. Noteworthy driver changes include: - Several conversions of DT bindings to yaml format. - Renesas adds driver support for R-Car V4H, RZ/V2M and RZ/G2UL SoCs. - Qualcomm adds a bus driver for the SSC (Snapdragon Sensor Core), and support for more chips in the RPMh power domains and the soc-id. - NXP has a new driver for the HDMI blk-ctrl on i.MX8MP. - Apple M1 gains support for the on-chip NVMe controller, making it possible to finally use the internal disks. This also includes SoC drivers for their RTKit IPC and for the SART DMA address filter. For other subsystems that merge their drivers through the SoC tree, we have - Firmware drivers for the ARM firmware stack including TEE, OP-TEE, SCMI and FF-A get a number of smaller updates and cleanups. OP-TEE now has a cache for firmware argument structures as an optimization, and SCMI now supports the 3.1 version of the specification. - Reset controller updates to Amlogic, ASpeed, Renesas and ACPI drivers - Memory controller updates for Tegra, and a few updates for other platforms" * tag 'arm-drivers-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (159 commits) memory: tegra: Add MC error logging on Tegra186 onward memory: tegra: Add memory controller channels support memory: tegra: Add APE memory clients for Tegra234 memory: tegra: Add Tegra234 support nvme-apple: fix sparse endianess warnings soc/tegra: pmc: Document core domain fields soc: qcom: pdr: use static for servreg_* variables soc: imx: fix semicolon.cocci warnings soc: renesas: R-Car V3U is R-Car Gen4 soc: imx: add i.MX8MP HDMI blk-ctrl soc: imx: imx8m-blk-ctrl: Add i.MX8MP media blk-ctrl soc: imx: add i.MX8MP HSIO blk-ctrl soc: imx: imx8m-blk-ctrl: set power device name soc: qcom: llcc: Add sc8180x and sc8280xp configurations dt-bindings: arm: msm: Add sc8180x and sc8280xp LLCC compatibles soc/tegra: pmc: Select REGMAP dt-bindings: reset: st,sti-powerdown: Convert to yaml dt-bindings: reset: st,sti-picophyreset: Convert to yaml dt-bindings: reset: socfpga: Convert to yaml dt-bindings: reset: snps,axs10x-reset: Convert to yaml ... commit ae862183285cbb2ef9032770d98ffa9becffe9d5 Merge: c011dd537ffe4 82706d6fb19d0 Author: Linus Torvalds Date: Thu May 26 10:28:12 2022 -0700 Merge tag 'arm-dt-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM DT updates from Arnd Bergmann: "There are 40 branches this time, adding a lot of new hardware support, and cleanups. Krzysztof Kozlowski continues his treewide cleanups. There are a number of new SoCs, all of them as part of existing families, and typically added along with a reference board: - Renesas RZ/G2UL (R9A07G043) is the single-core version of the RZ/G2L general-purpose MPU. - Renesas RZ/V2M (R9A09G011) is a smart camera SoC - Renesas R-Car V4H (R8A779G0) is an automotive chip with Cortex-A76 cores and deep learning accerlation. - Broadcom BCM47622 is a new broadband SoC based on a quad Cortex-A7 and dual Wifi-6. - Corstone1000 is a generic platform from Arm that is used for designing custom SoCs, the support for now is for the Fixed Virtual Platform emulation for it. - Mediatek MT8195 (Kompanio 1200) is a high-end consumer chip used in upcoming Chromebooks. - NXP i.MXRT1050 is a Cortex-M7 based microcontroller, the first MMU-less SoC to be added in a while New machines based on already supported SoCs this time are mainly for 32-bit platforms and include: - Two wireless routers based on Broadcom bcm4708 - 30 new boards based on NXP i.MX6, i.MX7 and i.MX8 families, mostly for the industrial embedded market, and on NXP LS1021A based IOT board. - Two ethernet switches based on Microchip LAN966 - Eight Qualcomm Snapdragon based machines, including a smartwatch, a Chromebook board and some phones - Another phone based on the old ST-Ericsson Ux500 platform - Seven STM32MP1 based boards - Four single-board computers based on Rockchip RK3566/RK3568" * tag 'arm-dt-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (791 commits) ARM: dts: kswitch-d10: enable networking ARM: dts: lan966x: add switch node ARM: dts: lan966x: add serdes node ARM: dts: lan966x: add reset switch reset node ARM: dts: lan966x: add MIIM nodes ARM: dts: lan966x: add hwmon node ARM: dts: lan966x: add basic Kontron KSwitch D10 support ARM: dts: lan966x: add flexcom I2C nodes ARM: dts: lan966x: add flexcom SPI nodes ARM: dts: lan966x: add all flexcom usart nodes ARM: dts: lan966x: add missing uart DMA channel ARM: dts: lan966x: add sgpio node ARM: dts: lan966x: swap dma channels for crypto node ARM: dts: lan966x: rename pinctrl nodes ARM: dts: at91: sama7g5: remove interrupt-parent from gic node ARM: dts: at91: use generic node name for dataflash ARM: dts: turris-omnia: Add atsha204a node arm64: dts: mt8192: Follow binding order for SCP registers arm64: dts: mediatek: add mtk-snfi for mt7622 arm64: dts: mediatek: mt8195-demo: enable uart1 ... commit c011dd537ffe47462051930413fed07dbdc80313 Merge: 3378323bbb9e7 426ecc5851021 Author: Linus Torvalds Date: Thu May 26 10:25:22 2022 -0700 Merge tag 'arm-soc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull 32-bit ARM SoC updates from Arnd Bergmann: "These updates are for platform specific code in arch/arm/, mostly fixing minor issues. The at91 platform gains support for better power management on the lan966 platform and new firmware on the sama5 platform. The mediatek soc drivers in turn are enabled for the new mt8195 SoC" * tag 'arm-soc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (34 commits) ARM: at91: debug: add lan966 support ARM: at91: pm: add support for sama5d2 secure suspend ARM: at91: add code to handle secure calls ARM: at91: Kconfig: implement PIT64B selection ARM: at91: pm: add quirks for pm ARM: at91: pm: use kernel documentation style ARM: at91: pm: introduce macros for pm mode replacement ARM: at91: pm: keep documentation inline with structure members orion5x: fix typos in comments ARM: hisi: Add missing of_node_put after of_find_compatible_node ARM: shmobile: rcar-gen2: Drop comma after OF match table sentinel ARM: shmobile: Drop commas after dt_compat sentinels soc: mediatek: mutex: remove mt8195 MOD0 and SOF0 definition MAINTAINERS: Add Broadcom BCMBCA entry arm: bcmbca: add arch bcmbca machine entry MAINTAINERS: Broadcom internal lists aren't maintainers dt-bindings: pwrap: mediatek: Update pwrap document for mt8195 soc: mediatek: add DDP_DOMPONENT_DITHER0 enum for mt8195 vdosys0 soc: mediatek: add mtk-mutex support for mt8195 vdosys0 soc: mediatek: add mtk-mmsys support for mt8195 vdosys0 ... commit 5f76955ab1e43e5795a9631b22ca4f918a0ae986 Author: Dmitry Torokhov Date: Wed May 25 09:51:08 2022 -0700 Input: stmfts - do not leave device disabled in stmfts_input_open The commit 26623eea0da3 attempted to deal with potential leak of runtime PM counter when opening the touchscreen device, however it ended up erroneously dropping the counter in the case of successfully enabling the device. Let's address this by using pm_runtime_resume_and_get() and then executing pm_runtime_put_sync() only when we fail to send "sense on" command to the device. Fixes: 26623eea0da3 ("Input: stmfts - fix reference leak in stmfts_input_open") Reported-by: Pavel Machek Signed-off-by: Dmitry Torokhov commit cee409bbba0d1bd3fb73064fb480ff365f453b5d Author: Lad Prabhakar Date: Wed May 25 14:39:28 2022 -0700 Input: gpio-keys - cancel delayed work only in case of GPIO gpio_keys module can either accept gpios or interrupts. The module initializes delayed work in case of gpios only and is only used if debounce timer is not used, so make sure cancel_delayed_work_sync() is called only when its gpio-backed and debounce_use_hrtimer is false. This fixes the issue seen below when the gpio_keys module is unloaded and an interrupt pin is used instead of GPIO: [ 360.297569] ------------[ cut here ]------------ [ 360.302303] WARNING: CPU: 0 PID: 237 at kernel/workqueue.c:3066 __flush_work+0x414/0x470 [ 360.310531] Modules linked in: gpio_keys(-) [ 360.314797] CPU: 0 PID: 237 Comm: rmmod Not tainted 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty #166 [ 360.324662] Hardware name: Renesas SMARC EVK based on r9a07g054l2 (DT) [ 360.331270] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 360.338318] pc : __flush_work+0x414/0x470 [ 360.342385] lr : __cancel_work_timer+0x140/0x1b0 [ 360.347065] sp : ffff80000a7fba00 [ 360.350423] x29: ffff80000a7fba00 x28: ffff000012b9c5c0 x27: 0000000000000000 [ 360.357664] x26: ffff80000a7fbb80 x25: ffff80000954d0a8 x24: 0000000000000001 [ 360.364904] x23: ffff800009757000 x22: 0000000000000000 x21: ffff80000919b000 [ 360.372143] x20: ffff00000f5974e0 x19: ffff00000f5974e0 x18: ffff8000097fcf48 [ 360.379382] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000053f40 [ 360.386622] x14: ffff800009850e88 x13: 0000000000000002 x12: 000000000000a60c [ 360.393861] x11: 000000000000a610 x10: 0000000000000000 x9 : 0000000000000008 [ 360.401100] x8 : 0101010101010101 x7 : 00000000a473c394 x6 : 0080808080808080 [ 360.408339] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80000919b458 [ 360.415578] x2 : ffff8000097577f0 x1 : 0000000000000001 x0 : 0000000000000000 [ 360.422818] Call trace: [ 360.425299] __flush_work+0x414/0x470 [ 360.429012] __cancel_work_timer+0x140/0x1b0 [ 360.433340] cancel_delayed_work_sync+0x10/0x18 [ 360.437931] gpio_keys_quiesce_key+0x28/0x58 [gpio_keys] [ 360.443327] devm_action_release+0x10/0x18 [ 360.447481] release_nodes+0x8c/0x1a0 [ 360.451194] devres_release_all+0x90/0x100 [ 360.455346] device_unbind_cleanup+0x14/0x60 [ 360.459677] device_release_driver_internal+0xe8/0x168 [ 360.464883] driver_detach+0x4c/0x90 [ 360.468509] bus_remove_driver+0x54/0xb0 [ 360.472485] driver_unregister+0x2c/0x58 [ 360.476462] platform_driver_unregister+0x10/0x18 [ 360.481230] gpio_keys_exit+0x14/0x828 [gpio_keys] [ 360.486088] __arm64_sys_delete_module+0x1e0/0x270 [ 360.490945] invoke_syscall+0x40/0xf8 [ 360.494661] el0_svc_common.constprop.3+0xf0/0x110 [ 360.499515] do_el0_svc+0x20/0x78 [ 360.502877] el0_svc+0x48/0xf8 [ 360.505977] el0t_64_sync_handler+0x88/0xb0 [ 360.510216] el0t_64_sync+0x148/0x14c [ 360.513930] irq event stamp: 4306 [ 360.517288] hardirqs last enabled at (4305): [] __cancel_work_timer+0x130/0x1b0 [ 360.526359] hardirqs last disabled at (4306): [] el1_dbg+0x24/0x88 [ 360.534204] softirqs last enabled at (4278): [] _stext+0x4a0/0x5e0 [ 360.542133] softirqs last disabled at (4267): [] irq_exit_rcu+0x18c/0x1b0 [ 360.550591] ---[ end trace 0000000000000000 ]--- Signed-off-by: Lad Prabhakar Link: https://lore.kernel.org/r/20220524135822.14764-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Dmitry Torokhov commit 3378323bbb9e77643a645f6b1ff10f7bdb9d61e4 Author: Uros Bizjak Date: Wed May 25 16:40:12 2022 +0200 locking/lockref: Use try_cmpxchg64 in CMPXCHG_LOOP macro Use try_cmpxchg64 instead of cmpxchg64 in CMPXCHG_LOOP macro. x86 CMPXCHG instruction returns success in ZF flag, so this change saves a compare after cmpxchg (and related move instruction in front of cmpxchg). The main loop of lockref_get improves from: 13: 48 89 c1 mov %rax,%rcx 16: 48 c1 f9 20 sar $0x20,%rcx 1a: 83 c1 01 add $0x1,%ecx 1d: 48 89 ce mov %rcx,%rsi 20: 89 c1 mov %eax,%ecx 22: 48 89 d0 mov %rdx,%rax 25: 48 c1 e6 20 shl $0x20,%rsi 29: 48 09 f1 or %rsi,%rcx 2c: f0 48 0f b1 4d 00 lock cmpxchg %rcx,0x0(%rbp) 32: 48 39 d0 cmp %rdx,%rax 35: 75 17 jne 4e to: 13: 48 89 ca mov %rcx,%rdx 16: 48 c1 fa 20 sar $0x20,%rdx 1a: 83 c2 01 add $0x1,%edx 1d: 48 89 d6 mov %rdx,%rsi 20: 89 ca mov %ecx,%edx 22: 48 c1 e6 20 shl $0x20,%rsi 26: 48 09 f2 or %rsi,%rdx 29: f0 48 0f b1 55 00 lock cmpxchg %rdx,0x0(%rbp) 2f: 75 02 jne 33 [ Michael Ellerman and Mark Rutland confirm that code generation on powerpc and arm64 respectively is also ok, even though they do not have a native arch_try_cmpxchg() implementation, and rely on the default fallback case - Linus ] Signed-off-by: Uros Bizjak Tested-by: Michael Ellerman Tested-by: Mark Rutland Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Waiman.Long@hp.com Cc: paulmck@linux.vnet.ibm.com Signed-off-by: Linus Torvalds commit d511578b9d215e2ff27e10c1b9d5d414383018dc Author: James Clark Date: Wed May 25 16:41:13 2022 +0100 perf unwind arm64: Decouple Libunwind register names from Perf DWARF register numbers and real register numbers on aarch64 are equivalent. Remove the references to the register names from Libunwind so that new registers are supported without having to add build time feature checks for each new register. The unwinder won't ask for a register that it doesn't know about and Perf will already report an error for an unknown or unrecorded register in the perf_reg_value() function so extra validation isn't needed. After this change the new VG register can be read by libunwind. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Alexander Shishkin Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Brown Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220525154114.718321-5-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 721052048bba2c8df1928d013963e12eca84f58c Author: James Clark Date: Wed May 25 16:41:12 2022 +0100 perf unwind: Use dynamic register set for DWARF unwind Architectures can detect availability of extra registers at runtime so use this more complete set for unwinding. This will include the VG register on arm64 in a later commit. If the function isn't implemented then PERF_REGS_MASK is returned and there is no change. Committer notes: Added util/perf_regs.c to tools/perf/util/python-ext-sources so that 'perf test python' passes, i.e. the perf python binding has all the symbols it needs, addressing: $ perf test -v python 19: 'import perf' in python : --- start --- test child forked, pid 2037817 python usage test: "echo "import sys ; sys.path.append('/tmp/build/perf/python'); import perf" | '/usr/bin/python3' " Traceback (most recent call last): File "", line 1, in ImportError: /tmp/build/perf/python/perf.cpython-310-x86_64-linux-gnu.so: undefined symbol: arch__user_reg_mask test child finished with -1 ---- end ---- 'import perf' in python: FAILED! $ Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Alexander Shishkin Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Brown Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220525154114.718321-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit f450f11b2d3f48e7eb0c9ca34ee5c873521e0b7b Author: James Clark Date: Wed May 25 16:41:11 2022 +0100 perf tools arm64: Copy perf_regs.h from the kernel Get the updated header for the newly added VG register. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Cc: Alexander Shishkin Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220525154114.718321-3-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 8803880f7d1cf85cbc110e47400165a6b85e13df Author: James Clark Date: Wed May 25 16:41:10 2022 +0100 perf unwind arm64: Use perf's copy of kernel headers Fix this include path to use perf's copy of the kernel header rather than the one from the root of the repo. This fixes build errors when only applying the perf tools part of a patchset rather than both sides. Reported-by: German Gomez Signed-off-by: James Clark Tested-by: German Gomez Cc: Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220525154114.718321-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit c4040212bc97d16040712a410335f93bc94d2262 Author: Leo Yan Date: Thu May 26 22:54:00 2022 +0800 perf c2c: Use stdio interface if slang is not supported If the slang lib is not installed on the system, perf c2c tool disables TUI mode and roll back to use stdio mode; but the flag 'c2c.use_stdio' is missed to set true and thus it wrongly applies UI quirks in the function ui_quirks(). This commit forces to use stdio interface if slang is not supported, and it can avoid to apply the UI quirks and show the correct metric header. Before: ================================================= Shared Cache Line Distribution Pareto ================================================= ------------------------------------------------------------------------------- 0 0 0 99 0 0 0 0xaaaac17d6000 ------------------------------------------------------------------------------- 0.00% 0.00% 6.06% 0.00% 0.00% 0.00% 0x20 N/A 0 0xaaaac17c25ac 0 0 43 375 18469 2 [.] 0x00000000000025ac memstress memstress[25ac] 0 0.00% 0.00% 93.94% 0.00% 0.00% 0.00% 0x29 N/A 0 0xaaaac17c3e88 0 0 173 180 135 2 [.] 0x0000000000003e88 memstress memstress[3e88] 0 After: ================================================= Shared Cache Line Distribution Pareto ================================================= ------------------------------------------------------------------------------- 0 0 0 99 0 0 0 0xaaaac17d6000 ------------------------------------------------------------------------------- 0.00% 0.00% 6.06% 0.00% 0.00% 0.00% 0x20 N/A 0 0xaaaac17c25ac 0 0 43 375 18469 2 [.] 0x00000000000025ac memstress memstress[25ac] 0 0.00% 0.00% 93.94% 0.00% 0.00% 0.00% 0x29 N/A 0 0xaaaac17c3e88 0 0 173 180 135 2 [.] 0x0000000000003e88 memstress memstress[3e88] 0 Fixes: 5a1a99cd2e4e1557 ("perf c2c report: Add main TUI browser") Reported-by: Joe Mario Signed-off-by: Leo Yan Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220526145400.611249-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 831d06c8d1b37b722d110579d52b1c661e618302 Author: Namhyung Kim Date: Wed May 18 15:47:25 2022 -0700 perf test: Add a basic offcpu profiling test $ sudo ./perf test -v offcpu 88: perf record offcpu profiling tests : --- start --- test child forked, pid 685966 Basic off-cpu test Basic off-cpu test [Success] test child finished with 0 ---- end ---- perf record offcpu profiling tests: Ok Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Acked-by: Ian Rogers Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-7-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 685439a7a037d8677e3d1acf0302624002ee6a6d Author: Namhyung Kim Date: Wed May 18 15:47:24 2022 -0700 perf record: Add cgroup support for off-cpu profiling This covers two different use cases. The first one is cgroup filtering given by -G/--cgroup option which controls the off-cpu profiling for tasks in the given cgroups only. The other use case is cgroup sampling which is enabled by --all-cgroups option and it adds PERF_SAMPLE_CGROUP to the sample_type to set the cgroup id of the task in the sample data. Example output. $ sudo perf record -a --off-cpu --all-cgroups sleep 1 $ sudo perf report --stdio -s comm,cgroup --call-graph=no ... # Samples: 144 of event 'offcpu-time' # Event count (approx.): 48452045427 # # Children Self Command Cgroup # ........ ........ ............... .......................................... # 61.57% 5.60% Chrome_ChildIOT /user.slice/user-657345.slice/user@657345.service/app.slice/... 29.51% 7.38% Web Content /user.slice/user-657345.slice/user@657345.service/app.slice/... 17.48% 1.59% Chrome_IOThread /user.slice/user-657345.slice/user@657345.service/app.slice/... 16.48% 4.12% pipewire-pulse /user.slice/user-657345.slice/user@657345.service/session.slice/... 14.48% 2.07% perf /user.slice/user-657345.slice/user@657345.service/app.slice/... 14.30% 7.15% CompositorTileW /user.slice/user-657345.slice/user@657345.service/app.slice/... 13.33% 6.67% Timer /user.slice/user-657345.slice/user@657345.service/app.slice/... ... Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Acked-by: Ian Rogers Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-6-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b36888f71c8542cd49ecaf29cd1ba874c733b5fe Author: Namhyung Kim Date: Wed May 18 15:47:23 2022 -0700 perf record: Handle argument change in sched_switch Recently sched_switch tracepoint added a new argument for prev_state, but it's hard to handle the change in a BPF program. Instead, we can check the function prototype in BTF before loading the program. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 10742d0c0771d9fb0329d03bb7c7620c8738f065 Author: Namhyung Kim Date: Wed May 18 15:47:22 2022 -0700 perf record: Implement basic filtering for off-cpu It should honor cpu and task filtering with -a, -C or -p, -t options. Committer testing: # perf record --off-cpu --cpu 1 perf bench sched messaging -l 1000 # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 1.722 [sec] [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 1.446 MB perf.data (7248 samples) ] # # perf script | head -20 perf 97164 [001] 38287.696761: 1 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97164 [001] 38287.696764: 1 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97164 [001] 38287.696765: 9 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97164 [001] 38287.696767: 212 cycles: ffffffffb6070176 native_write_msr+0x6 (vmlinux) perf 97164 [001] 38287.696768: 5130 cycles: ffffffffb6070176 native_write_msr+0x6 (vmlinux) perf 97164 [001] 38287.696770: 123063 cycles: ffffffffb6e0011e syscall_return_via_sysret+0x38 (vmlinux) perf 97164 [001] 38287.696803: 2292748 cycles: ffffffffb636c82d __fput+0xad (vmlinux) swapper 0 [001] 38287.702852: 1927474 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) :97513 97513 [001] 38287.767207: 1172536 cycles: ffffffffb612ff65 newidle_balance+0x5 (vmlinux) swapper 0 [001] 38287.769567: 1073081 cycles: ffffffffb618216d ktime_get_mono_fast_ns+0xd (vmlinux) :97533 97533 [001] 38287.770962: 984460 cycles: ffffffffb65b2900 selinux_socket_sendmsg+0x0 (vmlinux) :97540 97540 [001] 38287.772242: 883462 cycles: ffffffffb6d0bf59 irqentry_exit_to_user_mode+0x9 (vmlinux) swapper 0 [001] 38287.773633: 741963 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) :97552 97552 [001] 38287.774539: 606680 cycles: ffffffffb62eda0a page_add_file_rmap+0x7a (vmlinux) :97556 97556 [001] 38287.775333: 502254 cycles: ffffffffb634f964 get_obj_cgroup_from_current+0xc4 (vmlinux) :97561 97561 [001] 38287.776163: 427891 cycles: ffffffffb61b1522 cgroup_rstat_updated+0x22 (vmlinux) swapper 0 [001] 38287.776854: 359030 cycles: ffffffffb612fc5e load_balance+0x9ce (vmlinux) :97567 97567 [001] 38287.777312: 330371 cycles: ffffffffb6a8d8d0 skb_set_owner_w+0x0 (vmlinux) :97566 97566 [001] 38287.777589: 311622 cycles: ffffffffb614a7a8 native_queued_spin_lock_slowpath+0x148 (vmlinux) :97512 97512 [001] 38287.777671: 307851 cycles: ffffffffb62e0f35 find_vma+0x55 (vmlinux) # # perf record --off-cpu --cpu 4 perf bench sched messaging -l 1000 # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 1.613 [sec] [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 1.415 MB perf.data (6729 samples) ] # perf script | head -20 perf 97650 [004] 38323.728036: 1 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97650 [004] 38323.728040: 1 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97650 [004] 38323.728041: 9 cycles: ffffffffb6070174 native_write_msr+0x4 (vmlinux) perf 97650 [004] 38323.728042: 208 cycles: ffffffffb6070176 native_write_msr+0x6 (vmlinux) perf 97650 [004] 38323.728044: 5026 cycles: ffffffffb6070176 native_write_msr+0x6 (vmlinux) perf 97650 [004] 38323.728046: 119970 cycles: ffffffffb6d0bebc syscall_exit_to_user_mode+0x1c (vmlinux) perf 97650 [004] 38323.728078: 2190103 cycles: 54b756 perf_tool__process_synth_event+0x16 (/home/acme/bin/perf) swapper 0 [004] 38323.783357: 1593139 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) swapper 0 [004] 38323.785352: 1593139 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) swapper 0 [004] 38323.797330: 1418936 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) swapper 0 [004] 38323.802350: 1418936 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) swapper 0 [004] 38323.806333: 1418936 cycles: ffffffffb6761378 mwait_idle_with_hints.constprop.0+0x48 (vmlinux) :97996 97996 [004] 38323.807145: 1418936 cycles: 7f5db9be6917 [unknown] ([unknown]) :97959 97959 [004] 38323.807730: 1445074 cycles: ffffffffb6329d36 memcg_slab_post_alloc_hook+0x146 (vmlinux) :97959 97959 [004] 38323.808103: 1341584 cycles: ffffffffb62fd90f get_page_from_freelist+0x112f (vmlinux) :97959 97959 [004] 38323.808451: 1227537 cycles: ffffffffb65b2905 selinux_socket_sendmsg+0x5 (vmlinux) :97959 97959 [004] 38323.808768: 1184321 cycles: ffffffffb6d1ba35 _raw_spin_lock_irqsave+0x15 (vmlinux) :97959 97959 [004] 38323.809073: 1153017 cycles: ffffffffb6a8d92d skb_set_owner_w+0x5d (vmlinux) :97959 97959 [004] 38323.809402: 1126875 cycles: ffffffffb6329c64 memcg_slab_post_alloc_hook+0x74 (vmlinux) :97959 97959 [004] 38323.809695: 1073248 cycles: ffffffffb6e0001d entry_SYSCALL_64+0x1d (vmlinux) # Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit edc41a1099c2d08ccfd4ed7d59688501e3749015 Author: Namhyung Kim Date: Wed May 18 15:47:21 2022 -0700 perf record: Enable off-cpu analysis with BPF Add --off-cpu option to enable the off-cpu profiling with BPF. It'd use a bpf_output event and rename it to "offcpu-time". Samples will be synthesized at the end of the record session using data from a BPF map which contains the aggregated off-cpu time at context switches. So it needs root privilege to get the off-cpu profiling. Each sample will have a separate user stacktrace so it will skip kernel threads. The sample ip will be set from the stacktrace and other sample data will be updated accordingly. Currently it only handles some basic sample types. The sample timestamp is set to a dummy value just not to bother with other events during the sorting. So it has a very big initial value and increase it on processing each samples. Good thing is that it can be used together with regular profiling like cpu cycles. If you don't want to that, you can use a dummy event to enable off-cpu profiling only. Example output: $ sudo perf record --off-cpu perf bench sched messaging -l 1000 $ sudo perf report --stdio --call-graph=no # Total Lost Samples: 0 # # Samples: 41K of event 'cycles' # Event count (approx.): 42137343851 ... # Samples: 1K of event 'offcpu-time' # Event count (approx.): 587990831640 # # Children Self Command Shared Object Symbol # ........ ........ ............... .................. ......................... # 81.66% 0.00% sched-messaging libc-2.33.so [.] __libc_start_main 81.66% 0.00% sched-messaging perf [.] cmd_bench 81.66% 0.00% sched-messaging perf [.] main 81.66% 0.00% sched-messaging perf [.] run_builtin 81.43% 0.00% sched-messaging perf [.] bench_sched_messaging 40.86% 40.86% sched-messaging libpthread-2.33.so [.] __read 37.66% 37.66% sched-messaging libpthread-2.33.so [.] __write 2.91% 2.91% sched-messaging libc-2.33.so [.] __poll ... As you can see it spent most of off-cpu time in read and write in bench_sched_messaging(). The --call-graph=no was added just to make the output concise here. It uses perf hooks facility to control BPF program during the record session rather than adding new BPF/off-cpu specific calls. Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 303ead45c4459df9e38d4f2bd38ef6238c5898de Author: Namhyung Kim Date: Wed May 18 15:47:20 2022 -0700 perf report: Do not extend sample type of bpf-output event Currently evsel__new_idx() sets more sample_type bits when it finds a BPF-output event. But it should honor what's recorded in the perf data file rather than blindly sets the bits. Otherwise it could lead to a parse error when it recorded with a modified sample_type. Signed-off-by: Namhyung Kim Cc: Andi Kleen Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220518224725.742882-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7473ee56dbc91c9803e7a80768e71de02ab0b54d Author: Claire Jensen Date: Tue May 24 22:38:12 2022 -0700 perf test: Add checking for perf stat CSV output. Counts expected fields for various commands. No testing added for summary mode since it is broken. An example of the summary output is: summary,263831,,instructions:u,1435072,100.0,0.46,insn per cycle ,,,,,1.37,stalled cycles per insn This should be: summary,263831,,instructions:u,1435072,100.0,0.46,insn per cycle summary,,,,,,1.37,stalled cycles per insn The output has 7 fields when it should have 8. Additionally, the newline spacing is wrong, so it was excluded from testing until a fix is made. Committer testing: $ perf test "perf stat CSV output" 88: perf stat CSV output linter : Ok $ $ perf test -v "perf stat CSV output" Couldn't bump rlimit(MEMLOCK), failures may take place when creating BPF maps, etc 88: perf stat CSV output linter : --- start --- test child forked, pid 2622839 Checking CSV output: no args [Success] Checking CSV output: system wide [Skip] paranoid and not root Checking CSV output: system wide [Skip] paranoid and not root Checking CSV output: interval [Success] Checking CSV output: event [Success] Checking CSV output: per core [Skip] paranoid and not root Checking CSV output: per thread [Skip] paranoid and not root Checking CSV output: per die [Skip] paranoid and not root Checking CSV output: per node [Skip] paranoid and not root Checking CSV output: per socket [Skip] paranoid and not root test child finished with 0 ---- end ---- perf stat CSV output linter: Ok $ I did a s/parnoia/paranoid/g on the [Skip] lines. Signed-off-by: Claire Jensen Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alyssa Ross Cc: Claire Jensen Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Like Xu Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220525053814.3265216-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a41e24f6c3ffdd001f976f9bd76634f2163715f5 Author: Adrian Hunter Date: Tue May 24 10:54:36 2022 +0300 perf tools: Allow system-wide events to keep their own threads System-wide events do not have threads, so do not propagate threads to them. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-16-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 298613b8e3f68a1aef2370cd6a9dad462b6c0457 Author: Adrian Hunter Date: Tue May 24 10:54:35 2022 +0300 perf tools: Allow system-wide events to keep their own CPUs Currently, user_requested_cpus supplants system-wide CPUs when the evlist has_user_cpus. Change that so that system-wide events retain their own CPUs and they are added to all_cpus. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-15-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit f5fb6d4efe15a2f0d2c0c175c3827ac594023996 Author: Adrian Hunter Date: Tue May 24 10:54:34 2022 +0300 libperf evsel: Add comments for booleans Add comments for 'system_wide' and 'requires_cpu' booleans Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-14-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d3345fecf9e5f63be7946a1e5bf1f5695c67b445 Author: Adrian Hunter Date: Tue May 24 10:54:33 2022 +0300 perf stat: Add requires_cpu flag for uncore Uncore events require a CPU i.e. it cannot be -1. The evsel system_wide flag is intended for events that should be on every CPU, which does not make sense for uncore events because uncore events do not map one-to-one with CPUs. These 2 requirements are not exactly the same, so introduce a new flag 'requires_cpu' for the uncore case. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-13-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 4ce47d842d4c16c07b135b8a7975b8f0672bcc0e Author: Adrian Hunter Date: Tue May 24 10:54:32 2022 +0300 libperf evlist: Check nr_mmaps is correct Print an error message if the predetermined number of mmaps is incorrect. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-12-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ae4f8ae16a07896403c90305d4b9be27f657c1fc Author: Adrian Hunter Date: Tue May 24 10:54:31 2022 +0300 libperf evlist: Allow mixing per-thread and per-cpu mmaps mmap_per_evsel() will skip events that do not match the CPU, so all CPUs can be iterated in any case. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-11-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7be1fedd2a0a5b8f20952a675c611815254b74b6 Author: Adrian Hunter Date: Tue May 24 10:54:30 2022 +0300 perf tools: Allow all_cpus to be a superset of user_requested_cpus To support collection of system-wide events with user requested CPUs, all_cpus must be a superset of user_requested_cpus. In order to support all_cpus to be a superset of user_requested_cpus, all_cpus must be used instead of user_requested_cpus when dealing with CPUs of all events instead of CPUs of requested events. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-10-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7d189cadbeebc778fe19c245447d155458e6f1e3 Author: Adrian Hunter Date: Tue May 24 10:54:29 2022 +0300 perf intel-pt: Track sideband system-wide when needed User space tasks can migrate between CPUs, so when tracing selected CPUs, sideband for all CPUs is still needed. This is in preparation for allowing system-wide events on all CPUs while the user requested events are on only user requested CPUs. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-9-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e665c82a769164a976add4d793e91079ec3d1bae Author: Adrian Hunter Date: Tue May 24 10:54:28 2022 +0300 perf intel-pt: Use evlist__add_dummy_on_all_cpus() for switch tracking Use evlist__add_dummy_on_all_cpus() for switch tracking in preparation for allowing system-wide events on all CPUs while the user requested events are on only user requested CPUs. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-8-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 921e3be5a5648f483f80c9ba21ca2942d82d581c Author: Adrian Hunter Date: Tue May 24 10:54:27 2022 +0300 perf record: Use evlist__add_dummy_on_all_cpus() in record__config_text_poke() Use evlist__add_dummy_on_all_cpus() in record__config_text_poke() in preparation for allowing system-wide events on all CPUs while the user requested events are on only user requested CPUs. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-7-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 126d68fdcabed8c2ca5ffaba785add93ef722da8 Author: Adrian Hunter Date: Tue May 24 10:54:26 2022 +0300 perf evlist: Add evlist__add_dummy_on_all_cpus() Add evlist__add_dummy_on_all_cpus() to enable creating a system-wide dummy event that sets up the system-wide maps before map propagation. For convenience, add evlist__add_aux_dummy() so that the logic can be used whether or not the event needs to be system-wide. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 82944899149d2ea77c920333364dd0a6de0015ba Author: Adrian Hunter Date: Tue May 24 10:54:25 2022 +0300 perf evlist: Factor out evlist__dummy_event() Factor out evlist__dummy_event() so it can be reused. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 84bd5aba88af7b6ec46ea88e01588f93c6aa782f Author: Adrian Hunter Date: Tue May 24 10:54:24 2022 +0300 perf auxtrace: Remove auxtrace_mmap_params__set_idx() per_cpu parameter Remove auxtrace_mmap_params__set_idx() per_cpu parameter because it isn't needed. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d01508f2df21d6793f1642b20d4c1fe2f1c7fcba Author: Adrian Hunter Date: Tue May 24 10:54:23 2022 +0300 perf auxtrace: Add mmap_needed to auxtrace_mmap_params Add mmap_needed to auxtrace_mmap_params. Currently an auxtrace mmap is always attempted even if the event is not an auxtrace event. That works because, when AUX area tracing, there is always an auxtrace event first for every mmap. Prepare for that not being the case, which it won't be when sideband tracking events are allowed on all CPUs even when auxtrace is limited to selected CPUs. Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1097b38fb7583789ac5e33f3fefb1404bd087f99 Author: Adrian Hunter Date: Tue May 24 10:54:22 2022 +0300 perf intel-pt: Add a test for system-wide side band Add a test for system-wide side band even when tracing selected CPUs. The test fails before the patches up to "perf tools: Allow system-wide events to keep their own CPUs" are applied, passes afterwards. Signed-off-by: Adrian Hunter Tested-by: Ian Rogers Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexey Bayduraev Cc: Jiri Olsa Cc: Leo Yan Link: https://lore.kernel.org/r/20220524075436.29144-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit df76e0038370d364d4b2154fa7ddbbccc29f629f Author: Arnaldo Carvalho de Melo Date: Thu May 26 11:48:58 2022 -0300 perf build: Stop using __weak bpf_map_create() to handle older libbpf versions By adding a feature test for bpf_map_create() and providing a fallback if it isn't present in older versions of libbpf. This also fixes the build with torvalds/master at this point: $ git log --oneline -5 torvalds/master babf0bb978e3c9fc (torvalds/master) Merge tag 'xfs-5.19-for-linus' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux e375780b631a5fc2 Merge tag 'fsnotify_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 8b728edc5be16179 Merge tag 'fs_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 3f306ea2e18568f6 Merge tag 'dma-mapping-5.19-2022-05-25' of git://git.infradead.org/users/hch/dma-mapping fbe86daca0ba878b Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi $ Coping with: $ git log --oneline -2 d16495a982324f75 d16495a982324f75 libbpf: remove bpf_create_map*() APIs e2371b1632b1c61c libbpf: start 1.0 development cycle $ As the __weak function fails to build as it calls the now removed bpf_create_map() API. Testing: $ rpm -q libbpf-devel libbpf-devel-0.4.0-2.fc35.x86_64 $ $ make -C tools/perf BUILD_BPF_SKEL=1 LIBBPF_DYNAMIC=1 O=/tmp/build/perf install-bin $ cat /tmp/build/perf/feature/test-libbpf-bpf_map_create.make.output test-libbpf-bpf_map_create.c: In function ‘main’: test-libbpf-bpf_map_create.c:6:16: error: implicit declaration of function ‘bpf_map_create’; did you mean ‘bpf_map_freeze’? [-Werror=implicit-function-declaration] 6 | return bpf_map_create(0 /* map_type */, NULL /* map_name */, 0, /* key_size */, | ^~~~~~~~~~~~~~ | bpf_map_freeze test-libbpf-bpf_map_create.c:6:87: error: expected expression before ‘,’ token 6 | return bpf_map_create(0 /* map_type */, NULL /* map_name */, 0, /* key_size */, | ^ cc1: all warnings being treated as errors $ $ objdump -dS /tmp/build/perf/perf | grep ':' -A20 000000000058b290 : { 58b290: 55 push %rbp 58b291: 48 89 e5 mov %rsp,%rbp 58b294: 48 83 ec 10 sub $0x10,%rsp 58b298: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax 58b29f: 00 00 58b2a1: 48 89 45 f8 mov %rax,-0x8(%rbp) 58b2a5: 31 c0 xor %eax,%eax return bpf_create_map(map_type, key_size, value_size, max_entries, 0); 58b2a7: 48 8b 45 f8 mov -0x8(%rbp),%rax 58b2ab: 64 48 2b 04 25 28 00 sub %fs:0x28,%rax 58b2b2: 00 00 58b2b4: 75 10 jne 58b2c6 } 58b2b6: c9 leave 58b2b7: 89 d6 mov %edx,%esi 58b2b9: 89 ca mov %ecx,%edx 58b2bb: 44 89 c1 mov %r8d,%ecx return bpf_create_map(map_type, key_size, value_size, max_entries, 0); 58b2be: 45 31 c0 xor %r8d,%r8d $ Cc: Andrii Nakryiko Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Jiri Olsa Cc: Song Liu Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/Yo+XvQNKL4K5khl2@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 08af54b3e5729bc1d56ad3190af811301bdc37a1 Author: Chuck Lever Date: Wed May 11 13:02:21 2022 -0400 NFSD: nfsd_file_put() can sleep Now that there are no more callers of nfsd_file_put() that might hold a spin lock, ensure the lockdep infrastructure can catch newly introduced calls to nfsd_file_put() made while a spinlock is held. Link: https://lore.kernel.org/linux-nfs/ece7fd1d-5fb3-5155-54ba-347cfc19bd9a@oracle.com/T/#mf1855552570cf9a9c80d1e49d91438cd9085aada Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 043862b09cc00273e35e6c3a6389957953a34207 Author: Chuck Lever Date: Sun May 22 12:34:38 2022 -0400 NFSD: Add documenting comment for nfsd4_release_lockowner() And return explicit nfserr values that match what is documented in the new comment / API contract. Signed-off-by: Chuck Lever commit bd8fdb6e545f950f4654a9a10d7e819ad48146e5 Author: Chuck Lever Date: Sun May 22 12:07:18 2022 -0400 NFSD: Modernize nfsd4_release_lockowner() Refactor: Use existing helpers that other lock operations use. This change removes several automatic variables, so re-organize the variable declarations for readability. Signed-off-by: Chuck Lever commit ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b Author: Chuck Lever Date: Sat May 21 19:06:13 2022 -0400 NFSD: Fix possible sleep during nfsd4_release_lockowner() nfsd4_release_lockowner() holds clp->cl_lock when it calls check_for_locks(). However, check_for_locks() calls nfsd_file_get() / nfsd_file_put() to access the backing inode's flc_posix list, and nfsd_file_put() can sleep if the inode was recently removed. Let's instead rely on the stateowner's reference count to gate whether the release is permitted. This should be a reliable indication of locks-in-use since file lock operations and ->lm_get_owner take appropriate references, which are released appropriately when file locks are removed. Reported-by: Dai Ngo Signed-off-by: Chuck Lever Cc: stable@vger.kernel.org commit 982be4775164d4780d9c6a2f38b365f5b5bd16d4 Author: Jiri Olsa Date: Tue May 24 13:16:20 2022 +0200 perf build: Stop using __weak btf__raw_data() to handle older libbpf versions By adding a feature test for btf__raw_data() and providing a fallback if it isn't present in older versions of libbpf. Committer testing: $ rpm -q libbpf-devel libbpf-devel-0.4.0-2.fc35.x86_64 $ make -C tools/perf LIBBPF_DYNAMIC=1 O=/tmp/build/perf install-bin $ cat /tmp/build/perf/feature/test-libbpf-btf__raw_data.make.output test-libbpf-btf__raw_data.c: In function ‘main’: test-libbpf-btf__raw_data.c:6:9: error: implicit declaration of function ‘btf__raw_data’; did you mean ‘btf__get_raw_data’? [-Werror=implicit-function-declaration] 6 | btf__raw_data(NULL /* btf_ro */, NULL /* size */); | ^~~~~~~~~~~~~ | btf__get_raw_data cc1: all warnings being treated as errors $ objdump -dS /tmp/build/perf/perf | grep ':' -A20 00000000005b3050 : { 5b3050: 55 push %rbp 5b3051: 48 89 e5 mov %rsp,%rbp 5b3054: 48 83 ec 10 sub $0x10,%rsp 5b3058: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax 5b305f: 00 00 5b3061: 48 89 45 f8 mov %rax,-0x8(%rbp) 5b3065: 31 c0 xor %eax,%eax return btf__get_raw_data(btf_ro, size); 5b3067: 48 8b 45 f8 mov -0x8(%rbp),%rax 5b306b: 64 48 2b 04 25 28 00 sub %fs:0x28,%rax 5b3072: 00 00 5b3074: 75 06 jne 5b307c } 5b3076: c9 leave return btf__get_raw_data(btf_ro, size); 5b3077: e9 14 99 e5 ff jmp 40c990 5b307c: e8 af a7 e5 ff call 40d830 <__stack_chk_fail@plt> 5b3081: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 5b3088: 00 00 00 00 $ Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/YozLKby7ITEtchC9@krava Signed-off-by: Arnaldo Carvalho de Melo commit 739c9180cfa487cc92e2721e224564e4672c578e Author: Jiri Olsa Date: Tue May 24 13:13:17 2022 +0200 perf build: Stop using __weak bpf_object__next_map() to handle older libbpf versions By adding a feature test for bpf_object__next_map() and providing a fallback if it isn't present in older versions of libbpf. Committer testing: $ rpm -q libbpf-devel libbpf-devel-0.4.0-2.fc35.x86_64 $ make -C tools/perf LIBBPF_DYNAMIC=1 O=/tmp/build/perf install-bin $ cat /tmp/build/perf/feature/test-libbpf-bpf_object__next_map.make.output test-libbpf-bpf_object__next_map.c: In function ‘main’: test-libbpf-bpf_object__next_map.c:6:9: error: implicit declaration of function ‘bpf_object__next_map’; did you mean ‘bpf_object__next’? [-Werror=implicit-function-declaration] 6 | bpf_object__next_map(NULL /* obj */, NULL /* prev */); | ^~~~~~~~~~~~~~~~~~~~ | bpf_object__next cc1: all warnings being treated as errors $ $ objdump -dS /tmp/build/perf/perf | grep ':' -A20 00000000005b2e00 : { 5b2e00: 55 push %rbp 5b2e01: 48 89 e5 mov %rsp,%rbp 5b2e04: 48 83 ec 10 sub $0x10,%rsp 5b2e08: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax 5b2e0f: 00 00 5b2e11: 48 89 45 f8 mov %rax,-0x8(%rbp) 5b2e15: 31 c0 xor %eax,%eax return bpf_map__next(prev, obj); 5b2e17: 48 8b 45 f8 mov -0x8(%rbp),%rax 5b2e1b: 64 48 2b 04 25 28 00 sub %fs:0x28,%rax 5b2e22: 00 00 5b2e24: 75 0f jne 5b2e35 } 5b2e26: c9 leave 5b2e27: 49 89 f8 mov %rdi,%r8 5b2e2a: 48 89 f7 mov %rsi,%rdi return bpf_map__next(prev, obj); 5b2e2d: 4c 89 c6 mov %r8,%rsi 5b2e30: e9 cb b1 e5 ff jmp 40e000 $ Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/YozLKby7ITEtchC9@krava Signed-off-by: Arnaldo Carvalho de Melo commit 8916d72554e5f06df5ba17bfabc87c7977294ba4 Author: Jiri Olsa Date: Tue May 24 13:09:42 2022 +0200 perf build: Stop using __weak bpf_object__next_program() to handle older libbpf versions By adding a feature test for bpf_object__next_program() and providing a fallback if it isn't present in older versions of libbpf. Committer testing: $ rpm -q libbpf-devel libbpf-devel-0.4.0-2.fc35.x86_64 $ make -C tools/perf LIBBPF_DYNAMIC=1 O=/tmp/build/perf install-bin $ cat /tmp/build/perf/feature/test-libbpf-bpf_object__next_program.make.output test-libbpf-bpf_object__next_program.c: In function ‘main’: test-libbpf-bpf_object__next_program.c:6:9: error: implicit declaration of function ‘bpf_object__next_program’; did you mean ‘bpf_object__unpin_programs’? [-Werror=implicit-function-declaration] 6 | bpf_object__next_program(NULL /* obj */, NULL /* prev */); | ^~~~~~~~~~~~~~~~~~~~~~~~ | bpf_object__unpin_programs cc1: all warnings being treated as errors $ $ objdump -dS /tmp/build/perf/perf | grep ':' -A20 00000000005b2dc0 : { 5b2dc0: 55 push %rbp 5b2dc1: 48 89 e5 mov %rsp,%rbp 5b2dc4: 48 83 ec 10 sub $0x10,%rsp 5b2dc8: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax 5b2dcf: 00 00 5b2dd1: 48 89 45 f8 mov %rax,-0x8(%rbp) 5b2dd5: 31 c0 xor %eax,%eax return bpf_program__next(prev, obj); 5b2dd7: 48 8b 45 f8 mov -0x8(%rbp),%rax 5b2ddb: 64 48 2b 04 25 28 00 sub %fs:0x28,%rax 5b2de2: 00 00 5b2de4: 75 0f jne 5b2df5 } 5b2de6: c9 leave 5b2de7: 49 89 f8 mov %rdi,%r8 5b2dea: 48 89 f7 mov %rsi,%rdi return bpf_program__next(prev, obj); 5b2ded: 4c 89 c6 mov %r8,%rsi 5b2df0: e9 3b b4 e5 ff jmp 40e230 $ Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/YozLKby7ITEtchC9@krava Signed-off-by: Arnaldo Carvalho de Melo commit 5c83eff38194ab2c69a7dc1a64a0a3683f0a3c3a Author: Jiri Olsa Date: Tue May 24 13:04:43 2022 +0200 perf build: Stop using __weak bpf_prog_load() to handle older libbpf versions By adding a feature test for bpf_prog_load() and providing a fallback if it isn't present in older versions of libbpf. Committer testing: $ rpm -q libbpf-devel libbpf-devel-0.4.0-2.fc35.x86_64 $ make -C tools/perf LIBBPF_DYNAMIC=1 O=/tmp/build/perf install-bin $ cat /tmp/build/perf/feature/test-libbpf-bpf_prog_load.make.output test-libbpf-bpf_prog_load.c: In function ‘main’: test-libbpf-bpf_prog_load.c:6:16: error: implicit declaration of function ‘bpf_prog_load’ [-Werror=implicit-function-declaration] 6 | return bpf_prog_load(0 /* prog_type */, NULL /* prog_name */, | ^~~~~~~~~~~~~ cc1: all warnings being treated as errors $ $ objdump -dS /tmp/build/perf/perf | grep ':' -A20 00000000005b2d70 : { 5b2d70: 55 push %rbp 5b2d71: 48 89 ce mov %rcx,%rsi 5b2d74: 4c 89 c8 mov %r9,%rax 5b2d77: 49 89 d2 mov %rdx,%r10 5b2d7a: 4c 89 c2 mov %r8,%rdx 5b2d7d: 48 89 e5 mov %rsp,%rbp 5b2d80: 48 83 ec 18 sub $0x18,%rsp 5b2d84: 64 48 8b 0c 25 28 00 mov %fs:0x28,%rcx 5b2d8b: 00 00 5b2d8d: 48 89 4d f8 mov %rcx,-0x8(%rbp) 5b2d91: 31 c9 xor %ecx,%ecx return bpf_load_program(prog_type, insns, insn_cnt, license, 5b2d93: 41 8b 49 5c mov 0x5c(%r9),%ecx 5b2d97: 51 push %rcx 5b2d98: 4d 8b 49 60 mov 0x60(%r9),%r9 5b2d9c: 4c 89 d1 mov %r10,%rcx 5b2d9f: 44 8b 40 1c mov 0x1c(%rax),%r8d 5b2da3: e8 f8 aa e5 ff call 40d8a0 } $ Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/YozLKby7ITEtchC9@krava Signed-off-by: Arnaldo Carvalho de Melo commit 73534617dfa3c4cd95fe5ffaeff5315e9ffc2de6 Author: Jiri Olsa Date: Tue May 24 14:06:12 2022 +0200 perf build: Fix btf__load_from_kernel_by_id() feature check The btf__load_from_kernel_by_id() only takes one arg, not two. Committer notes: I tested it just with an older libbpf, one where btf__load_from_kernel_by_id() wasn't introduced yet. A test with a newer dynamic libbpf would fail because the btf__load_from_kernel_by_id() is there, but takes just one arg. Fixes: 0ae065a5d265bc5a ("perf build: Fix check for btf__load_from_kernel_by_id() in libbpf") Signed-off-by: Jiri Olsa Cc: Heiko Carstens Cc: Ian Rogers Cc: Ilya Leoshkevich Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Thomas Richter Cc: Vasily Gorbik Link: http://lore.kernel.org/linux-perf-users/YozLKby7ITEtchC9@krava Signed-off-by: Arnaldo Carvalho de Melo commit 9c477178a0a187c4718c228cc6e0692564811441 Author: Yang Li Date: Thu May 26 21:09:45 2022 +0800 RDMA/rtrs-clt: Fix one kernel-doc comment Add the description of @pathname and remove @sessname in rtrs_clt_open() kernel-doc comment to remove warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. drivers/infiniband/ulp/rtrs/rtrs-clt.c:2809: warning: Function parameter or member 'pathname' not described in 'rtrs_clt_open' drivers/infiniband/ulp/rtrs/rtrs-clt.c:2809: warning: Excess function parameter 'sessname' description in 'rtrs_clt_open' Link: https://lore.kernel.org/r/20220526130945.98601-1-yang.lee@linux.alibaba.com Reported-by: Abaci Robot Signed-off-by: Yang Li Reviewed-by: Md Haris Iqbal Signed-off-by: Jason Gunthorpe commit ebf2a3521738520e12849b221fea24928b3f61ff Author: Eddie James Date: Wed May 25 11:58:52 2022 -0500 spi: core: Display return code when failing to transfer message All the other calls to the controller driver display the error return code. The return code is helpful to understand what went wrong, so include it when failing to transfer one message. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220525165852.33167-3-eajames@linux.ibm.com Signed-off-by: Mark Brown commit 61bf40ef51aa73f6216b33563271b6acf7ea8d70 Author: Eddie James Date: Wed May 25 11:58:51 2022 -0500 spi: fsi: Fix spurious timeout The driver may return a timeout error even if the status register indicates that the transfer may proceed. Fix this by restructuring the polling loop. Fixes: 89b35e3f2851 ("spi: fsi: Implement a timeout for polling status") Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220525165852.33167-2-eajames@linux.ibm.com Signed-off-by: Mark Brown commit 5fa66f29937eb806997a4d1d3edd360ef4e93db9 Author: David Lin Date: Thu May 26 20:13:02 2022 +0800 ASoC: Intel: common: fix typo for tplg naming Correct typo form sof-adl-mx98360a-nau8825.tplg to sof-adl-max98360a-nau8825.tplg. The reason is tplg naming without naming limitaion of length. It will be consistency with sof topology generation. Signed-off-by: David Lin Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220526121301.1819541-1-CTLIN0@nuvoton.com Signed-off-by: Mark Brown commit 50e35bd57c02a584442c0aa917787c858eabe80b Author: pengfuyuan Date: Thu May 26 14:27:57 2022 +0800 video: fbdev: radeon: Fix spelling typo in comment Fix spelling typo in comment. Signed-off-by: pengfuyuan Signed-off-by: Helge Deller commit d27423bf048dcb5e15f04286d001c66685e30c29 Author: Shradha Gupta Date: Sun May 15 21:50:58 2022 -0700 hv_balloon: Fix balloon_probe() and balloon_remove() error handling Add missing cleanup in balloon_probe() if the call to balloon_connect_vsp() fails. Also correctly handle cleanup in balloon_remove() when dm_state is DM_INIT_ERROR because balloon_resume() failed. Signed-off-by: Shradha Gupta Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20220516045058.GA7933@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Wei Liu commit 86c8fb4d228ed8dbe17b1abd664888bc7ee0052a Author: Saurabh Sengar Date: Wed May 25 04:27:02 2022 -0700 scsi: storvsc: Removing Pre Win8 related logic The latest storvsc code has already removed the support for windows 7 and earlier. There is still some code logic remaining which is there to support pre Windows 8 OS. This patch removes these stale logic. This patch majorly does three things : 1. Removes vmscsi_size_delta and its logic, as the vmscsi_request struct is same for all the OS post windows 8 there is no need of delta. 2. Simplify sense_buffer_size logic, as there is single buffer size for all the post windows 8 OS. 3. Embed the vmscsi_win8_extension structure inside the vmscsi_request, as there is no separate handling required for different OS. Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1653478022-26621-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu commit 1940f9f81d4523b261617cf10e926b4a2485168c Author: Julia Lawall Date: Sat May 21 13:11:10 2022 +0200 Drivers: hv: vmbus: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-60-Julia.Lawall@inria.fr Signed-off-by: Wei Liu commit 7e4fd16b38923028b01d3dbadf4ca973d885c53e Author: Tiezhu Yang Date: Wed May 25 19:29:55 2022 +0800 MIPS: RALINK: Define pci_remap_iospace under CONFIG_PCI_DRIVERS_GENERIC kernel test robot reports a build error used with clang compiler and mips-randconfig [1]: ld.lld: error: undefined symbol: pci_remap_iospace we can see the following configs in the mips-randconfig file: CONFIG_RALINK=y CONFIG_SOC_MT7620=y CONFIG_PCI_DRIVERS_LEGACY=y CONFIG_PCI=y CONFIG_RALINK is set, so pci_remap_iospace is defined in the related arch/mips/include/asm/mach-ralink/spaces.h header file: #define pci_remap_iospace pci_remap_iospace CONFIG_PCI is set, so pci_remap_iospace() in drivers/pci/pci.c is not built due to pci_remap_iospace is defined under CONFIG_RALINK. #ifndef pci_remap_iospace int pci_remap_iospace(const struct resource *res, ...) $ objdump -d drivers/pci/pci.o | grep pci_remap_iospace 00004cc8 : 4d18: 10400008 beqz v0,4d3c 4d2c: 1040000c beqz v0,4d60 4d70: 1000fff3 b 4d40 In addition, CONFIG_PCI_DRIVERS_GENERIC is not set, so pci_remap_iospace() in arch/mips/pci/pci-generic.c is not built too. #ifdef pci_remap_iospace int pci_remap_iospace(const struct resource *res, ...) For the above reasons, undefined reference pci_remap_iospace() looks like reasonable. Here are simple steps to reproduce used with gcc and defconfig: cd mips.git make vocore2_defconfig # set RALINK, SOC_MT7620, PCI_DRIVERS_LEGACY make menuconfig # set PCI make there exists the following build error: LD vmlinux.o MODPOST vmlinux.symvers MODINFO modules.builtin.modinfo GEN modules.builtin LD .tmp_vmlinux.kallsyms1 drivers/pci/pci.o: In function `devm_pci_remap_iospace': pci.c:(.text+0x4d24): undefined reference to `pci_remap_iospace' Makefile:1158: recipe for target 'vmlinux' failed make: *** [vmlinux] Error 1 Define pci_remap_iospace under CONFIG_PCI_DRIVERS_GENERIC can fix the build error, with this patch, no build error remains. This patch is similar with commit e538e8649892 ("MIPS: asm: pci: define arch-specific 'pci_remap_iospace()' dependent on 'CONFIG_PCI_DRIVERS_GENERIC'"). [1] https://lore.kernel.org/lkml/202205251247.nQ5cxSV6-lkp@intel.com/ Fixes: 09d97da660ff ("MIPS: Only define pci_remap_iospace() for Ralink") Reported-by: kernel test robot Signed-off-by: Tiezhu Yang Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 6c465408a7709cf180cde7569e141191b67a175c Author: Geert Uytterhoeven Date: Tue May 24 16:11:53 2022 +0200 dt-bindings: net: adin: Fix adi,phy-output-clock description syntax "make dt_binding_check": Documentation/devicetree/bindings/net/adi,adin.yaml:40:77: [error] syntax error: mapping values are not allowed here (syntax) The first line of the description ends with a colon, hence the block needs to be marked with a "|". Fixes: 1f77204e11f8b9e5 ("dt-bindings: net: adin: document phy clock output properties") Signed-off-by: Geert Uytterhoeven Acked-by: Rob Herring Link: https://lore.kernel.org/r/6fcef2665a6cd86a021509a84c5956ec2efd93ed.1653401420.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit ed6cd6a17896561b9f51ab4c0d9bbb29e762b597 Author: Daniel Borkmann Date: Wed May 25 00:56:18 2022 +0200 net, neigh: Set lower cap for neigh_managed_work rearming Yuwei reported that plain reuse of DELAY_PROBE_TIME to rearm work queue in neigh_managed_work is problematic if user explicitly configures the DELAY_PROBE_TIME to 0 for a neighbor table. Such misconfig can then hog CPU to 100% processing the system work queue. Instead, set lower interval bound to HZ which is totally sufficient. Yuwei is additionally looking into making the interval separately configurable from DELAY_PROBE_TIME. Reported-by: Yuwei Wang Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/netdev/797c3c53-ce1b-9f60-e253-cda615788f4a@iogearbox.net Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/3b8c5aa906c52c3a8c995d1b2e8ccf650ea7c716.1653432794.git.daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit b3b1a17538d3ef6a9667b2271216fd16d7678ab5 Author: liuyacan Date: Wed May 25 16:54:08 2022 +0800 net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable In the process of checking whether RDMAv2 is available, the current implementation first sets ini->smcrv2.ib_dev_v2, and then allocates smc buf desc and register rmb, but the latter may fail. In this case, the pointer should be reset. Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2") Signed-off-by: liuyacan Reviewed-by: Karsten Graul Link: https://lore.kernel.org/r/20220525085408.812273-1-liuyacan@corp.netease.com Signed-off-by: Jakub Kicinski commit 215cd9897afbce9a964d4afbeec58c086d6cb170 Author: luyun Date: Wed May 25 11:18:19 2022 +0800 selftests/net: enable lo.accept_local in psock_snd test The psock_snd test sends and receives packets over loopback, and the test results depend on parameter settings: Set rp_filter=0, or set rp_filter=1 and accept_local=1 so that the test will pass. Otherwise, this test will fail with Resource temporarily unavailable: sudo ./psock_snd.sh dgram tx: 128 rx: 142 ./psock_snd: recv: Resource temporarily unavailable For most distro kernel releases(like Ubuntu or Centos), the parameter rp_filter is enabled by default, so it's necessary to enable the parameter lo.accept_local in psock_snd test. And this test runs inside a netns, changing a sysctl is fine. Signed-off-by: luyun Reviewed-by: Jackie Liu Tested-by: Hangbin Liu Acked-by: Willem de Bruijn Link: https://lore.kernel.org/r/20220525031819.866684-1-luyun_611@163.com Signed-off-by: Jakub Kicinski commit d0bbe0328fe552ff3211b3cbbf6117a885a3d5b2 Author: Min Li Date: Tue May 24 10:45:01 2022 -0400 ptp: ptp_clockmatrix: fix is_single_shot is_single_shot should return false for the power_of_2 mask Fixes: bec67592521e ("ptp: ptp_clockmatrix: Add PTP_CLK_REQ_EXTTS support") Signed-off-by: Min Li Link: https://lore.kernel.org/r/1653403501-12621-1-git-send-email-min.li.xe@renesas.com Signed-off-by: Jakub Kicinski commit 0b7180072a9df5e18af5b58410fec38230848a8d Author: Siddharth Vadapalli Date: Tue May 24 11:55:58 2022 +0530 net: ethernet: ti: am65-cpsw: Fix fwnode passed to phylink_create() am65-cpsw-nuss driver incorrectly uses fwnode member of common ethernet device's "struct device_node" instead of using fwnode member of the port's "struct device_node" in phylink_create(). This results in all ports having the same phy data when there are multiple ports with their phy properties populated in their respective nodes rather than the common ethernet device node. Fix it here by using fwnode member of the port's node. Fixes: e8609e69470f ("net: ethernet: ti: am65-cpsw: Convert to PHYLINK") Signed-off-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20220524062558.19296-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski commit 1679ea99bcfa8c68518b04c87992b2b2fc096513 Merge: 7e062cda7d905 1a1a0e80e005c Author: Jakub Kicinski Date: Wed May 25 21:36:19 2022 -0700 Merge branch 'amt-fix-several-bugs' Taehee Yoo says: ==================== amt: fix several bugs This patchset fixes several bugs in amt module First patch fixes typo. Second patch fixes wrong return value of amt_update_handler(). A relay finds a tunnel if it receives an update message from the gateway. If it can't find a tunnel, amt_update_handler() should return an error, not success. But it always returns success. Third patch fixes a possible memory leak in amt_rcv(). A skb would not be freed if an amt interface doesn't have a socket. ==================== Link: https://lore.kernel.org/r/20220523161708.29518-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit 1a1a0e80e005cbdc2c250fc858e1d8570f4e4acb Author: Taehee Yoo Date: Mon May 23 16:17:08 2022 +0000 amt: fix possible memory leak in amt_rcv() If an amt receives packets and it finds socket. If it can't find a socket, it should free a received skb. But it doesn't. So, a memory leak would possibly occur. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit ac1dbf55981b88d64312858ea06e3e63001f085d Author: Taehee Yoo Date: Mon May 23 16:17:07 2022 +0000 amt: fix return value of amt_update_handler() If a relay receives an update message, it lookup a tunnel. and if there is no tunnel for that message, it should be treated as an error, not a success. But amt_update_handler() returns false, which means success. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 4934609dda03ec90ca5052deecbe455b09a44e21 Author: Taehee Yoo Date: Mon May 23 16:17:06 2022 +0000 amt: fix typo in amt AMT_MSG_TEARDOWM is defined, But it should be AMT_MSG_TEARDOWN. Fixes: b9022b53adad ("amt: add control plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit babf0bb978e3c9fce6c4eba6b744c8754fd43d8e Merge: e375780b631a5 efd409a4329f6 Author: Linus Torvalds Date: Wed May 25 19:34:40 2022 -0700 Merge tag 'xfs-5.19-for-linus' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Dave Chinner: "This is a big update with lots of new code. The summary below them all, so I'll just touch on teh higlights. The two main new features are Large Extent Counts and Logged Attribute Replay - these are two new foundational features that we are building more complex future features on top of. For upcoming functionality, we need to be able to store hundreds of millions of xattrs per inode. The Large Extent Count feature removes the limits that prevent this scale of xattr storage, and while we were modifying the on disk extent count format we also increased the number of data extents we support per inode from 2^32 to 2^47. We also need to be able to modify xattrs as part of larger atomic transactions rather than as standalone transactions. The Logged Attribute Replay feature introduces the infrastructure that allows us to use intents to record the attribute modifications in the journal before we start them, hence allowing other atomic transactions to log attribute modification intents and then defer the actual modification to later. If we then crash, log recovery then guarantees that the attribute is replayed in the context of the atomic transaction that logged the intent. A significant chunk of the commits in this merge are for the base attribute replay functionality along with fixes, improvements and cleanups related to this new functioanlity. Allison deserves a big round of thanks for her ongoing work to get this functionality into XFS. There are also many other smaller changes and improvements, so overall this is one of the bigger XFS merge requests in some time. I will be following up next week with another smaller pull request - we already have another round of fixes and improvements to the logged attribute replay functionality just about ready to go. They'll soak and test over the next week, and I'll send a pull request for them near the end of the merge window. Summary: - support for printk message indexing. - large extent counts to provide support for up to 2^47 data extents and 2^32 attribute extents, allowing us to scale beyond 4 billion data extents to billions of xattrs per inode. - conversion of various flags fields to be consistently declared as unsigned bit fields. - improvements to realtime extent accounting and converts them to per-cpu counters to match all the other block and inode accounting. - reworks core log formatting code to reduce iterations, have a shorter, cleaner fast path and generally be easier to understand and maintain. - improvements to rmap btree searches that reduce overhead by up to 30% resulting in xfs_scrub runtime reductions of 15%. - improvements to reflink that remove the size limitations in remapping operations and greatly reduce the size of transaction reservations. - reworks the minimum log size calculations to allow us to change transaction reservations without changing the minimum supported log size. - removal of quota warning support as it has never been used on Linux. - intent whiteouts to allow us to cancel intents that are completed entirely in memory rather than having use CPU and disk bandwidth formatting and writing them into the journal when it is not necessary. This makes rmap, reflink and extent freeing slightly more efficient, but provides massive improvements for.... - Logged Attribute Replay feature support. This is a fundamental change to the way we modify attributes, laying the foundation for future integration of attribute modifications as part of other atomic transactional operations the filesystem performs. - Lots of cleanups and fixes for the logged attribute replay functionality" * tag 'xfs-5.19-for-linus' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (124 commits) xfs: can't use kmem_zalloc() for attribute buffers xfs: detect empty attr leaf blocks in xfs_attr3_leaf_verify xfs: ATTR_REPLACE algorithm with LARP enabled needs rework xfs: use XFS_DA_OP flags in deferred attr ops xfs: remove xfs_attri_remove_iter xfs: switch attr remove to xfs_attri_set_iter xfs: introduce attr remove initial states into xfs_attr_set_iter xfs: xfs_attr_set_iter() does not need to return EAGAIN xfs: clean up final attr removal in xfs_attr_set_iter xfs: remote xattr removal in xfs_attr_set_iter() is conditional xfs: XFS_DAS_LEAF_REPLACE state only needed if !LARP xfs: split remote attr setting out from replace path xfs: consolidate leaf/node states in xfs_attr_set_iter xfs: kill XFS_DAC_LEAF_ADDNAME_INIT xfs: separate out initial attr_set states xfs: don't set quota warning values xfs: remove warning counters from struct xfs_dquot_res xfs: remove quota warning limit from struct xfs_quota_limits xfs: rework deferred attribute operation setup xfs: make xattri_leaf_bp more useful ... commit e375780b631a5fc2a61a3b4fa12429255361a31e Merge: 8b728edc5be16 dccd855771b37 Author: Linus Torvalds Date: Wed May 25 19:29:54 2022 -0700 Merge tag 'fsnotify_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "The biggest part of this is support for fsnotify inode marks that don't pin inodes in memory but rather get evicted together with the inode (they are useful if userspace needs to exclude receipt of events from potentially large subtrees using fanotify ignore marks). There is also a fix for more consistent handling of events sent to parent and a fix of sparse(1) complaints" * tag 'fsnotify_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: fix incorrect fmode_t casts fsnotify: consistent behavior for parent not watching children fsnotify: introduce mark type iterator fanotify: enable "evictable" inode marks fanotify: use fsnotify group lock helpers fanotify: implement "evictable" inode marks fanotify: factor out helper fanotify_mark_update_flags() fanotify: create helper fanotify_mark_user_flags() fsnotify: allow adding an inode mark without pinning inode dnotify: use fsnotify group lock helpers nfsd: use fsnotify group lock helpers audit: use fsnotify group lock helpers inotify: use fsnotify group lock helpers fsnotify: create helpers for group mark_mutex lock fsnotify: make allow_dups a property of the group fsnotify: pass flags argument to fsnotify_alloc_group() fsnotify: fix wrong lockdep annotations inotify: move control flags from mask to mark flags inotify: show inotify mask flags in proc fdinfo commit 8b728edc5be161799434cc17e1279db2f8eabe29 Merge: 3f306ea2e1856 2999e1e387271 Author: Linus Torvalds Date: Wed May 25 19:24:06 2022 -0700 Merge tag 'fs_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull writeback and ext2 cleanups from Jan Kara: "One small ext2 cleanup and one writeback spelling fix" * tag 'fs_for_v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: writeback: fix typo in comment fs: ext2: Fix duplicate included linux/dax.h commit 3f306ea2e18568f693f7763d1c2178f349ae8f31 Merge: fbe86daca0ba8 4a37f3dd9a831 Author: Linus Torvalds Date: Wed May 25 19:18:36 2022 -0700 Merge tag 'dma-mapping-5.19-2022-05-25' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - don't over-decrypt memory (Robin Murphy) - takes min align mask into account for the swiotlb max mapping size (Tianyu Lan) - use GFP_ATOMIC in dma-debug (Mikulas Patocka) - fix DMA_ATTR_NO_KERNEL_MAPPING on xen/arm (me) - don't fail on highmem CMA pages in dma_direct_alloc_pages (me) - cleanup swiotlb initialization and share more code with swiotlb-xen (me, Stefano Stabellini) * tag 'dma-mapping-5.19-2022-05-25' of git://git.infradead.org/users/hch/dma-mapping: (23 commits) dma-direct: don't over-decrypt memory swiotlb: max mapping size takes min align mask into account swiotlb: use the right nslabs-derived sizes in swiotlb_init_late swiotlb: use the right nslabs value in swiotlb_init_remap swiotlb: don't panic when the swiotlb buffer can't be allocated dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages swiotlb-xen: fix DMA_ATTR_NO_KERNEL_MAPPING on arm x86: remove cruft from swiotlb: remove swiotlb_init_with_tbl and swiotlb_init_late_with_tbl swiotlb: merge swiotlb-xen initialization into swiotlb swiotlb: provide swiotlb_init variants that remap the buffer swiotlb: pass a gfp_mask argument to swiotlb_init_late swiotlb: add a SWIOTLB_ANY flag to lift the low memory restriction swiotlb: make the swiotlb_init interface more useful x86: centralize setting SWIOTLB_FORCE when guest memory encryption is enabled x86: remove the IOMMU table infrastructure MIPS/octeon: use swiotlb_init instead of open coding it arm/xen: don't check for xen_initial_domain() in xen_create_contiguous_region swiotlb: rename swiotlb_late_init_with_default_size ... commit fbe86daca0ba878b04fa241b85e26e54d17d4229 Merge: d7227785e384d 325d5c5fb2166 Author: Linus Torvalds Date: Wed May 25 19:09:48 2022 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This consists of a small set of driver updates (lpfc, ufs, mpt3sas mpi3mr, iscsi target). Apart from that this is mostly small fixes with very few core changes (the biggest one being VPD caching)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (177 commits) scsi: target: tcmu: Avoid holding XArray lock when calling lock_page scsi: elx: efct: Remove NULL check after calling container_of() scsi: dpt_i2o: Drop redundant spinlock initialization scsi: qedf: Remove redundant variable op scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver() scsi: fnic: Replace DMA mask of 64 bits with 47 bits scsi: mpi3mr: Add target device related sysfs attributes scsi: mpi3mr: Add shost related sysfs attributes scsi: elx: efct: Remove redundant memset() statement scsi: megaraid_sas: Remove redundant memset() statement scsi: mpi3mr: Return error if dma_alloc_coherent() fails scsi: hisi_sas: Fix rescan after deleting a disk scsi: hisi_sas: Use sas_ata_wait_after_reset() in IT nexus reset scsi: libsas: Refactor sas_ata_hard_reset() scsi: mpt3sas: Update driver version to 42.100.00.00 scsi: mpt3sas: Fix junk chars displayed while printing ChipName scsi: ipr: Use kobj_to_dev() scsi: mpi3mr: Fix a NULL vs IS_ERR() bug in mpi3mr_bsg_init() scsi: bnx2fc: Avoid using get_cpu() in bnx2fc_cmd_alloc() scsi: libfc: Remove get_cpu() semantics in fc_exch_em_alloc() ... commit 324373f476936b6c8d6a83086a8025a818c1b9e6 Author: Guo Ren Date: Wed May 25 12:04:04 2022 -0400 riscv: compat: Using seperated vdso_maps for compat_vdso_info This is a fixup for vdso implementation which caused musl to fail. [ 11.600082] Run /sbin/init as init process [ 11.628561] init[1]: unhandled signal 11 code 0x1 at 0x0000000000000000 in libc.so[ffffff8ad39000+a4000] [ 11.629398] CPU: 0 PID: 1 Comm: init Not tainted 5.18.0-rc7-next-20220520 #1 [ 11.629462] Hardware name: riscv-virtio,qemu (DT) [ 11.629546] epc : 00ffffff8ada1100 ra : 00ffffff8ada13c8 sp : 00ffffffc58199f0 [ 11.629586] gp : 00ffffff8ad39000 tp : 00ffffff8ade0998 t0 : ffffffffffffffff [ 11.629598] t1 : 00ffffffc5819fd0 t2 : 0000000000000000 s0 : 00ffffff8ade0cc0 [ 11.629610] s1 : 00ffffff8ade0cc0 a0 : 0000000000000000 a1 : 00ffffffc5819a00 [ 11.629622] a2 : 0000000000000001 a3 : 000000000000001e a4 : 00ffffffc5819b00 [ 11.629634] a5 : 00ffffffc5819b00 a6 : 0000000000000000 a7 : 0000000000000000 [ 11.629645] s2 : 00ffffff8ade0ac8 s3 : 00ffffff8ade0ec8 s4 : 00ffffff8ade0728 [ 11.629656] s5 : 00ffffff8ade0a90 s6 : 0000000000000000 s7 : 00ffffffc5819e40 [ 11.629667] s8 : 00ffffff8ade0ca0 s9 : 00ffffff8addba50 s10: 0000000000000000 [ 11.629678] s11: 0000000000000000 t3 : 0000000000000002 t4 : 0000000000000001 [ 11.629688] t5 : 0000000000020000 t6 : ffffffffffffffff [ 11.629699] status: 0000000000004020 badaddr: 0000000000000000 cause: 000000000000000d The last __vdso_init(&compat_vdso_info) replaces the data in normal vdso_info. This is an obvious bug. Reported-by: Guenter Roeck Signed-off-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Heiko Stuebner Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20220525160404.2930984-1-guoren@kernel.org Fixes: 3092eb456375 ("riscv: compat: vdso: Add setup additional pages implementation") Signed-off-by: Palmer Dabbelt commit d7227785e384d4422b3ca189aa5bf19f462337cc Merge: 2518f226c60d8 60571929d06b0 Author: Linus Torvalds Date: Wed May 25 16:55:16 2022 -0700 Merge tag 'sound-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Not much dramatic changes at this time, but we've received quite a lot of changes for ASoC, while there are still a few fixes and quirks for usual HD- and USB-auido. Here are some highlights. ASoC: - Overhaul of endianness specification for data formats, avoiding needless restrictions due to CODECs - Initial stages of Intel AVS driver merge - Introduction of v4 IPC mechanism for SOF - TDM mode support for AK4613 - Support for Analog Devices ADAU1361, Cirrus Logic CS35L45, Maxim MAX98396, MediaTek MT8186, NXP i.MX8 micfil and SAI interfaces, nVidia Tegra186 ASRC, and Texas Instruments TAS2764 and TAS2780 Others: - A few regression fixes after the USB-audio endpoint management refactoring - More enhancements for Cirrus HD-audio codec support (still ongoing) - Addition of generic serial MIDI driver" * tag 'sound-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (504 commits) ALSA: hda/realtek - Add new type for ALC245 ALSA: usb-audio: Configure sync endpoints before data ALSA: ctxfi: fix typo in comment ALSA: cs5535audio: fix typo in comment ALSA: ctxfi: Add SB046x PCI ID ALSA: usb-audio: Add missing ep_idx in fixed EP quirks ALSA: usb-audio: Workaround for clock setup on TEAC devices ALSA: lola: Bounds check loop iterator against streams array size ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() ASoC: rt1308-sdw: add the default value of register 0xc320 ASoC: rt9120: Use pm_runtime and regcache to optimize 'pwdnn' logic ASoC: rt9120: Fix 3byte read, valule offset typo ASoC: amd: acp: Set Speaker enable/disable pin through rt1019 codec driver. ASoC: amd: acp: Set Speaker enable/disable pin through rt1019 codec driver ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() ASoC: codecs: lpass: Fix passing zero to 'PTR_ERR' ASoC: SOF: sof-client-ipc-flood-test: use pm_runtime_resume_and_get() ASoC: SOF: mediatek: remove duplicate include in mt8195.c ASoC: SOF: mediatek: Add mt8195 debug dump ASoC: SOF: mediatek: Add mediatek common debug dump ... commit 2518f226c60d8e04d18ba4295500a5b0b8ac7659 Merge: 86c87bea6b421 c4955d9cd2fc5 Author: Linus Torvalds Date: Wed May 25 16:18:27 2022 -0700 Merge tag 'drm-next-2022-05-25' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Intel have enabled DG2 on certain SKUs for laptops, AMD has started some new GPU support, msm has user allocated VA controls dma-buf: - add dma_resv_replace_fences - add dma_resv_get_singleton - make dma_excl_fence private core: - EDID parser refactorings - switch drivers to drm_mode_copy/duplicate - DRM managed mutex initialization display-helper: - put HDMI, SCDC, HDCP, DSC and DP into new module gem: - rework fence handling ttm: - rework bulk move handling - add common debugfs for resource managers - convert to kvcalloc format helpers: - support monochrome formats - RGB888, RGB565 to XRGB8888 conversions fbdev: - cfb/sys_imageblit fixes - pagelist corruption fix - create offb platform device - deferred io improvements sysfb: - Kconfig rework - support for VESA mode selection bridge: - conversions to devm_drm_of_get_bridge - conversions to panel_bridge - analogix_dp - autosuspend support - it66121 - audio support - tc358767 - DSI to DPI support - icn6211 - PLL/I2C fixes, DT property - adv7611 - enable DRM_BRIDGE_OP_HPD - anx7625 - fill ELD if no monitor - dw_hdmi - add audio support - lontium LT9211 support, i.MXMP LDB - it6505: Kconfig fix, DPCD set power fix - adv7511 - CEC support for ADV7535 panel: - ltk035c5444t, B133UAN01, NV3052C panel support - DataImage FG040346DSSWBG04 support - st7735r - DT bindings fix - ssd130x - fixes i915: - DG2 laptop PCI-IDs ("motherboard down") - Initial RPL-P PCI IDs - compute engine ABI - DG2 Tile4 support - DG2 CCS clear color compression support - DG2 render/media compression formats support - ATS-M platform info - RPL-S PCI IDs added - Bump ADL-P DMC version to v2.16 - Support static DRRS - Support multiple eDP/LVDS native mode refresh rates - DP HDR support for HSW+ - Lots of display refactoring + fixes - GuC hwconfig support and query - sysfs support for multi-tile - fdinfo per-client gpu utilisation - add geometry subslices query - fix prime mmap with LMEM - fix vm open count and remove vma refcounts - contiguous allocation fixes - steered register write support - small PCI BAR enablement - GuC error capture support - sunset igpu legacy mmap support for newer devices - GuC version 70.1.1 support amdgpu: - Initial SoC21 support - SMU 13.x enablement - SMU 13.0.4 support - ttm_eu cleanups - USB-C, GPUVM updates - TMZ fixes for RV - RAS support for VCN - PM sysfs code cleanup - DC FP rework - extend CG/PG flags to 64-bit - SI dpm lockdep fix - runtime PM fixes amdkfd: - RAS/SVM fixes - TLB flush fixes - CRIU GWS support - ignore bogus MEC signals more efficiently msm: - Fourcc modifier for tiled but not compressed layouts - Support for userspace allocated IOVA (GPU virtual address) - DPU: DSC (Display Stream Compression) support - DP: eDP support - DP: conversion to use drm_bridge and drm_bridge_connector - Merge DPU1 and MDP5 MDSS driver - DPU: writeback support nouveau: - make some structures static - make some variables static - switch to drm_gem_plane_helper_prepare_fb radeon: - misc fixes/cleanups mxsfb: - rework crtc mode setting - LCDIF CRC support etnaviv: - fencing improvements - fix address space collisions - cleanup MMU reference handling gma500: - GEM/GTT improvements - connector handling fixes komeda: - switch to plane reset helper mediatek: - MIPI DSI improvements omapdrm: - GEM improvements qxl: - aarch64 support vc4: - add a CL submission tracepoint - HDMI YUV support - HDMI/clock improvements - drop is_hdmi caching virtio: - remove restriction of non-zero blob types vmwgfx: - support for cursormob and cursorbypass 4 - fence improvements tidss: - reset DISPC on startup solomon: - SPI support - DT improvements sun4i: - allwinner D1 support - drop is_hdmi caching imx: - use swap() instead of open-coding - use devm_platform_ioremap_resource - remove redunant initializations ast: - Displayport support rockchip: - Refactor IOMMU initialisation - make some structures static - replace drm_detect_hdmi_monitor with drm_display_info.is_hdmi - support swapped YUV formats, - clock improvements - rk3568 support - VOP2 support mediatek: - MT8186 support tegra: - debugabillity improvements" * tag 'drm-next-2022-05-25' of git://anongit.freedesktop.org/drm/drm: (1740 commits) drm/i915/dsi: fix VBT send packet port selection for ICL+ drm/i915/uc: Fix undefined behavior due to shift overflowing the constant drm/i915/reg: fix undefined behavior due to shift overflowing the constant drm/i915/gt: Fix use of static in macro mismatch drm/i915/audio: fix audio code enable/disable pipe logging drm/i915: Fix CFI violation with show_dynamic_id() drm/i915: Fix 'mixing different enum types' warnings in intel_display_power.c drm/i915/gt: Fix build error without CONFIG_PM drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path drm/msm/dpu: add DRM_MODE_ROTATE_180 back to supported rotations drm/msm: don't free the IRQ if it was not requested drm/msm/dpu: limit writeback modes according to max_linewidth drm/amd: Don't reset dGPUs if the system is going to s2idle drm/amdgpu: Unmap legacy queue when MES is enabled drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() drm/msm: Fix fb plane offset calculation drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init drm/msm/dsi: don't powerup at modeset time for parade-ps8640 drm/rockchip: Change register space names in vop2 dt-bindings: display: rockchip: make reg-names mandatory for VOP2 ... commit 86c87bea6b42100c67418af690919c44de6ede6e Merge: d223575e50f8d d036d915b61f2 Author: Linus Torvalds Date: Wed May 25 14:56:06 2022 -0700 Merge tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "Bindings: - Convert smsc,lan91c111, qcom,spi-qup, qcom,msm-uartdm, qcom,i2c-qup, qcom,gsbi, i2c-mt65xx, TI wkup_m3_ipc (and new props), qcom,smp2p, TI timer, Mediatek gnss, Mediatek topckgen, Mediatek apmixedsys, Mediatek infracfg, fsl,ls-extirq, fsl,layerscape-dcfg, QCom PMIC SPMI, rda,8810pl-timer, Xilinx zynqmp_ipi, uniphier-pcie, and Ilitek touchscreen controllers - Convert various Arm Ltd peripheral IP bindings to schemas - New bindings for Menlo board CPLD, DH electronics board CPLD, Qualcomm Geni based QUP I2C, Renesas RZ/G2UL OSTM, Broafcom BCM4751 GNSS, MT6360 PMIC, ASIX USB Ethernet controllers, and Microchip/SMSC LAN95xx USB Ethernet controllers - Add vendor prefix for Enclustra - Add various compatible string additions - Various example fixes and cleanups - Remove unused hisilicon,hi6220-reset binding - Treewide fix properties missing type definition - Drop some empty and unreferenced .txt bindings - Documentation improvements for writing schemas DT driver core: - Drop static IRQ resources for DT platform devices as IRQ setup is dynamic and drivers have all been converted to use platform_get_irq() and friends - Rework memory allocations and frees for overlays - Continue overlay notifier callbacks on successful calls and add unittests - Handle 'interrupts-extended' in early DT IRQ setup - Fix of_property_read_string() errors to match documentation - Ignore disabled nodes in FDT API calls" * tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (86 commits) of/irq: fix typo in comment dt-bindings: Fix properties without any type Revert "dt-bindings: mailbox: qcom-ipcc: add missing properties into example" dt-bindings: input: touchscreen: ilitek_ts_i2c: Absorb ili2xxx bindings dt-bindings: timer: samsung,exynos4210-mct: define strict clock order dt-bindings: timer: samsung,exynos4210-mct: drop unneeded minItems dt-bindings: timer: cdns,ttc: drop unneeded minItems dt-bindings: mailbox: zynqmp_ipi: convert to yaml dt-bindings: usb: ci-hdrc-usb2: fix node node for ethernet controller dt-bindings: net: add schema for Microchip/SMSC LAN95xx USB Ethernet controllers dt-bindings: net: add schema for ASIX USB Ethernet controllers of/fdt: Ignore disabled memory nodes dt-bindings: arm: fix typos in compatible dt-bindings: mfd: Add bindings child nodes for the Mediatek MT6360 dt-bindings: display: convert Arm Komeda to DT schema dt-bindings: display: convert Arm Mali-DP to DT schema dt-bindings: display: convert Arm HDLCD to DT schema dt-bindings: display: convert PL110/PL111 to DT schema dt-bindings: arm: convert vexpress-config to DT schema dt-bindings: arm: convert vexpress-sysregs to DT schema ... commit d223575e50f8da0de358c0098defd560069ecf66 Merge: e908305fb2625 5d2b6bc3a6a27 Author: Linus Torvalds Date: Wed May 25 14:46:09 2022 -0700 Merge tag 'perf-tools-for-v5.19-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tool updates from Arnaldo Carvalho de Melo: "Intel PT: - Allow hardware tracing on KVM test programs. In this case, the VM is not running an OS, but only the functions loaded into it by the hypervisor test program, and conveniently, loaded at the same virtual addresses. - Improve documentation: - Add link to perf wiki's page - Cleanups: - Delete now unused perf-with-kcore.sh script - Remove unused machines__find_host() ARM SPE (Statistical Profile Extensions): - Add man page entry. Vendor Events: - Update various Intel event topics - Update various microarch events - Fix various cstate metrics - Fix Alderlake metric groups - Add sapphirerapids events - Add JSON files for ARM Cortex A34, A35, A55, A510, A65, A73, A75, A77, A78, A710, X1, X2 and Neoverse E1 - Update Cortex A57/A72 perf stat: - Introduce stats for the user and system rusage times perf c2c: - Prep work to support ARM systems perf annotate: - Add --percent-limit option perf lock: - Add -t/--thread option for report - Do not discard broken lock stats perf bench: - Add breakpoint benchmarks perf test: - Limit to only run executable scripts in tests - Add basic perf record tests - Add stat record+report test - Add basic stat and topdown group test - Skip several tests when the user hasn't permission to perform them - Fix test case 81 ("perf record tests") on s390x perf version: - debuginfod support improvements perf scripting python: - Expose symbol offset and source information perf build: - Error for BPF skeletons without LIBBPF - Use Python devtools for version autodetection rather than runtime Miscellaneous: - Add riscv64 support to 'perf jitdump' - Various fixes/tidy ups related to cpu_map - Fixes for handling Intel hybrid systems" * tag 'perf-tools-for-v5.19-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (122 commits) perf intel-pt: Add guest_code support perf kvm report: Add guest_code support perf script: Add guest_code support perf tools: Add guest_code support perf tools: Factor out thread__set_guest_comm() perf tools: Add machine to machines back pointer perf vendors events arm64: Update Cortex A57/A72 perf vendors events arm64: Arm Neoverse E1 perf vendors events arm64: Arm Cortex-X2 perf vendors events arm64: Arm Cortex-X1 perf vendors events arm64: Arm Cortex-A710 perf vendors events arm64: Arm Cortex-A78 perf vendors events arm64: Arm Cortex-A77 perf vendors events arm64: Arm Cortex-A75 perf vendors events arm64: Arm Cortex-A73 perf vendors events arm64: Arm Cortex-A65 perf vendors events arm64: Arm Cortex-A510 perf vendors events arm64: Arm Cortex-A55 perf vendors events arm64: Arm Cortex-A35 perf vendors events arm64: Arm Cortex-A34 ... commit d9e418d0ca1c464fe361468b772d4aa870d54e63 Author: Palmer Dabbelt Date: Tue Apr 19 20:13:27 2022 -0700 RISC-V: Fix the XIP build A handful of functions unused functions were enabled during XIP builds, which themselves didn't build correctly. This just disables the functions entirely. Fixes: e8a62cc26ddf ("riscv: Implement sv48 support") Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220420184056.7886-5-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit e7681beba992d5a196476d5d79dfcb48f2a2c477 Author: Palmer Dabbelt Date: Tue Apr 19 20:02:16 2022 -0700 RISC-V: Split out the XIP fixups into their own file This was broken by the original refactoring (as the XIP definitions depend on ) and then more broken by the merge (as I accidentally took the old version). This fixes both breakages, while also pulling this out of to avoid polluting most assembly files with the XIP fixups. Fixes: bee7fbc38579 ("RISC-V CPU Idle Support") Fixes: 63b13e64a829 ("RISC-V: Add arch functions for non-retentive suspend entry/exit") Link: https://lore.kernel.org/r/20220420184056.7886-4-palmer@rivosinc.com Reviewed-by: Guo Ren Signed-off-by: Palmer Dabbelt commit e908305fb262588471958f560eb3c6c18cc683a1 Merge: 62e5873ec96bc 73f1d07e5f8a1 Author: Linus Torvalds Date: Wed May 25 14:37:00 2022 -0700 Merge tag 'checkpatch-new-alloc-check-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull checkpatch update from Gustavo Silva: "kvmalloc() and kvzalloc() functions have now 2-factor multiplication argument forms kvmalloc_array() and kvcalloc(). Add alloc-with-multiplies checks for these new functions" * tag 'checkpatch-new-alloc-check-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: checkpatch: add new alloc functions to alloc with multiplies check commit e35c2d8e22745751cf304ec3fe39616643db2e0a Author: Li Huafei Date: Wed Apr 27 11:41:19 2022 +0800 tracing: Reset the function filter after completing trampoline/graph selftest The direct trampoline and graph coexistence test sets global_ops to trace only 'trace_selftest_dynamic_test_func', but does not reset it after the test is completed, resulting in the function filter being set already after the system starts. Although it can be reset through the tracefs interface, it is more or less confusing to the user, and we should reset it to trace all functions after the trampoline/graph test completes. Link: https://lkml.kernel.org/r/20220427034119.24668-1-lihuafei1@huawei.com Link: https://lore.kernel.org/all/20220418073958.104029-1-lihuafei1@huawei.com/ Fixes: 130c08065848 ("tracing: Add trampoline/graph selftest") Signed-off-by: Li Huafei Signed-off-by: Steven Rostedt (Google) commit 499f12168aebd6da8fa32c9b7d6203ca9b5eb88d Author: Steven Rostedt (Google) Date: Thu Apr 7 14:56:32 2022 -0400 tracing: Have event format check not flag %p* on __get_dynamic_array() The print fmt check against trace events to make sure that the format does not use pointers that may be freed from the time of the trace to the time the event is read, gives a false positive on %pISpc when reading data that was saved in __get_dynamic_array() when it is perfectly fine to do so, as the data being read is on the ring buffer. Link: https://lore.kernel.org/all/20220407144524.2a592ed6@canb.auug.org.au/ Cc: stable@vger.kernel.org Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Reported-by: Stephen Rothwell Signed-off-by: Steven Rostedt (Google) commit 62e5873ec96bc2cfe809a1bc123af8101989ef5f Merge: a3a8b54b4f1a2 746f1b0ac5bf6 Author: Linus Torvalds Date: Wed May 25 13:56:57 2022 -0700 Merge tag 'size_t-saturating-helpers-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull misc hardening updates from Gustavo Silva: "Replace a few open-coded instances with size_t saturating arithmetic helpers" * tag 'size_t-saturating-helpers-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: virt: acrn: Prefer array_size and struct_size over open coded arithmetic afs: Prefer struct_size over open coded arithmetic commit a3a8b54b4f1a261656eb6c9a517e68e1204cef39 Merge: 7e062cda7d905 336feb502a715 Author: Linus Torvalds Date: Wed May 25 13:52:24 2022 -0700 Merge tag 'Wstringop-overflow-fixes-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull Wstringop-overflow fixes from Gustavo Silva: "Fix some -Wstringop-overflow warnings when building with GCC-11. All the patches have been in linux-next during the last development cycle. This is part of the ongoing efforts to globally enable -Wstringop-overflow" * tag 'Wstringop-overflow-fixes-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() drm/amd/display: Fix Wstringop-overflow warnings in dc_link_dp.c scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() commit 3159d79b56c15068aeb7e4630cd5f6dacd20fda4 Author: Congyu Liu Date: Mon May 23 05:35:31 2022 +0000 kcov: update pos before writing pc in trace function In __sanitizer_cov_trace_pc(), previously we write pc before updating pos. However, some early interrupt code could bypass check_kcov_mode() check and invoke __sanitizer_cov_trace_pc(). If such interrupt is raised between writing pc and updating pos, the pc could be overitten by the recursive __sanitizer_cov_trace_pc(). As suggested by Dmitry, we cold update pos before writing pc to avoid such interleaving. Apply the same change to write_comp_data(). Link: https://lkml.kernel.org/r/20220523053531.1572793-1-liu3101@purdue.edu Signed-off-by: Congyu Liu Reviewed-by: Dmitry Vyukov Cc: Andrey Konovalov Signed-off-by: Andrew Morton commit 863e0d81b6683c4cbc588ad831f560c90e494bef Author: Junxiao Bi via Ocfs2-devel Date: Wed May 18 16:52:24 2022 -0700 ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock When user_dlm_destroy_lock failed, it didn't clean up the flags it set before exit. For USER_LOCK_IN_TEARDOWN, if this function fails because of lock is still in used, next time when unlink invokes this function, it will return succeed, and then unlink will remove inode and dentry if lock is not in used(file closed), but the dlm lock is still linked in dlm lock resource, then when bast come in, it will trigger a panic due to user-after-free. See the following panic call trace. To fix this, USER_LOCK_IN_TEARDOWN should be reverted if fail. And also error should be returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink fail. For the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN, USER_LOCK_BUSY is also required to be cleared. Even though spin lock is released in between, but USER_LOCK_IN_TEARDOWN is still set, for USER_LOCK_BUSY, if before every place that waits on this flag, USER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow waits on the busy flag set by user_dlm_destroy_lock(), then we can simplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails. Fix user_dlm_cluster_lock() which is the only function not following this. [ 941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink 004fb0000060000b5a90b8c847b72e1, error -16 from destroy [ 989.757536] ------------[ cut here ]------------ [ 989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173! [ 989.757876] invalid opcode: 0000 [#1] SMP [ 989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O) ksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5 auth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc rds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE) mlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad ib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si ipmi_msghandler [ 989.760686] ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ksplice_2zhuk2jr_ib_ipoib_old] [ 989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P OE 4.1.12-124.57.1.el6uek.x86_64 #2 [ 989.762290] Hardware name: Oracle Corporation ORACLE SERVER X5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021 [ 989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti: ffff88017f7c8000 [ 989.762848] RIP: e030:[] [] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.763185] RSP: e02b:ffff88017f7cbcb8 EFLAGS: 00010246 [ 989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX: 0000000000000003 [ 989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI: ffff880174d48170 [ 989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09: 0000000000000000 [ 989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12: ffff880174d48008 [ 989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15: ffff88021db7a000 [ 989.764422] FS: 0000000000000000(0000) GS:ffff880247480000(0000) knlGS:ffff880247480000 [ 989.764685] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4: 0000000000042660 [ 989.765081] Stack: [ 989.765167] 0000000000000003 ffff880174d48040 ffff88017f7cbd18 ffffffffc07d455f [ 989.765442] ffff88017f7cbd88 ffffffff816fb639 ffff88017f7cbd38 ffff8800361b5600 [ 989.765717] ffff88021db7a000 ffff88021f429380 0000000000000003 ffffffffc0453020 [ 989.765991] Call Trace: [ 989.766093] [] user_bast+0x5f/0xf0 [ocfs2_dlmfs] [ 989.766287] [] ? schedule_timeout+0x169/0x2d0 [ 989.766475] [] ? o2dlm_lock_ast_wrapper+0x20/0x20 [ocfs2_stack_o2cb] [ 989.766738] [] o2dlm_blocking_ast_wrapper+0x1a/0x20 [ocfs2_stack_o2cb] [ 989.767010] [] dlm_do_local_bast+0x46/0xe0 [ocfs2_dlm] [ 989.767217] [] ? dlm_lockres_calc_usage+0x4c/0x60 [ocfs2_dlm] [ 989.767466] [] dlm_thread+0xa31/0x1140 [ocfs2_dlm] [ 989.767662] [] ? __schedule+0x24a/0x810 [ 989.767834] [] ? __schedule+0x23e/0x810 [ 989.768006] [] ? __schedule+0x24a/0x810 [ 989.768178] [] ? __schedule+0x23e/0x810 [ 989.768349] [] ? __schedule+0x24a/0x810 [ 989.768521] [] ? __schedule+0x23e/0x810 [ 989.768693] [] ? __schedule+0x24a/0x810 [ 989.768893] [] ? __schedule+0x23e/0x810 [ 989.769067] [] ? __schedule+0x24a/0x810 [ 989.769241] [] ? wait_woken+0x90/0x90 [ 989.769411] [] ? dlm_kick_thread+0x80/0x80 [ocfs2_dlm] [ 989.769617] [] kthread+0xcb/0xf0 [ 989.769774] [] ? __schedule+0x24a/0x810 [ 989.769945] [] ? __schedule+0x24a/0x810 [ 989.770117] [] ? kthread_create_on_node+0x180/0x180 [ 989.770321] [] ret_from_fork+0x61/0x90 [ 989.770492] [] ? kthread_create_on_node+0x180/0x180 [ 989.770689] Code: d0 00 00 00 f0 45 7d c0 bf 00 20 00 00 48 89 83 c0 00 00 00 48 89 83 c8 00 00 00 e8 55 c1 8c c0 83 4b 04 10 48 83 c4 08 5b 5d c3 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 83 [ 989.771892] RIP [] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.772174] RSP [ 989.772704] ---[ end trace ebd1e38cebcc93a8 ]--- [ 989.772907] Kernel panic - not syncing: Fatal exception [ 989.773173] Kernel Offset: disabled Link: https://lkml.kernel.org/r/20220518235224.87100-2-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Joseph Qi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 0b6d14e3dbde9de158263ce5e4a27112693e71ac Author: Junxiao Bi Date: Wed May 18 16:52:23 2022 -0700 ocfs2: dlmfs: don't clear USER_LOCK_ATTACHED when destroying lock The following function is the only place that checks USER_LOCK_ATTACHED. This flag is set when lock request is granted through user_ast() and only the following function will clear it. Checking of this flag here is to make sure ocfs2_dlm_unlock is not issued if this lock is never granted. For example, lock file is created and then get removed, open file never happens. Clearing the flag here is not necessary because this is the only function that checks it, if another flow is executing user_dlm_destroy_lock(), it will bail out at the beginning because of USER_LOCK_IN_TEARDOWN and never check USER_LOCK_ATTACHED. Drop the clear, so we don't need take care of it for the following error handling patch. int user_dlm_destroy_lock(struct user_lock_res *lockres) { ... status = 0; if (!(lockres->l_flags & USER_LOCK_ATTACHED)) { spin_unlock(&lockres->l_lock); goto bail; } lockres->l_flags &= ~USER_LOCK_ATTACHED; lockres->l_flags |= USER_LOCK_BUSY; spin_unlock(&lockres->l_lock); status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK); if (status) { user_log_dlm_error("ocfs2_dlm_unlock", status, lockres); goto bail; } ... } V1 discussion with Joseph: https://lore.kernel.org/all/7b620c53-0c45-da2c-829e-26195cbe7d4e@linux.alibaba.com/T/ Link: https://lkml.kernel.org/r/20220518235224.87100-1-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton commit 7e062cda7d90543ac8c7700fc7c5527d0c0f22ad Merge: 5d1772b1739b0 57d7becda9c9e Author: Linus Torvalds Date: Wed May 25 12:22:58 2022 -0700 Merge tag 'net-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core ---- - Support TCPv6 segmentation offload with super-segments larger than 64k bytes using the IPv6 Jumbogram extension header (AKA BIG TCP). - Generalize skb freeing deferral to per-cpu lists, instead of per-socket lists. - Add a netdev statistic for packets dropped due to L2 address mismatch (rx_otherhost_dropped). - Continue work annotating skb drop reasons. - Accept alternative netdev names (ALT_IFNAME) in more netlink requests. - Add VLAN support for AF_PACKET SOCK_RAW GSO. - Allow receiving skb mark from the socket as a cmsg. - Enable memcg accounting for veth queues, sysctl tables and IPv6. BPF --- - Add libbpf support for User Statically-Defined Tracing (USDTs). - Speed up symbol resolution for kprobes multi-link attachments. - Support storing typed pointers to referenced and unreferenced objects in BPF maps. - Add support for BPF link iterator. - Introduce access to remote CPU map elements in BPF per-cpu map. - Allow middle-of-the-road settings for the kernel.unprivileged_bpf_disabled sysctl. - Implement basic types of dynamic pointers e.g. to allow for dynamically sized ringbuf reservations without extra memory copies. Protocols --------- - Retire port only listening_hash table, add a second bind table hashed by port and address. Avoid linear list walk when binding to very popular ports (e.g. 443). - Add bridge FDB bulk flush filtering support allowing user space to remove all FDB entries matching a condition. - Introduce accept_unsolicited_na sysctl for IPv6 to implement router-side changes for RFC9131. - Support for MPTCP path manager in user space. - Add MPTCP support for fallback to regular TCP for connections that have never connected additional subflows or transmitted out-of-sequence data (partial support for RFC8684 fallback). - Avoid races in MPTCP-level window tracking, stabilize and improve throughput. - Support lockless operation of GRE tunnels with seq numbers enabled. - WiFi support for host based BSS color collision detection. - Add support for SO_TXTIME/SCM_TXTIME on CAN sockets. - Support transmission w/o flow control in CAN ISOTP (ISO 15765-2). - Support zero-copy Tx with TLS 1.2 crypto offload (sendfile). - Allow matching on the number of VLAN tags via tc-flower. - Add tracepoint for tcp_set_ca_state(). Driver API ---------- - Improve error reporting from classifier and action offload. - Add support for listing line cards in switches (devlink). - Add helpers for reporting page pool statistics with ethtool -S. - Add support for reading clock cycles when using PTP virtual clocks, instead of having the driver convert to time before reporting. This makes it possible to report time from different vclocks. - Support configuring low-latency Tx descriptor push via ethtool. - Separate Clause 22 and Clause 45 MDIO accesses more explicitly. New hardware / drivers ---------------------- - Ethernet: - Marvell's Octeon NIC PCI Endpoint support (octeon_ep) - Sunplus SP7021 SoC (sp7021_emac) - Add support for Renesas RZ/V2M (in ravb) - Add support for MediaTek mt7986 switches (in mtk_eth_soc) - Ethernet PHYs: - ADIN1100 industrial PHYs (w/ 10BASE-T1L and SQI reporting) - TI DP83TD510 PHY - Microchip LAN8742/LAN88xx PHYs - WiFi: - Driver for pureLiFi X, XL, XC devices (plfxlc) - Driver for Silicon Labs devices (wfx) - Support for WCN6750 (in ath11k) - Support Realtek 8852ce devices (in rtw89) - Mobile: - MediaTek T700 modems (Intel 5G 5000 M.2 cards) - CAN: - ctucanfd: add support for CTU CAN FD open-source IP core from Czech Technical University in Prague Drivers ------- - Delete a number of old drivers still using virt_to_bus(). - Ethernet NICs: - intel: support TSO on tunnels MPLS - broadcom: support multi-buffer XDP - nfp: support VF rate limiting - sfc: use hardware tx timestamps for more than PTP - mlx5: multi-port eswitch support - hyper-v: add support for XDP_REDIRECT - atlantic: XDP support (including multi-buffer) - macb: improve real-time perf by deferring Tx processing to NAPI - High-speed Ethernet switches: - mlxsw: implement basic line card information querying - prestera: add support for traffic policing on ingress and egress - Embedded Ethernet switches: - lan966x: add support for packet DMA (FDMA) - lan966x: add support for PTP programmable pins - ti: cpsw_new: enable bc/mc storm prevention - Qualcomm 802.11ax WiFi (ath11k): - Wake-on-WLAN support for QCA6390 and WCN6855 - device recovery (firmware restart) support - support setting Specific Absorption Rate (SAR) for WCN6855 - read country code from SMBIOS for WCN6855/QCA6390 - enable keep-alive during WoWLAN suspend - implement remain-on-channel support - MediaTek WiFi (mt76): - support Wireless Ethernet Dispatch offloading packet movement between the Ethernet switch and WiFi interfaces - non-standard VHT MCS10-11 support - mt7921 AP mode support - mt7921 IPv6 NS offload support - Ethernet PHYs: - micrel: ksz9031/ksz9131: cabletest support - lan87xx: SQI support for T1 PHYs - lan937x: add interrupt support for link detection" * tag 'net-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1809 commits) ptp: ocp: Add firmware header checks ptp: ocp: fix PPS source selector debugfs reporting ptp: ocp: add .init function for sma_op vector ptp: ocp: vectorize the sma accessor functions ptp: ocp: constify selectors ptp: ocp: parameterize input/output sma selectors ptp: ocp: revise firmware display ptp: ocp: add Celestica timecard PCI ids ptp: ocp: Remove #ifdefs around PCI IDs ptp: ocp: 32-bit fixups for pci start address Revert "net/smc: fix listen processing for SMC-Rv2" ath6kl: Use cc-disable-warning to disable -Wdangling-pointer selftests/bpf: Dynptr tests bpf: Add dynptr data slices bpf: Add bpf_dynptr_read and bpf_dynptr_write bpf: Dynptr support for ring buffers bpf: Add bpf_dynptr_from_mem for local dynptrs bpf: Add verifier support for dynptrs bpf: Suppress 'passing zero to PTR_ERR' warning bpf: Introduce bpf_arch_text_invalidate for bpf_prog_pack ... commit 5d1772b1739b085721431eef0c0400f3aff01abf Merge: 8b49c4b1b6f63 10a5a651e3afc Author: Linus Torvalds Date: Wed May 25 11:59:19 2022 -0700 Merge branch 'for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue update from Tejun Heo: "A lone commit fixing CPU offline handling for per-cpu wq workers so that they don't bother isolated CPUs" * 'for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs commit 8b49c4b1b6f6397aca3eaee4c79295b74350b7b4 Merge: 64e34b50d7aee b154a017c9201 Author: Linus Torvalds Date: Wed May 25 11:47:25 2022 -0700 Merge branch 'for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Nothing too interesting. This adds cpu controller selftests and there are a couple code cleanup patches" * 'for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: remove the superfluous judgment cgroup: Make cgroup_debug static kseltest/cgroup: Make test_stress.sh work if run interactively kselftest/cgroup: fix test_stress.sh to use OUTPUT dir cgroup: Add config file to cgroup selftest suite cgroup: Add test_cpucg_max_nested() testcase cgroup: Add test_cpucg_max() testcase cgroup: Add test_cpucg_nested_weight_underprovisioned() testcase cgroup: Adding test_cpucg_nested_weight_overprovisioned() testcase cgroup: Add test_cpucg_weight_underprovisioned() testcase cgroup: Add test_cpucg_weight_overprovisioned() testcase cgroup: Add test_cpucg_stats() testcase to cgroup cpu selftests cgroup: Add new test_cpu.c test suite in cgroup selftests commit af7dc8e5124daf017ebc85c8ea97212e1e2e62fe Author: Jeff Layton Date: Mon May 23 13:22:09 2022 -0400 MAINTAINERS: move myself from ceph "Maintainer" to "Reviewer" Xiubo has graciously volunteered to take over for me as the Linux cephfs client maintainer. Make it official by changing myself to be a "Reviewer" for libceph and ceph. Signed-off-by: Jeff Layton Acked-by: Xiubo Li Signed-off-by: Ilya Dryomov commit ea16567f11018e2f58e72b667b0c803ff92b8153 Author: Luís Henriques Date: Mon May 23 17:09:51 2022 +0100 ceph: fix decoding of client session messages flags The cephfs kernel client started to show the message: ceph: mds0 session blocklisted when mounting a filesystem. This is due to the fact that the session messages are being incorrectly decoded: the skip needs to take into account the 'len'. While there, fixed some whitespaces too. Cc: stable@vger.kernel.org Fixes: e1c9788cb397 ("ceph: don't rely on error_string to validate blocklisted session.") Signed-off-by: Luís Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5e56776d5215ab5ab886006fc749346bad8473c8 Author: Xiubo Li Date: Wed May 18 22:49:26 2022 +0800 ceph: switch TASK_INTERRUPTIBLE to TASK_KILLABLE If the task is placed in the TASK_INTERRUPTIBLE state it will sleep until either something explicitly wakes it up, or a non-masked signal is received. Switch to TASK_KILLABLE to avoid the noises. Cc: Matthew Wilcox Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 2ecd0edd13a8bed87c3588bcd4a048113eff18f6 Author: Colin Ian King Date: Wed May 18 09:55:08 2022 +0100 ceph: remove redundant variable ino Variable ino is being assigned a value that is never read. The variable and assignment are redundant, remove it. Cleans up clang scan build warning: warning: Although the value stored to 'ino' is used in the enclosing expression, the value is never actually read from 'ino' [deadcode.DeadStores] Signed-off-by: Colin Ian King Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit a74379543d229a3fb1af8cd44cbd19844a7bb1bc Author: Xiubo Li Date: Wed Apr 27 14:14:41 2022 +0800 ceph: try to queue a writeback if revoking fails If the pagecaches writeback just finished and the i_wrbuffer_ref reaches zero it will try to trigger ceph_check_caps(). But if just before ceph_check_caps() the i_wrbuffer_ref could be increased again by mmap/cache write, then the Fwb revoke will fail. We need to try to queue a writeback in this case instead of triggering the writeback by BDI's delayed work per 5 seconds. URL: https://tracker.ceph.com/issues/46904 URL: https://tracker.ceph.com/issues/55377 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 55ab5520802016b13098e0ea3794480289659aab Author: Luís Henriques Date: Wed Apr 27 16:57:04 2022 +0100 ceph: fix statfs for subdir mounts When doing a mount using as base a directory that has 'max_bytes' quotas statfs uses that value as the total; if a subdirectory is used instead, the same 'max_bytes' too in statfs, unless there is another quota set. Unfortunately, if this subdirectory only has the 'max_files' quota set, then statfs uses the filesystem total. Fix this by making sure we only lookup realms that contain the 'max_bytes' quota. Cc: Ryan Taylor URL: https://tracker.ceph.com/issues/55090 Signed-off-by: Luís Henriques Reviewed-by: Jeff Layton Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 825978fd6a0defc3c29d8a38b6cea76a0938d21e Author: Xiubo Li Date: Mon Apr 25 16:08:24 2022 +0800 ceph: fix possible deadlock when holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately: ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL: https://tracker.ceph.com/issues/55377 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 3459bd0c55ed28f86a1fd2e01e376492cb6d4f91 Author: Xiubo Li Date: Sun Apr 24 17:35:53 2022 +0800 ceph: redirty the page for writepage on failure When run out of memories we should redirty the page before failing the writepage. Or we will hit BUG_ON(folio_get_private(folio)) in ceph_dirty_folio(). URL: https://tracker.ceph.com/issues/55421 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5eed80fba65cd707075892450bc5d6bd464862a0 Author: Xiubo Li Date: Thu Apr 21 11:26:40 2022 +0800 ceph: try to choose the auth MDS if possible for getattr If any 'x' caps is issued we can just choose the auth MDS instead of the random replica MDSes. Because only when the Locker is in LOCK_EXEC state will the loner client could get the 'x' caps. And if we send the getattr requests to any replica MDS it must auth pin and tries to rdlock from the auth MDS, and then the auth MDS need to do the Locker state transition to LOCK_SYNC. And after that the lock state will change back. This cost much when doing the Locker state transition and usually will need to revoke caps from clients. URL: https://tracker.ceph.com/issues/55240 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit f7a2d0688a3b2bb4769402b4c962f54f7b0fc23c Author: Xiubo Li Date: Wed Apr 20 13:13:02 2022 +0800 ceph: disable updating the atime since cephfs won't maintain it Since CephFS makes no attempt to maintain atime, we shouldn't try to update it in mmap and generic read cases and ignore updating it in direct and sync read cases. And even we update it in mmap and generic read cases we will drop it and won't sync it to MDS. And we are seeing the atime will be updated and then dropped to the floor again and again. URL: https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/VSJM7T4CS5TDRFF6XFPIYMHP75K73PZ6/ Signed-off-by: Xiubo Li Acked-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 1b2ba3c5616e17ff951359e25c658a1c3f146f1e Author: Xiubo Li Date: Tue Apr 19 08:58:49 2022 +0800 ceph: flush the mdlog for filesystem sync Before waiting for a request's safe reply, we will send the mdlog flush request to the relevant MDS. And this will also flush the mdlog for all the other unsafe requests in the same session, so we can record the last session and no need to flush mdlog again in the next loop. But there still have cases that it may send the mdlog flush requst twice or more, but that should be not often. Rename wait_unsafe_requests() to flush_mdlog_and_wait_mdsc_unsafe_requests() to make it more descriptive. [xiubli: fold in MDS request refcount leak fix from Jeff] URL: https://tracker.ceph.com/issues/55284 URL: https://tracker.ceph.com/issues/55411 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit ae0670633014d172fab3772fff2da99269d17874 Author: Xiubo Li Date: Mon Apr 18 20:04:51 2022 +0800 ceph: rename unsafe_request_wait() Rename it to flush_mdlog_and_wait_inode_unsafe_requests() to make it more descriptive. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit d9d58f0402a8bd14b980e6f41a5aa28aa0ca0e04 Author: Guo Zhengkui Date: Tue Apr 12 14:46:20 2022 +0800 libceph: use swap() macro instead of taking tmp variable Fix the following coccicheck warning: net/ceph/crush/mapper.c:1077:8-9: WARNING opportunity for swap() by using swap() for the swapping of variable values and drop the tmp variable that is not needed any more. Signed-off-by: Guo Zhengkui Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 261998c30004f0e6eeddd24b1eb5e504cfacee18 Author: Xiubo Li Date: Mon Apr 11 09:59:09 2022 +0800 ceph: fix statx AT_STATX_DONT_SYNC vs AT_STATX_FORCE_SYNC check From the posix and the initial statx supporting commit comments, the AT_STATX_DONT_SYNC is a lightweight stat and the AT_STATX_FORCE_SYNC is a heaverweight one. And also checked all the other current usage about these two flags they are all doing the same, that is only when the AT_STATX_FORCE_SYNC is not set and the AT_STATX_DONT_SYNC is set will they skip sync retriving the attributes from storage. Signed-off-by: Xiubo Li Reviewed-by: David Howells Signed-off-by: Ilya Dryomov commit 68e5ec2ec94576bee4d5280d512ed47e6f876baf Author: Xiubo Li Date: Thu Apr 7 13:12:42 2022 +0800 ceph: no need to invalidate the fscache twice Fixes: 400e1286c0ec3 ("ceph: conversion to new fscache API") Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 3ffa9d6f991facd370fe35fd7fcbdbf5d1063afd Author: Jakob Koschel Date: Thu Mar 31 23:53:29 2022 +0200 ceph: replace usage of found with dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 57a5df0e8653a4ae4fa8f8fbfed8f1f0d734ebc0 Author: Jakob Koschel Date: Thu Mar 31 23:53:28 2022 +0200 ceph: use dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 7ffe4fcea789552fac47216188f30559c329c847 Author: Xiubo Li Date: Wed Mar 30 12:21:12 2022 +0800 ceph: update the dlease for the hashed dentry when removing The MDS will always refresh the dentry lease when removing the files or directories. And if the dentry is still hashed, we can update the dentry lease and no need to do the lookup from the MDS later. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 546a5d6122faae161cb59159e8af8518130efeab Author: Xiubo Li Date: Wed Mar 30 14:39:33 2022 +0800 ceph: stop retrying the request when exceeding 256 times The type of 'r_attempts' in kernel 'ceph_mds_request' is 'int', while in 'ceph_mds_request_head' the type of 'num_retry' is '__u8'. So in case the request retries exceeding 256 times, the MDS will receive a incorrect retry seq. In this case it's ususally a bug in MDS and continue retrying the request makes no sense. For now let's limit it to 256. In future this could be fixed in ceph code, so avoid using the hardcode here. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 1980b1bf17a4975fee5ee42df167f50f7f67b3d9 Author: Xiubo Li Date: Tue Mar 29 12:48:01 2022 +0800 ceph: stop forwarding the request when exceeding 256 times The type of 'num_fwd' in ceph 'MClientRequestForward' is 'int32_t', while in 'ceph_mds_request_head' the type is '__u8'. So in case the request bounces between MDSes exceeding 256 times, the client will get stuck. In this case it's ususally a bug in MDS and continue bouncing the request makes no sense. URL: https://tracker.ceph.com/issues/55130 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit 6c1dc50284c4dab9f1e563efba6f9c4a47af894a Author: Xiubo Li Date: Mon Mar 28 10:25:35 2022 +0800 ceph: remove unused CEPH_MDS_LEASE_RELEASE related code The ceph_mdsc_lease_release() has been removed by commit 8aa152c77890 (ceph: remove ceph_mdsc_lease_release). ceph_mdsc_lease_send_msg will never be called with CEPH_MDS_LEASE_RELEASE. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 3302ffd44c3d70e77ad5764d15f5028a6ade540a Author: Jakob Koschel Date: Thu Mar 24 08:20:50 2022 +0100 rbd: replace usage of found with dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d7a2dc523085f8b8c60548ceedc696934aefeb0e Author: Venky Shankar Date: Thu Mar 10 09:34:19 2022 -0500 ceph: allow ceph.dir.rctime xattr to be updatable `rctime' has been a pain point in cephfs due to its buggy nature - inconsistent values reported and those sorts. Fixing rctime is non-trivial needing an overall redesign of the entire nested statistics infrastructure. As a workaround, PR http://github.com/ceph/ceph/pull/37938 allows this extended attribute to be manually set. This allows users to "fixup" inconsistent rctime values. While this sounds messy, its probably the wisest approach allowing users/scripts to workaround buggy rctime values. The above PR enables Ceph MDS to allow manually setting rctime extended attribute with the corresponding user-land changes. We may as well allow the same to be done via kclient for parity. Signed-off-by: Venky Shankar Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 64e34b50d7aeee7082287ec39f9d34d4e60f3a04 Merge: 1c6d2ead87e94 e7eaffce47b7d Author: Linus Torvalds Date: Wed May 25 11:32:53 2022 -0700 Merge tag 'linux-kselftest-kunit-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: "Several fixes, cleanups, and enhancements to tests and framework: - introduce _NULL and _NOT_NULL macros to pointer error checks - rework kunit_resource allocation policy to fix memory leaks when caller doesn't specify free() function to be used when allocating memory using kunit_add_resource() and kunit_alloc_resource() funcs. - add ability to specify suite-level init and exit functions" * tag 'linux-kselftest-kunit-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (41 commits) kunit: tool: Use qemu-system-i386 for i386 runs kunit: fix executor OOM error handling logic on non-UML kunit: tool: update riscv QEMU config with new serial dependency kcsan: test: use new suite_{init,exit} support kunit: tool: Add list of all valid test configs on UML kunit: take `kunit_assert` as `const` kunit: tool: misc cleanups kunit: tool: minor cosmetic cleanups in kunit_parser.py kunit: tool: make parser stop overwriting status of suites w/ no_tests kunit: tool: remove dead parse_crash_in_log() logic kunit: tool: print clearer error message when there's no TAP output kunit: tool: stop using a shell to run kernel under QEMU kunit: tool: update test counts summary line format kunit: bail out of test filtering logic quicker if OOM lib/Kconfig.debug: change KUnit tests to default to KUNIT_ALL_TESTS kunit: Rework kunit_resource allocation policy kunit: fix debugfs code to use enum kunit_status, not bool kfence: test: use new suite_{init/exit} support, add .kunitconfig kunit: add ability to specify suite-level init and exit functions kunit: rename print_subtest_{start,end} for clarity (s/subtest/suite) ... commit 1c6d2ead87e94f3d2bacb0c4539686ea7a92d50b Merge: 88a618920e9ba 15477b31db104 Author: Linus Torvalds Date: Wed May 25 11:30:21 2022 -0700 Merge tag 'linux-kselftest-next-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: "Several fixes, cleanups, and enhancements to tests: - add mips support for kprobe args string and syntax tests - updates to resctrl test to use kselftest framework - fixes, cleanups, and enhancements to tests" * tag 'linux-kselftest-next-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftests/ir : Improve readability of modprobe error message selftests/resctrl: Fix null pointer dereference on open failed selftests/resctrl: Add missing SPDX license to Makefile selftests/resctrl: Update README about using kselftest framework to build/run resctrl_tests selftests/resctrl: Make resctrl_tests run using kselftest framework selftests/resctrl: Fix resctrl_tests' return code to work with selftest framework selftests/resctrl: Change the default limited time to 120 seconds selftests/resctrl: Kill child process before parent process terminates if SIGTERM is received selftests/resctrl: Print a message if the result of MBM&CMT tests is failed on Intel CPU selftests/resctrl: Extend CPU vendor detection selftests/x86/corrupt_xstate_header: Use provided __cpuid_count() macro selftests/x86/amx: Use provided __cpuid_count() macro selftests/vm/pkeys: Use provided __cpuid_count() macro selftests: Provide local define of __cpuid_count() selftests/damon: add damon to selftests root Makefile selftests/binderfs: Improve message to provide more info selftests: mqueue: drop duplicate min definition selftests/ftrace: add mips support for kprobe args syntax tests selftests/ftrace: add mips support for kprobe args string tests commit 88a618920e9baabc1780479e2fbb68e5551d0563 Merge: 537e62c865dcb b86f46d5ce3e7 Author: Linus Torvalds Date: Wed May 25 11:17:41 2022 -0700 Merge tag 'docs-5.19' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It was a moderately busy cycle for documentation; highlights include: - After a long period of inactivity, the Japanese translations are seeing some much-needed maintenance and updating. - Reworked IOMMU documentation - Some new documentation for static-analysis tools - A new overall structure for the memory-management documentation. This is an LSFMM outcome that, it is hoped, will help encourage developers to fill in the many gaps. Optimism is eternal...but hopefully it will work. - More Chinese translations. Plus the usual typo fixes, updates, etc" * tag 'docs-5.19' of git://git.lwn.net/linux: (70 commits) docs: pdfdocs: Add space for chapter counts >= 100 in TOC docs/zh_CN: Add dev-tools/gdb-kernel-debugging.rst Chinese translation input: Docs: correct ntrig.rst typo input: Docs: correct atarikbd.rst typos MAINTAINERS: Become the docs/zh_CN maintainer docs/zh_CN: fix devicetree usage-model translation mm,doc: Add new documentation structure Documentation: drop more IDE boot options and ide-cd.rst Documentation/process: use scripts/get_maintainer.pl on patches MAINTAINERS: Add entry for DOCUMENTATION/JAPANESE docs/trans/ja_JP/howto: Don't mention specific kernel versions docs/ja_JP/SubmittingPatches: Request summaries for commit references docs/ja_JP/SubmittingPatches: Add Suggested-by as a standard signature docs/ja_JP/SubmittingPatches: Randy has moved docs/ja_JP/SubmittingPatches: Suggest the use of scripts/get_maintainer.pl docs/ja_JP/SubmittingPatches: Update GregKH links Documentation/sysctl: document max_rcu_stall_to_panic Documentation: add missing angle bracket in cgroup-v2 doc Documentation: dev-tools: use literal block instead of code-block docs/zh_CN: add vm numa translation ... commit 908ea6541661d72c6852650f91adebba88b0de0b Author: Yufen Yu Date: Wed May 25 17:43:36 2022 +0800 f2fs: add f2fs_init_write_merge_io function Almost all other initialization of variables in f2fs_fill_super are extraced to a single function. Also do it for write_io[], which can make code more clean. This patch just refactors the code, theres no functional change. Signed-off-by: Yufen Yu Reviewed-by: Chao Yu [Jaegeuk Kim: clean up] Signed-off-by: Jaegeuk Kim commit f403f22f8ccb12860b2b62fec3173c6ccd45938b Author: Kefeng Wang Date: Fri May 20 10:18:33 2022 +0800 mm: kfence: use PAGE_ALIGNED helper Use PAGE_ALIGNED macro instead of IS_ALIGNED and passing PAGE_SIZE. Link: https://lkml.kernel.org/r/20220520021833.121405-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Muchun Song Cc: Marco Elver Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton commit 0598739900071feff82b89f1515f963a6889b330 Author: Patrick Wang Date: Sat May 21 16:38:25 2022 +0800 selftests: vm: add the "settings" file with timeout variable The default "timeout" for one kselftest is 45 seconds, while some cases in run_vmtests.sh require more time. This will cause testing timeout like: not ok 4 selftests: vm: run_vmtests.sh # TIMEOUT 45 seconds Therefore, add the "settings" file with timeout variable so users can set the "timeout" value. Link: https://lkml.kernel.org/r/20220521083825.319654-4-patrick.wang.shcn@gmail.com Signed-off-by: Patrick Wang Cc: Shuah Khan Signed-off-by: Andrew Morton commit ccd2a1201d267bf6f1950bf31cfd55fb4e17a231 Author: Patrick Wang Date: Sat May 21 16:38:24 2022 +0800 selftests: vm: add "test_hmm.sh" to TEST_FILES The "test_hmm.sh" file used by run_vmtests.sh dose not be installed into INSTALL_PATH. Thus run_vmtests.sh can not call it in INSTALL_PATH: --------------------------- running ./test_hmm.sh smoke --------------------------- ./run_vmtests.sh: line 74: ./test_hmm.sh: No such file or directory [FAIL] ----------------------- Add "test_hmm.sh" to TEST_FILES so that it will be installed. Link: https://lkml.kernel.org/r/20220521083825.319654-3-patrick.wang.shcn@gmail.com Signed-off-by: Patrick Wang Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9aa1af954db02a3228763015356684a169503c68 Author: Patrick Wang Date: Sat May 21 16:38:23 2022 +0800 selftests: vm: check numa_available() before operating "merge_across_nodes" in ksm_tests Patch series "selftests: vm: a few fixup patches". This series contains three fixup patches for vm selftests. They are independent. Please see the patches. This patch (of 3): Currently, ksm_tests operates "merge_across_nodes" with NUMA either enabled or disabled. In a system with NUMA disabled, these operations will fail and output a misleading report given "merge_across_nodes" does not exist in sysfs: ---------------------------- running ./ksm_tests -M -p 10 ---------------------------- f /sys/kernel/mm/ksm/merge_across_nodes fopen: No such file or directory Cannot save default tunables [FAIL] ---------------------- So check numa_available() before those operations to skip them if NUMA is disabled. Link: https://lkml.kernel.org/r/20220521083825.319654-1-patrick.wang.shcn@gmail.com Link: https://lkml.kernel.org/r/20220521083825.319654-2-patrick.wang.shcn@gmail.com Signed-off-by: Patrick Wang Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3d3921ed271b0e23d60c91fcad089f2f5e71af98 Author: Muhammad Usama Anjum Date: Sat May 21 14:43:13 2022 +0500 selftests: vm: add migration to the .gitignore Add newly added migration test object to .gitignore file. Link: https://lkml.kernel.org/r/20220521094313.166505-1-usama.anjum@collabora.com Fixes: 0c2d08728470 ("mm: add selftests for migration entries") Signed-off-by: Muhammad Usama Anjum Reviewed-by: Alistair Popple Signed-off-by: Andrew Morton commit 75c96ccea2e1de1342996722ee505d2cadedc0dd Author: Julia Lawall Date: Sat May 21 13:11:30 2022 +0200 selftests/vm/pkeys: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lkml.kernel.org/r/20220521111145.81697-80-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit 3413b2c872c3fe5cf3b11d4e73de55098c81c7a3 Author: Julia Lawall Date: Sat May 21 13:11:44 2022 +0200 ksm: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lkml.kernel.org/r/20220521111145.81697-94-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit 33776141b81296e604a39a8065b28b89c61c7f74 Author: Suren Baghdasaryan Date: Wed May 18 13:43:16 2022 -0700 selftests: vm: add process_mrelease tests Introduce process_mrelease syscall sanity tests which include tests which expect to fail: - process_mrelease with invalid pidfd and flags inputs - process_mrelease on a live process with no pending signals and valid process_mrelease usage which is expected to succeed. Because process_mrelease has to be used against a process with a pending SIGKILL, it's possible that the process exits before process_mrelease gets called. In such cases we retry the test with a victim that allocates twice more memory up to 1GB. This would require the victim process to spend more time during exit and process_mrelease has a better chance of catching the process before it exits and succeeding. On success the test reports the amount of memory the child had to allocate for reaping to succeed. Sample output: $ mrelease_test Success reaping a child with 1MB of memory allocations On failure the test reports the failure. Sample outputs: $ mrelease_test All process_mrelease attempts failed! $ mrelease_test process_mrelease: Invalid argument Link: https://lkml.kernel.org/r/20220518204316.13131-1-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Shuah Khan Acked-by: Christian Brauner (Microsoft) Reviewed-by: Muhammad Usama Anjum Cc: Michal Hocko Cc: David Rientjes Cc: Matthew Wilcox (Oracle) Cc: Johannes Weiner Cc: Roman Gushchin Cc: Minchan Kim Cc: "Kirill A . Shutemov" Cc: Andrea Arcangeli Cc: Christoph Hellwig Cc: Oleg Nesterov Cc: David Hildenbrand Cc: Jann Horn Cc: Shakeel Butt Cc: Peter Xu Cc: John Hubbard Signed-off-by: Andrew Morton commit 3f1509c57b1ba5646de0fb8d81bd7107aec22257 Author: Johannes Weiner Date: Wed May 18 15:09:11 2022 -0400 Revert "mm/vmscan: never demote for memcg reclaim" This reverts commit 3a235693d3930e1276c8d9cc0ca5807ef292cf0a. Its premise was that cgroup reclaim cares about freeing memory inside the cgroup, and demotion just moves them around within the cgroup limit. Hence, pages from toptier nodes should be reclaimed directly. However, with NUMA balancing now doing tier promotions, demotion is part of the page aging process. Global reclaim demotes the coldest toptier pages to secondary memory, where their life continues and from which they have a chance to get promoted back. Essentially, tiered memory systems have an LRU order that spans multiple nodes. When cgroup reclaims pages coming off the toptier directly, there can be colder pages on lower tier nodes that were demoted by global reclaim. This is an aging inversion, not unlike if cgroups were to reclaim directly from the active lists while there are inactive pages. Proactive reclaim is another factor. The goal of that it is to offload colder pages from expensive RAM to cheaper storage. When lower tier memory is available as an intermediate layer, we want offloading to take advantage of it instead of bypassing to storage. Revert the patch so that cgroups respect the LRU order spanning the memory hierarchy. Of note is a specific undercommit scenario, where all cgroup limits in the system add up to <= available toptier memory. In that case, shuffling pages out to lower tiers first to reclaim them from there is inefficient. This is something could be optimized/short-circuited later on (although care must be taken not to accidentally recreate the aging inversion). Let's ensure correctness first. Link: https://lkml.kernel.org/r/20220518190911.82400-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Dave Hansen Reviewed-by: Yang Shi Acked-by: Roman Gushchin Reviewed-by: "Huang, Ying" Reviewed-by: Muchun Song Acked-by: Michal Hocko Acked-by: Shakeel Butt Acked-by: Tim Chen Cc: Zi Yan Signed-off-by: Andrew Morton commit 83d7d04f9d2ef354858b2a8444aee38e41ec1699 Author: Jackie Liu Date: Wed May 18 15:31:05 2022 +0800 mm/kfence: print disabling or re-enabling message By printing information, we can friendly prompt the status change information of kfence by dmesg and record by syslog. Also, set kfence_enabled to false only when needed. Link: https://lkml.kernel.org/r/20220518073105.3160335-1-liu.yun@linux.dev Signed-off-by: Jackie Liu Co-developed-by: Marco Elver Signed-off-by: Marco Elver Reviewed-by: Marco Elver Signed-off-by: Andrew Morton commit e5c3f619a04d9e191de66d5f8e069367f73a6487 Author: Vasily Averin Date: Tue May 17 09:55:51 2022 +0300 include/trace/events/percpu.h: cleanup for "percpu: improve percpu_alloc_percpu event trace" Fix sparse warning about incorrect gfp_t cast. Link: https://lkml.kernel.org/r/001979f3-e978-0998-cbed-61a4a2ac87b8@openvz.org Fixes: f67bed134a05 ("percpu: improve percpu_alloc_percpu event trace") Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton commit 185194f19134716f32b2ab04ac76cf93ea85706a Author: Vasily Averin Date: Tue May 17 09:58:14 2022 +0300 include/trace/events/mmflags.h: cleanup for "tracing: incorrect gfp_t conversion" Redefines __def_gfpflag_names array according to akpm@, willy@ and Joe Perches recommendations. Link: https://lkml.kernel.org/r/6f811e19-41c6-f3e8-fca6-23a19a62e313@openvz.org Fixes: fe573327ffb1 ("tracing: incorrect gfp_t conversion") Signed-off-by: Vasily Averin Cc: Matthew Wilcox Cc: Joe Perches Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 88ee134320b8311ca7a00630e5ba013cd0239350 Author: Zi Yan Date: Tue May 24 15:47:56 2022 -0400 mm: fix a potential infinite loop in start_isolate_page_range() In isolate_single_pageblock() called by start_isolate_page_range(), there are some pageblock isolation issues causing a potential infinite loop when isolating a page range. This is reported by Qian Cai. 1. the pageblock was isolated by just changing pageblock migratetype without checking unmovable pages. Calling set_migratetype_isolate() to isolate pageblock properly. 2. an off-by-one error caused migrating pages unnecessarily, since the page is not crossing pageblock boundary. 3. migrating a compound page across pageblock boundary then splitting the free page later has a small race window that the free page might be allocated again, so that the code will try again, causing an potential infinite loop. Temporarily set the to-be-migrated page's pageblock to MIGRATE_ISOLATE to prevent that and bail out early if no free page is found after page migration. An additional fix to split_free_page() aims to avoid crashing in __free_one_page(). When the free page is split at the specified split_pfn_offset, free_page_order should check both the first bit of free_page_pfn and the last bit of split_pfn_offset and use the smaller one. For example, if free_page_pfn=0x10000, split_pfn_offset=0xc000, free_page_order should first be 0x8000 then 0x4000, instead of 0x4000 then 0x8000, which the original algorithm did. [akpm@linux-foundation.org: suppress min() warning] Link: https://lkml.kernel.org/r/20220524194756.1698351-1-zi.yan@sent.com Fixes: b2c9e2fbba3253 ("mm: make alloc_contig_range work at pageblock granularity") Signed-off-by: Zi Yan Reported-by: Qian Cai Cc: Christophe Leroy Cc: David Hildenbrand Cc: Eric Ren Cc: Mel Gorman Cc: Mike Rapoport Cc: Minchan Kim Cc: Oscar Salvador Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bb5ced41a658e51bb72d3dc651b28e344e001ac9 Author: Muchun Song Date: Sat May 21 15:41:03 2022 +0800 MAINTAINERS: add Muchun as co-maintainer for HugeTLB I have been focusing on mm for the past two years. e.g. developing, fixing bugs, reviewing related to HugeTLB system. I would like to help Mike and other people working on HugeTLB by reviewing their work. When I first introduced the vmemmmap reduction, I forgot to update MAINTAINERS file. Let's update it as well. And rename "HUGETLB FILESYSTEM" to "HUGETLB SUBSYSTEM" since some files are not only related to filesystem but also memory management (the name of FILESYSTEM cannot cover this area). Link: https://lkml.kernel.org/r/20220521074103.79468-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: Mike Kravetz Signed-off-by: Andrew Morton commit 6140ae41effe0fff80ff3d6f1bfdff64aa06e9b4 Author: Randy Dunlap Date: Sun May 22 13:40:27 2022 -0700 zram: fix Kconfig dependency warning ZSMALLOC depends on MMU so ZRAM should also depend on MMU since 'select' does not follow any dependency chains. Fixes this Kconfig warning: WARNING: unmet direct dependencies detected for ZSMALLOC Depends on [n]: MMU [=n] Selected by [y]: - ZRAM [=y] && BLK_DEV [=y] && BLOCK [=y] && SYSFS [=y] && (CRYPTO_LZO [=y] || CRYPTO_ZSTD [=m] || CRYPTO_LZ4 [=m] || CRYPTO_LZ4HC [=n] || CRYPTO_842 [=n]) Link: https://lkml.kernel.org/r/20220522204027.22964-1-rdunlap@infradead.org Fixes: b3fbd58fcbb10 ("mm: Kconfig: simplify zswap configuration") Signed-off-by: Randy Dunlap Acked-by: Johannes Weiner Cc: Minchan Kim Cc: Nitin Gupta Cc: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton commit e384200e70664cd690cdadb72b2a1bc9dfcdec1a Author: Hugh Dickins Date: Sat May 21 19:53:04 2022 -0700 mm/shmem: fix shmem folio swapoff hang Shmem swapoff makes no progress: the index to indices is not incremented. But "ret" is no longer a return value, so use folio_batch_count() instead. Link: https://lkml.kernel.org/r/c32bee8a-f0aa-245-f94e-24dd271924fa@google.com Fixes: da08e9b79323 ("mm/shmem: convert shmem_swapin_page() to shmem_swapin_folio()") Signed-off-by: Hugh Dickins Reviewed-by: Miaohe Lin Tested-by: Miaohe Lin Cc: Matthew Wilcox Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit 7fb6378701dc0d8f19c1ac4623b55f5125f0e286 Author: Christophe JAILLET Date: Sun May 22 16:18:51 2022 +0200 cgroup: fix an error handling path in alloc_pagecache_max_30M() If the first goto is taken, 'fd' is not opened yet (and is un-initialized). So a direct return is safer. Link: https://lkml.kernel.org/r/628312312eb40e0e39463a2c06415fde5295c716.1653229120.git.christophe.jaillet@wanadoo.fr Fixes: c1a31a2f7a9c ("cgroup: fix racy check in alloc_pagecache_max_30M() helper function") Signed-off-by: Christophe JAILLET Reviewed-by: Andrew Morton Cc: Dan Carpenter Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Shakeel Butt Cc: Muchun Song Cc: Tejun Heo Cc: Zefan Li Cc: Shuah Khan Cc: David Vernet Signed-off-by: Andrew Morton commit 537e62c865dcb9b91d07ed83f8615b71fa0b51bb Merge: 2e17ce1106e04 1c6fd59943a63 Author: Linus Torvalds Date: Wed May 25 10:32:08 2022 -0700 Merge tag 'printk-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Offload writing printk() messages on consoles to per-console kthreads. It prevents soft-lockups when an extensive amount of messages is printed. It was observed, for example, during boot of large systems with a lot of peripherals like disks or network interfaces. It prevents live-lockups that were observed, for example, when messages about allocation failures were reported and a CPU handled consoles instead of reclaiming the memory. It was hard to solve even with rate limiting because it would need to take into account the amount of messages and the speed of all consoles. It is a must to have for real time. Otherwise, any printk() might break latency guarantees. The per-console kthreads allow to handle each console on its own speed. Slow consoles do not longer slow down faster ones. And printk() does not longer unpredictably slows down various code paths. There are situations when the kthreads are either not available or not reliable, for example, early boot, suspend, or panic. In these situations, printk() uses the legacy mode and tries to handle consoles immediately. - Add documentation for the printk index. * tag 'printk-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk, tracing: fix console tracepoint printk: remove @console_locked printk: extend console_lock for per-console locking printk: add kthread console printers printk: add functions to prefer direct printing printk: add pr_flush() printk: move buffer definitions into console_emit_next_record() caller printk: refactor and rework printing logic printk: add con_printk() macro for console details printk: call boot_delay_msec() in printk_delay() printk: get caller_id/timestamp after migration disable printk: wake waiters for safe and NMI contexts printk: wake up all waiters printk: add missing memory barrier to wake_up_klogd() printk: cpu sync always disable interrupts printk: rename cpulock functions printk/index: Printk index feature documentation MAINTAINERS: Add printk indexing maintainers on mention of printk_index commit 2e17ce1106e04a7f3a83796ec623881487f75dd3 Merge: caa28984163cb e001897da62eb Author: Linus Torvalds Date: Wed May 25 10:24:04 2022 -0700 Merge tag 'slab-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - Conversion of slub_debug stack traces to stackdepot, allowing more useful debugfs-based inspection for e.g. memory leak debugging. Allocation and free debugfs info now includes full traces and is sorted by the unique trace frequency. The stackdepot conversion was already attempted last year but reverted by ae14c63a9f20. The memory overhead (while not actually enabled on boot) has been meanwhile solved by making the large stackdepot allocation dynamic. The xfstest issues haven't been reproduced on current kernel locally nor in -next, so the slab cache layout changes that originally made that bug manifest were probably not the root cause. - Refactoring of dma-kmalloc caches creation. - Trivial cleanups such as removal of unused parameters, fixes and clarifications of comments. - Hyeonggon Yoo joins as a reviewer. * tag 'slab-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: MAINTAINERS: add myself as reviewer for slab mm/slub: remove unused kmem_cache_order_objects max mm: slab: fix comment for __assume_kmalloc_alignment mm: slab: fix comment for ARCH_KMALLOC_MINALIGN mm/slub: remove unneeded return value of slab_pad_check mm/slab_common: move dma-kmalloc caches creation into new_kmalloc_cache() mm/slub: remove meaningless node check in ___slab_alloc() mm/slub: remove duplicate flag in allocate_slab() mm/slub: remove unused parameter in setup_object*() mm/slab.c: fix comments slab, documentation: add description of debugfs files for SLUB caches mm/slub: sort debugfs output by frequency of stack traces mm/slub: distinguish and print stack traces in debugfs files mm/slub: use stackdepot to save stack trace in objects mm/slub: move struct track init out of set_track() lib/stackdepot: allow requesting early initialization dynamically mm/slub, kunit: Make slub_kunit unaffected by user specified flags mm/slab: remove some unused functions commit caa28984163cb63ea0be4cb8dbf05defdc7303f9 Author: Linus Torvalds Date: Wed May 25 09:02:19 2022 -0700 linux/types.h: reinstate "__bitwise__" macro for user space use Commit c724c866bb70 ("linux/types.h: remove unnecessary __bitwise__") was right that there are no users of __bitwise__ in the kernel, but it turns out there are user space users of it that do expect it. It is, after all, in the uapi directory, so user space usage is to be expected. Instead of reverting the commit completely, let's just clarify the situation so that it doesn't happen again, and have some in-code explanations for why that "__bitwise__" still exists. Reported-by: Jiri Slaby Cc: Bjorn Helgaas Link: https://lore.kernel.org/all/b5c0a68d-8387-4909-beea-f70ab9e6e3d5@kernel.org/ Signed-off-by: Linus Torvalds commit e5499dd7253c8382d03f687f19a854adcc688357 Author: Sean Young Date: Wed May 25 14:08:30 2022 +0100 media: lirc: revert removal of unused feature flags Commit b2a90f4fcb14 ("media: lirc: remove unused lirc features") removed feature flags which were never implemented, but they are still used by the lirc daemon went built from source. Reinstate these symbols in order not to break the lirc build. Fixes: b2a90f4fcb14 ("media: lirc: remove unused lirc features") Link: https://lore.kernel.org/all/a0470450-ecfd-2918-e04a-7b57c1fd7694@kernel.org/ Reported-by: Jiri Slaby Cc: Mauro Carvalho Chehab Signed-off-by: Sean Young Signed-off-by: Linus Torvalds commit 86dca369075b3e310c3c0adb0f81e513c562b5e4 Author: Kan Liang Date: Wed May 25 06:39:52 2022 -0700 perf/x86/intel: Fix event constraints for ICL According to the latest event list, the event encoding 0x55 INST_DECODED.DECODERS and 0x56 UOPS_DECODED.DEC0 are only available on the first 4 counters. Add them into the event constraints table. Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") Signed-off-by: Kan Liang Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220525133952.1660658-1-kan.liang@linux.intel.com commit 108ea7eb3e754be735a1c33d2713a19527fb2065 Author: Juerg Haefliger Date: Wed May 25 15:39:49 2022 +0200 perf/x86/Kconfig: Fix indentation in the Kconfig file The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. Signed-off-by: Juerg Haefliger Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220525133949.53730-1-juerg.haefliger@canonical.com commit 1a23accae82d780b5d5de6254d32c270aeb7f664 Author: Linus Walleij Date: Sun May 22 09:23:56 2022 +0200 ARM: ixp4xx: Consolidate Kconfig fixing issue The IXP4xx Kconfig we ended up with for mach-ixp4xx creates as kismet warning: WARNING: unmet direct dependencies detected for GPIO_IXP4XX Depends on [n]: GPIOLIB [=y] && HAS_IOMEM [=y] && ARCH_IXP4XX [=y] && OF [=n] Selected by [y]: - ARCH_IXP4XX [=y] && This is because it is possible to select ARCH_IXP4XX witout OF while that selects the GPIO driver that now depends on OF. Fix this by creating a single ARCH_IXP4XX kconfig that selects USE_OF. Reported-by: kernel test robot Signed-off-by: Linus Walleij Cc: Arnd Bergmann Cc: Imre Kaloz Cc: Krzysztof Halasa Link: https://lore.kernel.org/r/20220522072356.34062-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit 4fe4f1552394d41442205f9cde93af00eda59435 Author: Srinivas Pandruvada Date: Mon May 23 11:16:55 2022 -0700 Documentation: admin-guide: PM: Add Out of Band mode Update documentation for using the tool to support performance level change via OOB (Out of Band) interface. Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 20eb48885b62d5de4ab6be7e08f9f55aa33333fd Author: sunliming Date: Wed May 25 09:28:27 2022 +0800 x86/idt: Remove unused headers Commit: 4b9a8dca0e58 ("x86/idt: Remove the tracing IDT completely") removed the 'tracing IDT' from arch/x86/kernel/tracepoint.c, but left related headers included - remove them. [ mingo: Tweak changelog. ] Signed-off-by: sunliming Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220525012827.93464-1-sunliming@kylinos.cn commit 3c1d004bdb4e12b4b1dfbdd6a9167ea5003e48cd Author: Sumeet Pawnikar Date: Mon May 23 23:18:52 2022 +0530 thermal: int340x: Add Meteor Lake PCI device ID Add Meteor Lake PCI ID for processor thermal device. Signed-off-by: Sumeet Pawnikar Reviewed-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 0ecfacb4c50ae2fd32ee1898562fe55f045b56d2 Author: Juerg Haefliger Date: Wed May 25 15:32:03 2022 +0200 x86/Kconfig: Fix indentation of arch/x86/Kconfig.debug The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. Signed-off-by: Juerg Haefliger Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220525133203.52463-3-juerg.haefliger@canonical.com commit 758cd94a0e16ddbc5607428f28170897f67c2964 Author: Juerg Haefliger Date: Wed May 25 15:32:02 2022 +0200 x86/Kconfig: Fix indentation and add endif comments to arch/x86/Kconfig The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. While add it, add missing trailing endif comments and squeeze multiple empty lines. Signed-off-by: Juerg Haefliger Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220525133203.52463-2-juerg.haefliger@canonical.com commit 657b95d34ba3cecc62993817a21896475110603d Author: Sumeet Pawnikar Date: Mon May 23 23:16:30 2022 +0530 ACPI: DPTF: Support Meteor Lake Add Meteor Lake ACPI IDs for DPTF devices. Signed-off-by: Sumeet Pawnikar Reviewed-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 8a33d96bd178d5f49cc5c1898e4cda08e221d2db Author: XueBing Chen Date: Wed May 25 16:51:01 2022 +0800 x86/setup: Use strscpy() to replace deprecated strlcpy() strlcpy() is marked deprecated and should not be used, because it doesn't limit the source length. The preferred interface for when strlcpy()'s return value is not checked (truncation) is strscpy(). [ mingo: Tweaked the changelog ] Signed-off-by: XueBing Chen Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/730f0fef.a33.180fa69880f.Coremail.chenxuebing@jari.cn commit 9e12eb8231496682525b6f9ba04131132d139759 Author: Julia Lawall Date: Sat May 21 13:10:13 2022 +0200 ACPI: CPPC: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Rafael J. Wysocki commit 0125de38122f0f66bf61336158d12a1aabfe6425 Author: Takashi Iwai Date: Wed May 25 15:12:03 2022 +0200 ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4c691a287d4ee0c308708c1d6f9e0cc7513463f8 Author: Takashi Iwai Date: Wed May 25 14:20:18 2022 +0200 ALSA: usb-audio: Add mixer mapping for Gigabyte B450/550 Mobos This patch implements a static mapping for Gigabyte B450/550 Mobos so that the mixer elements appear reasonably and jack detections work properly. Reported-and-tested-by: Brock Szuszczewicz BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215988 Link: https://lore.kernel.org/r/20220525122018.3299-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e04314082c3197874f0cb3f4031219e811741a49 Merge: 09583dfed2cb9 22079af7df5a5 Author: Rafael J. Wysocki Date: Wed May 25 15:02:26 2022 +0200 Merge tag 'opp-updates-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP (Operating Performance Points) updates for 5.19-rc1 from Viresh Kumar: - Minor update to dt-binding for Qcom's opp-v2-kryo-cpu (Yassine Oudjana). - Use list iterator only inside the list_for_each_entry loop (Xiaomeng Tong, and Jakob Koschel). - New APIs related to finding OPP based on interconnect bandwidth (Krzysztof Kozlowski). - Fix the missing of_node_put() in _bandwidth_supported() (Dan Carpenter). - Cleanups (Krzysztof Kozlowski, and Viresh Kumar). * tag 'opp-updates-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: opp: Reorder definition of ceil/floor helpers opp: Add apis to retrieve opps with interconnect bandwidth dt-bindings: opp: opp-v2-kryo-cpu: Remove SMEM opp: use list iterator only inside the loop opp: replace usage of found with dedicated list iterator variable PM: opp: simplify with dev_err_probe() OPP: call of_node_put() on error path in _bandwidth_supported() commit 990247af7cf59190271da405458aefaed985e831 Merge: 09583dfed2cb9 39b360102f3ac Author: Rafael J. Wysocki Date: Wed May 25 15:01:30 2022 +0200 Merge tag 'cpufreq-arm-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull ARM cpufreq updates for 5.19-rc1 from Viresh Kumar: - Tegra234 cpufreq support (Sumit Gupta). - Mediatek cleanups and enhancements (Wan Jiabing, Rex-BC Chen, and Jia-Wei Chang). * tag 'cpufreq-arm-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: (21 commits) cpufreq: mediatek: Add support for MT8186 cpufreq: mediatek: Link CCI device to CPU dt-bindings: cpufreq: mediatek: Add MediaTek CCI property cpufreq: mediatek: Fix potential deadlock problem in mtk_cpufreq_set_target cpufreq: mediatek: Add opp notification support cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking() cpufreq: mediatek: Move voltage limits to platform data cpufreq: mediatek: Unregister platform device on exit cpufreq: mediatek: Fix NULL pointer dereference in mediatek-cpufreq cpufreq: mediatek: Make sram regulator optional cpufreq: mediatek: Record previous target vproc value cpufreq: mediatek: Replace old_* with pre_* cpufreq: mediatek: Use device print to show logs cpufreq: mediatek: Enable clocks and regulators cpufreq: mediatek: Remove unused headers cpufreq: mediatek: Cleanup variables and error handling in mtk_cpu_dvfs_info_init() cpufreq: mediatek: Use module_init and add module_exit arm64: tegra: add node for tegra234 cpufreq cpufreq: tegra194: Add support for Tegra234 cpufreq: tegra194: add soc data to support multiple soc ... commit da007f171fc9dd993d03a360b515cac1c87921bb Author: Dmitry Osipenko Date: Wed May 25 00:21:18 2022 +0300 kernel/reboot: Change registration order of legacy power-off handler We're unconditionally registering sys-off handler for the legacy pm_power_off() callback, this causes problem for platforms that don't use power-off handlers at all and should be halted. Now reboot syscall assumes that there is a power-off handler installed and tries to power off system instead of halting it. To fix the trouble, move the handler's registration to the reboot syscall and check the pm_power_off() presence. Fixes: 0e2110d2e910 ("kernel/reboot: Add kernel_can_power_off()") Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit de3a9e943ddecba8d2ac1dde4cfff538e5c6a7b9 Author: Paulo Alcantara Date: Wed May 25 07:37:04 2022 -0500 cifs: fix ntlmssp on old servers Some older servers seem to require the workstation name during ntlmssp to be at most 15 chars (RFC1001 name length), so truncate it before sending when using insecure dialects. Link: https://lore.kernel.org/r/e6837098-15d9-acb6-7e34-1923cf8c6fe1@winds.org Reported-by: Byron Stanoszek Tested-by: Byron Stanoszek Fixes: 49bd49f983b5 ("cifs: send workstation name during ntlmssp session setup") Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit cfd6d63e596552e1a5bf38bb889997b656475032 Author: Geert Uytterhoeven Date: Mon May 23 19:55:20 2022 +0200 m68k: virt: Switch to new sys-off handler API On m68k with CONFIG_VIRT=y (e.g. virt_defconfig or allmodconfig): arch/m68k/virt/config.c: In function ‘config_virt’: arch/m68k/virt/config.c:129:2: error: ‘mach_power_off’ undeclared (first use in this function); did you mean ‘pm_power_off’? 129 | mach_power_off = virt_halt; | ^~~~~~~~~~~~~~ | pm_power_off Commit 05d51e42df06f021 ("m68k: Introduce a virtual m68k machine") introduced a new user of mach_power_off. Convert it to the new sys-off handler API, too. Reported-by: noreply@ellerman.id.au Fixes: f0f7e5265b3b37b0 ("m68k: Switch to new sys-off handler API") Signed-off-by: Geert Uytterhoeven Signed-off-by: Rafael J. Wysocki commit 14c03a4a757f4be3e81c5004ca72f809ab04e0b1 Merge: 09583dfed2cb9 6779db970bd28 Author: Rafael J. Wysocki Date: Wed May 25 14:38:29 2022 +0200 Merge back reboot/poweroff notifiers rework for 5.19-rc1. commit 9f56390f8c49a1e2f38f049673dcbb407a742302 Author: Tom Rix Date: Sat May 21 15:59:42 2022 -0400 video: fbdev: xen: remove setting of 'transp' parameter cppcheck reports [drivers/video/fbdev/xen-fbfront.c:226]: (style) Assignment of function parameter has no effect outside the function. The value parameter 'transp' is not used, so setting it can be removed. Signed-off-by: Tom Rix Reviewed-by: Geert Uytterhoeven Reviewed-by: Juergen Gross Signed-off-by: Helge Deller commit 54739cc6b4e12b8bf3802536634b8e896eb796b1 Author: Jens Axboe Date: Mon May 23 16:49:31 2022 -0600 io_uring: make prep and issue side of req handlers named consistently Almost all of them are, the odd ones out are the poll remove and the files update request. Name them like the others, which is: io_#cmdname_prep for request preparation io_#cmdname for request issue Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit ecddc25d1355d0ce2b486a4991b826b6e87875a9 Author: Jens Axboe Date: Mon May 23 16:13:56 2022 -0600 io_uring: make timeout prep handlers consistent with other prep handlers All other opcodes take a {req, sqe} set for prep handling, split out a timeout prep handler so that timeout and linked timeouts can use the same one. Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit c9bfb460c3e4da2462e16b0f0b200990b36b1dd2 Author: Nico Boehr Date: Tue May 24 15:43:20 2022 +0200 s390/perf: obtain sie_block from the right address Since commit 1179f170b6f0 ("s390: fix fpu restore in entry.S"), the sie_block pointer is located at empty1[1], but in sie_block() it was taken from empty1[0]. This leads to a random pointer being dereferenced, possibly causing system crash. This problem can be observed when running a simple guest with an endless loop and recording the cpu-clock event: sudo perf kvm --guestvmlinux= --guest top -e cpu-clock With this fix, the correct guest address is shown. Fixes: 1179f170b6f0 ("s390: fix fpu restore in entry.S") Cc: stable@vger.kernel.org Acked-by: Christian Borntraeger Acked-by: Claudio Imbrenda Reviewed-by: Heiko Carstens Signed-off-by: Nico Boehr Signed-off-by: Heiko Carstens commit 3384f135e90f96a7697a85c33081e46c0a0f415d Author: Heiko Carstens Date: Mon May 23 14:42:40 2022 +0200 s390: generate register offsets into pt_regs automatically Use asm offsets method to generate register offsets into pt_regs, instead of open-coding at several places. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 85806016acb0610e47ffcd5415d1575f18f58a33 Author: Heiko Carstens Date: Fri May 20 19:23:48 2022 +0200 s390: simplify early program check handler Due to historic reasons the base program check handler calls a configurable function. Given that there is only the early program check handler left, simplify the code by directly calling that function. The only other user was removed with commit d485235b0054 ("s390: assume diag308 set always works"). Also rename all functions and the asm file to reflect this. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit bd52cd5e23f134019b23f0c389db0f9a436e4576 Author: Jann Horn Date: Tue May 17 16:30:47 2022 +0200 s390/crypto: fix scatterwalk_unmap() callers in AES-GCM The argument of scatterwalk_unmap() is supposed to be the void* that was returned by the previous scatterwalk_map() call. The s390 AES-GCM implementation was instead passing the pointer to the struct scatter_walk. This doesn't actually break anything because scatterwalk_unmap() only uses its argument under CONFIG_HIGHMEM and ARCH_HAS_FLUSH_ON_KUNMAP. Fixes: bf7fa038707c ("s390/crypto: add s390 platform specific aes gcm support.") Signed-off-by: Jann Horn Acked-by: Harald Freudenberger Link: https://lore.kernel.org/r/20220517143047.3054498-1-jannh@google.com Signed-off-by: Heiko Carstens commit 6821ad8770340825f17962cf5ef64ebaffee7fd7 Author: Maciej Żenczykowski Date: Wed May 18 14:05:48 2022 -0700 xfrm: do not set IPv4 DF flag when encapsulating IPv6 frames <= 1280 bytes. One may want to have DF set on large packets to support discovering path mtu and limiting the size of generated packets (hence not setting the XFRM_STATE_NOPMTUDISC tunnel flag), while still supporting networks that are incapable of carrying even minimal sized IPv6 frames (post encapsulation). Having IPv4 Don't Frag bit set on encapsulated IPv6 frames that are not larger than the minimum IPv6 mtu of 1280 isn't useful, because the resulting ICMP Fragmentation Required error isn't actionable (even assuming you receive it) because IPv6 will not drop it's path mtu below 1280 anyway. While the IPv4 stack could prefrag the packets post encap, this requires the ICMP error to be successfully delivered and causes a loss of the original IPv6 frame (thus requiring a retransmit and latency hit). Luckily with IPv4 if we simply don't set the DF flag, we'll just make further fragmenting the packets some other router's problems. We'll still learn the correct IPv4 path mtu through encapsulation of larger IPv6 frames. I'm still not convinced this patch is entirely sufficient to make everything happy... but I don't see how it could possibly make things worse. See also recent: 4ff2980b6bd2 'xfrm: fix tunnel model fragmentation behavior' and friends Cc: Lorenzo Colitti Cc: Eric Dumazet Cc: Lina Wang Cc: Steffen Klassert Signed-off-by: Maciej Zenczykowski Signed-off-by: Steffen Klassert commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 Author: Michal Kubecek Date: Mon May 23 22:05:24 2022 +0200 Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7. A non-zero return value from pfkey_broadcast() does not necessarily mean an error occurred as this function returns -ESRCH when no registered listener received the message. In particular, a call with BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return zero so that this commit in fact prevents processing any PF_KEY message. One visible effect is that racoon daemon fails to find encryption algorithms like aes and refuses to start. Excluding -ESRCH return value would fix this but it's not obvious that we really want to bail out here and most other callers of pfkey_broadcast() also ignore the return value. Also, as pointed out by Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code should use netlink instead so that we should only disturb the code for really important fixes. v2: add a comment explaining why is the return value ignored Signed-off-by: Michal Kubecek Signed-off-by: Steffen Klassert commit ffd1925a596ce68bed7d81c61cb64bc35f788a9d Author: Yanfei Xu Date: Mon May 23 22:08:21 2022 +0800 KVM: x86: Fix the intel_pt PMI handling wrongly considered from guest When kernel handles the vm-exit caused by external interrupts and NMI, it always sets kvm_intr_type to tell if it's dealing an IRQ or NMI. For the PMI scenario, it could be IRQ or NMI. However, intel_pt PMIs are only generated for HARDWARE perf events, and HARDWARE events are always configured to generate NMIs. Use kvm_handling_nmi_from_guest() to precisely identify if the intel_pt PMI came from the guest; this avoids false positives if an intel_pt PMI/NMI arrives while the host is handling an unrelated IRQ VM-Exit. Fixes: db215756ae59 ("KVM: x86: More precisely identify NMI from guest when handling PMI") Signed-off-by: Yanfei Xu Message-Id: <20220523140821.1345605-1-yanfei.xu@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 366d4a12cdcf3d83c8162ff6e0046c123567c754 Author: Like Xu Date: Thu May 19 01:01:17 2022 +0800 KVM: selftests: x86: Sync the new name of the test case to .gitignore Fixing side effect of the so-called opportunistic change in the commit. Fixes: dc8a9febbab0 ("KVM: selftests: x86: Fix test failure on arch lbr capable platforms") Signed-off-by: Like Xu Message-Id: <20220518170118.66263-2-likexu@tencent.com> Signed-off-by: Paolo Bonzini commit 186af6bb40c4fd2048bb81253c1109d8b3011e42 Author: Paolo Bonzini Date: Fri May 20 07:22:46 2022 -0400 Documentation: kvm: reorder ARM-specific section about KVM_SYSTEM_EVENT_SUSPEND Signed-off-by: Paolo Bonzini commit baec4f5a018fe2d708fc1022330dba04b38b5fe3 Author: Paolo Bonzini Date: Tue May 24 09:43:31 2022 -0400 x86, kvm: use correct GFP flags for preemption disabled Commit ddd7ed842627 ("x86/kvm: Alloc dummy async #PF token outside of raw spinlock") leads to the following Smatch static checker warning: arch/x86/kernel/kvm.c:212 kvm_async_pf_task_wake() warn: sleeping in atomic context arch/x86/kernel/kvm.c 202 raw_spin_lock(&b->lock); 203 n = _find_apf_task(b, token); 204 if (!n) { 205 /* 206 * Async #PF not yet handled, add a dummy entry for the token. 207 * Allocating the token must be down outside of the raw lock 208 * as the allocator is preemptible on PREEMPT_RT kernels. 209 */ 210 if (!dummy) { 211 raw_spin_unlock(&b->lock); --> 212 dummy = kzalloc(sizeof(*dummy), GFP_KERNEL); ^^^^^^^^^^ Smatch thinks the caller has preempt disabled. The `smdb.py preempt kvm_async_pf_task_wake` output call tree is: sysvec_kvm_asyncpf_interrupt() <- disables preempt -> __sysvec_kvm_asyncpf_interrupt() -> kvm_async_pf_task_wake() The caller is this: arch/x86/kernel/kvm.c 290 DEFINE_IDTENTRY_SYSVEC(sysvec_kvm_asyncpf_interrupt) 291 { 292 struct pt_regs *old_regs = set_irq_regs(regs); 293 u32 token; 294 295 ack_APIC_irq(); 296 297 inc_irq_stat(irq_hv_callback_count); 298 299 if (__this_cpu_read(apf_reason.enabled)) { 300 token = __this_cpu_read(apf_reason.token); 301 kvm_async_pf_task_wake(token); 302 __this_cpu_write(apf_reason.token, 0); 303 wrmsrl(MSR_KVM_ASYNC_PF_ACK, 1); 304 } 305 306 set_irq_regs(old_regs); 307 } The DEFINE_IDTENTRY_SYSVEC() is a wrapper that calls this function from the call_on_irqstack_cond(). It's inside the call_on_irqstack_cond() where preempt is disabled (unless it's already disabled). The irq_enter/exit_rcu() functions disable/enable preempt. Reported-by: Dan Carpenter Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 619f51da097952194a5d4d6a6c5f9ef3b9d1b25a Author: Wanpeng Li Date: Fri May 20 10:15:18 2022 -0400 KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer The timer is disarmed when switching between TSC deadline and other modes; however, the pending timer is still in-flight, so let's accurately remove any traces of the previous mode. Fixes: 4427593258 ("KVM: x86: thoroughly disarm LAPIC timer around TSC deadline switch") Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 0547758a6de3cc71a0cfdd031a3621a30db6a68b Author: Sean Christopherson Date: Thu May 19 07:57:11 2022 -0700 x86/kvm: Alloc dummy async #PF token outside of raw spinlock Drop the raw spinlock in kvm_async_pf_task_wake() before allocating the the dummy async #PF token, the allocator is preemptible on PREEMPT_RT kernels and must not be called from truly atomic contexts. Opportunistically document why it's ok to loop on allocation failure, i.e. why the function won't get stuck in an infinite loop. Reported-by: Yajun Deng Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit fee060cd52d69c114b62d1a2948ea9648b5131f9 Author: Sean Christopherson Date: Fri Mar 11 03:27:41 2022 +0000 KVM: x86: avoid calling x86 emulator without a decoded instruction Whenever x86_decode_emulated_instruction() detects a breakpoint, it returns the value that kvm_vcpu_check_breakpoint() writes into its pass-by-reference second argument. Unfortunately this is completely bogus because the expected outcome of x86_decode_emulated_instruction is an EMULATION_* value. Then, if kvm_vcpu_check_breakpoint() does "*r = 0" (corresponding to a KVM_EXIT_DEBUG userspace exit), it is misunderstood as EMULATION_OK and x86_emulate_instruction() is called without having decoded the instruction. This causes various havoc from running with a stale emulation context. The fix is to move the call to kvm_vcpu_check_breakpoint() where it was before commit 4aa2691dcbd3 ("KVM: x86: Factor out x86 instruction emulation with decoding") introduced x86_decode_emulated_instruction(). The other caller of the function does not need breakpoint checks, because it is invoked as part of a vmexit and the processor has already checked those before executing the instruction that #GP'd. This fixes CVE-2022-1852. Reported-by: Qiuhao Li Reported-by: Gaoning Pan Reported-by: Yongkang Jia Fixes: 4aa2691dcbd3 ("KVM: x86: Factor out x86 instruction emulation with decoding") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220311032801.3467418-2-seanjc@google.com> [Rewrote commit message according to Qiuhao's report, since a patch already existed to fix the bug. - Paolo] Signed-off-by: Paolo Bonzini commit d22d2474e3953996f03528b84b7f52cc26a39403 Author: Ashish Kalra Date: Mon May 16 15:43:10 2022 +0000 KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak For some sev ioctl interfaces, the length parameter that is passed maybe less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the allocated buffer, these sev ioctl interface may return uninitialized kernel slab memory. Reported-by: Andy Nguyen Suggested-by: David Rientjes Suggested-by: Peter Gonda Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Fixes: eaf78265a4ab3 ("KVM: SVM: Move SEV code to separate file") Fixes: 2c07ded06427d ("KVM: SVM: add support for SEV attestation command") Fixes: 4cfdd47d6d95a ("KVM: SVM: Add KVM_SEV SEND_START command") Fixes: d3d1af85e2c75 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") Fixes: eba04b20e4861 ("KVM: x86: Account a variety of miscellaneous allocations") Signed-off-by: Ashish Kalra Reviewed-by: Peter Gonda Message-Id: <20220516154310.3685678-1-Ashish.Kalra@amd.com> Signed-off-by: Paolo Bonzini commit d187ba5312307d51818beafaad87d28a7d939adf Author: Sean Christopherson Date: Wed May 4 00:12:19 2022 +0000 x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave) Set the starting uABI size of KVM's guest FPU to 'struct kvm_xsave', i.e. to KVM's historical uABI size. When saving FPU state for usersapce, KVM (well, now the FPU) sets the FP+SSE bits in the XSAVE header even if the host doesn't support XSAVE. Setting the XSAVE header allows the VM to be migrated to a host that does support XSAVE without the new host having to handle FPU state that may or may not be compatible with XSAVE. Setting the uABI size to the host's default size results in out-of-bounds writes (setting the FP+SSE bits) and data corruption (that is thankfully caught by KASAN) when running on hosts without XSAVE, e.g. on Core2 CPUs. WARN if the default size is larger than KVM's historical uABI size; all features that can push the FPU size beyond the historical size must be opt-in. ================================================================== BUG: KASAN: slab-out-of-bounds in fpu_copy_uabi_to_guest_fpstate+0x86/0x130 Read of size 8 at addr ffff888011e33a00 by task qemu-build/681 CPU: 1 PID: 681 Comm: qemu-build Not tainted 5.18.0-rc5-KASAN-amd64 #1 Hardware name: /DG35EC, BIOS ECG3510M.86A.0118.2010.0113.1426 01/13/2010 Call Trace: dump_stack_lvl+0x34/0x45 print_report.cold+0x45/0x575 kasan_report+0x9b/0xd0 fpu_copy_uabi_to_guest_fpstate+0x86/0x130 kvm_arch_vcpu_ioctl+0x72a/0x1c50 [kvm] kvm_vcpu_ioctl+0x47f/0x7b0 [kvm] __x64_sys_ioctl+0x5de/0xc90 do_syscall_64+0x31/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xae Allocated by task 0: (stack is not available) The buggy address belongs to the object at ffff888011e33800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes to the right of 512-byte region [ffff888011e33800, ffff888011e33a00) The buggy address belongs to the physical page: page:0000000089cd4adb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e30 head:0000000089cd4adb order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888001041c80 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888011e33900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888011e33980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888011e33a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888011e33a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011e33b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Fixes: be50b2065dfa ("kvm: x86: Add support for getting/setting expanded xstate buffer") Fixes: c60427dd50ba ("x86/fpu: Add uabi_size to guest_fpu") Reported-by: Zdenek Kaspar Cc: Maciej S. Szmigiero Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Tested-by: Zdenek Kaspar Message-Id: <20220504001219.983513-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit eb3de2d8f78d893303891d879f941c47f2f2d13d Author: Paolo Bonzini Date: Mon May 23 15:23:21 2022 -0400 s390/uv_uapi: depend on CONFIG_S390 Signed-off-by: Paolo Bonzini commit 1644e270592001f47572c70106d618283ece1ef6 Merge: b699da3dc2795 c71159648c3cf Author: Paolo Bonzini Date: Wed May 25 05:11:21 2022 -0400 Merge tag 'kvm-s390-next-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fix and feature for 5.19 - ultravisor communication device driver - fix TEID on terminating storage key ops commit b699da3dc27959091fafbd906853a38cfc2887a7 Merge: 47e8eec832620 fed9b26b2501e Author: Paolo Bonzini Date: Wed May 25 05:09:49 2022 -0400 Merge tag 'kvm-riscv-5.19-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 5.19 - Added Sv57x4 support for G-stage page table - Added range based local HFENCE functions - Added remote HFENCE functions based on VCPU requests - Added ISA extension registers in ONE_REG interface - Updated KVM RISC-V maintainers entry to cover selftests support commit 47e8eec83262083c7da220446551eaad614218ea Merge: 825be3b5abae1 5c0ad551e9aa6 Author: Paolo Bonzini Date: Fri May 20 07:16:27 2022 -0400 Merge tag 'kvmarm-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 5.19 - Add support for the ARMv8.6 WFxT extension - Guard pages for the EL2 stacks - Trap and emulate AArch32 ID registers to hide unsupported features - Ability to select and save/restore the set of hypercalls exposed to the guest - Support for PSCI-initiated suspend in collaboration with userspace - GICv3 register-based LPI invalidation support - Move host PMU event merging into the vcpu data structure - GICv3 ITS save/restore fixes - The usual set of small-scale cleanups and fixes [Due to the conflict, KVM_SYSTEM_EVENT_SEV_TERM is relocated from 4 to 6. - Paolo] commit 825be3b5abae1e67db45ff7d4b9a7764a2419bd9 Author: Yang Weijiang Date: Thu May 12 04:40:46 2022 -0400 KVM: selftests: x86: Fix test failure on arch lbr capable platforms On Arch LBR capable platforms, LBR_FMT in perf capability msr is 0x3f, so the last format test will fail. Use a true invalid format(0x30) for the test if it's running on these platforms. Opportunistically change the file name to reflect the tests actually carried out. Suggested-by: Paolo Bonzini Signed-off-by: Yang Weijiang Message-Id: <20220512084046.105479-1-weijiang.yang@intel.com> Signed-off-by: Paolo Bonzini commit e0ac535178ad32c2a4898e2309dcc49ad546e96e Author: Wanpeng Li Date: Tue Apr 26 01:25:51 2022 -0700 KVM: LAPIC: Trace LAPIC timer expiration on every vmentry In commit ec0671d5684a ("KVM: LAPIC: Delay trace_kvm_wait_lapic_expire tracepoint to after vmexit", 2019-06-04), trace_kvm_wait_lapic_expire was moved after guest_exit_irqoff() because invoking tracepoints within kvm_guest_enter/kvm_guest_exit caused a lockdep splat. These days this is not necessary, because commit 87fa7f3e98a1 ("x86/kvm: Move context tracking where it belongs", 2020-07-09) restricted the RCU extended quiescent state to be closer to vmentry/vmexit. Moving the tracepoint back to __kvm_wait_lapic_expire is more accurate, because it will be reported even if vcpu_enter_guest causes multiple vmentries via the IPI/Timer fast paths, and it allows the removal of advance_expire_delta. Signed-off-by: Wanpeng Li Message-Id: <1650961551-38390-1-git-send-email-wanpengli@tencent.com> Signed-off-by: Paolo Bonzini commit 6e516faf04317db2c46cbec4e3b78b4653a5b109 Author: Steven Price Date: Thu May 19 16:20:03 2022 +0100 drm/panfrost: Job should reference MMU not file_priv For a while now it's been allowed for a MMU context to outlive it's corresponding panfrost_priv, however the job structure still references panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat. To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed. Fixes: 7fdc48cc63a3 ("drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv") Signed-off-by: Steven Price Acked-by: Alyssa Rosenzweig Link: https://patchwork.freedesktop.org/patch/msgid/20220519152003.81081-1-steven.price@arm.com commit 83969805cc716a7dc6b296c3fb1bc7e5cd7ca321 Author: Hector Martin Date: Tue May 24 23:22:06 2022 +0900 pinctrl: apple: Use a raw spinlock for the regmap The irqchip ops are called with a raw spinlock held, so the subsequent regmap usage cannot use a plain spinlock. spi-hid-apple-of spi0.0: spihid_apple_of_probe:74 ============================= [ BUG: Invalid wait context ] 5.18.0-asahi-00176-g0fa3ab03bdea #1337 Not tainted ----------------------------- kworker/u20:3/86 is trying to lock: ffff8000166b5018 (pinctrl_apple_gpio:462:(®map_config)->lock){....}-{3:3}, at: regmap_lock_spinlock+0x18/0x30 other info that might help us debug this: context-{5:5} 7 locks held by kworker/u20:3/86: #0: ffff800017725d48 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1c8/0x670 #1: ffff80001e33bdd0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1c8/0x670 #2: ffff800017d629a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x30/0x17c #3: ffff80002414e618 (&ctlr->add_lock){+.+.}-{4:4}, at: spi_add_device+0x40/0x80 #4: ffff800024116990 (&dev->mutex){....}-{4:4}, at: __device_attach+0x30/0x17c #5: ffff800022d4be58 (request_class){+.+.}-{4:4}, at: __setup_irq+0xa8/0x720 #6: ffff800022d4bcc8 (lock_class){....}-{2:2}, at: __setup_irq+0xcc/0x720 Fixes: a0f160ffcb83 ("pinctrl: add pinctrl/GPIO driver for Apple SoCs") Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20220524142206.18833-1-marcan@marcan.st Signed-off-by: Linus Walleij commit 71cc785d295527587faa8e3d825ef7c0e1cb2d12 Merge: d75c26a9266e1 c17f8fd3f2184 Author: Stephen Boyd Date: Wed May 25 00:27:32 2022 -0700 Merge branch 'clk-qcom' into clk-next * clk-qcom: Revert "clk: qcom: regmap-mux: add pipe clk implementation" Revert "clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" Revert "clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" clk: qcom: rcg2: Cache CFG register updates for parked RCGs clk: qcom: add sc8280xp GCC driver dt-bindings: clock: Add Qualcomm SC8280XP GCC bindings clk: qcom: gcc-msm8976: Add modem reset dt-bindings: clk: qcom: gcc-msm8976: Add modem reset clk: qcom: gcc-msm8976: Set floor ops for SDCC dt-bindings: clock: qcom,gcc-apq8064: Fix typo in compatible and split apq8084 clk: qcom: smd: Update MSM8976 RPM clocks. clk: qcom: gcc-msm8998: add SSC-related clocks dt-bindings: clock: gcc-msm8998: Add definitions of SSC-related clocks dt-bindings: clock: qcom,rpmcc: add clocks property dt-bindings: clock: qcom,rpmcc: convert to dtschema clk: qcom: lpass: Add support for LPASS clock controller for SC7280 dt-bindings: clock: Add YAML schemas for LPASS clocks on SC7280 clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks clk: qcom: regmap-mux: add pipe clk implementation commit d75c26a9266e11e423ec4c69d6c56d8df4911f42 Merge: d3d88716a6ce8 7337342b354b5 e98839fb56ea2 f538ce1123856 538101dd7ce36 83ce0357dcb7f Author: Stephen Boyd Date: Wed May 25 00:27:09 2022 -0700 Merge branches 'clk-rockchip', 'clk-ingenic', 'clk-bindings', 'clk-samsung' and 'clk-stm' into clk-next - Mark some clks critical on Ingenic X1000 - Add STM32MP13 RCC driver (Reset Clock Controller) * clk-rockchip: dt-bindings: clock: convert rockchip,rk3368-cru.txt to YAML dt-bindings: clock: convert rockchip,rk3228-cru.txt to YAML dt-bindings: clock: convert rockchip,rk3036-cru.txt to YAML dt-bindings: clock: convert rockchip,rk3308-cru.txt to YAML dt-bindings: clock: convert rockchip,px30-cru.txt to YAML dt-bindings: clock: convert rockchip,rk3188-cru.txt to YAML dt-bindings: clock: convert rockchip,rk3288-cru.txt to YAML dt-bindings: clock: convert rockchip,rv1108-cru.txt to YAML dt-binding: clock: Add missing rk3568 cru bindings clk: rockchip: Mark hclk_vo as critical on rk3568 dt-bindings: clock: fix rk3399 cru clock issues dt-bindings: clock: use generic node name for pmucru example in rockchip,rk3399-cru.yaml dt-bindings: clock: replace a maintainer for rockchip,rk3399-cru.yaml dt-bindings: clock: fix some conversion style issues for rockchip,rk3399-cru.yaml * clk-ingenic: clk: ingenic-tcu: Fix missing TCU clock for X1000 SoCs mips: ingenic: Do not manually reference the CPU clock clk: ingenic: Mark critical clocks in Ingenic SoCs clk: ingenic: Allow specifying common clock flags * clk-bindings: dt-bindings: clock: Replace common binding with link to schema * clk-samsung: dt-bindings: clock: exynosautov9: correct count of NR_CLK clk: samsung: exynosautov9: add cmu_peric1 clock support clk: samsung: exynosautov9: add cmu_peric0 clock support clk: samsung: exynosautov9: add cmu_fsys2 clock support clk: samsung: exynosautov9: add cmu_busmc clock support clk: samsung: exynosautov9: add cmu_peris clock support clk: samsung: exynosautov9: add cmu_core clock support clk: samsung: add top clock support for Exynos Auto v9 SoC dt-bindings: clock: add Exynos Auto v9 SoC CMU bindings dt-bindings: clock: add clock binding definitions for Exynos Auto v9 * clk-stm: clk: stm32mp13: add safe mux management clk: stm32mp13: add multi mux function clk: stm32mp13: add all STM32MP13 kernel clocks clk: stm32mp13: add all STM32MP13 peripheral clocks clk: stm32mp13: manage secured clocks clk: stm32mp13: add composite clock clk: stm32mp13: add stm32 divider clock clk: stm32mp13: add stm32_gate management clk: stm32mp13: add stm32_mux clock management clk: stm32: Introduce STM32MP13 RCC drivers (Reset Clock Controller) dt-bindings: rcc: stm32: add new compatible for STM32MP13 SoC commit d3d88716a6ce892d3a1fd90d602dded36830ca8d Merge: 2c29798c5d6f5 bea0b66efa654 5876ee756c816 8b9d9e9f8e605 0594058b723b9 3972b152e3da5 Author: Stephen Boyd Date: Wed May 25 00:26:52 2022 -0700 Merge branches 'clk-ux500', 'clk-mtk', 'clk-tegra', 'clk-allwinner' and 'clk-imx' into clk-next - Convert ux500 to clk_hw - Add the two missing CLKOUT clocks for U8500/DB8500 SoC - MediaTek MT8186 SoC clk support - Move MediaTek driver to clk_hw provider APIs * clk-ux500: clk: ux500: fix a possible off-by-one in u8500_prcc_reset_base() clk: ux500: Implement the missing CLKOUT clocks clk: ux500: Rewrite PRCMU clocks to use clk_hw_* clk: ux500: Drop .is_prepared state from PRCMU clocks clk: ux500: Drop .is_enabled state from PRCMU clocks dt-bindings: clock: u8500: Add clkout clock bindings * clk-mtk: (22 commits) clk: mediatek: mt8173: Switch to clk_hw provider APIs clk: mediatek: Switch to clk_hw provider APIs clk: mediatek: Replace 'struct clk' with 'struct clk_hw' clk: mediatek: apmixed: Drop error message from clk_register() failure clk: mediatek: Make mtk_clk_register_composite() static clk: mediatek: use en_mask as a pure div_en_mask clk: mediatek: update compatible string for MT7986 ethsys clk: mediatek: Add MT8186 ipesys clock support clk: mediatek: Add MT8186 mdpsys clock support clk: mediatek: Add MT8186 camsys clock support clk: mediatek: Add MT8186 vencsys clock support clk: mediatek: Add MT8186 vdecsys clock support clk: mediatek: Add MT8186 imgsys clock support clk: mediatek: Add MT8186 wpesys clock support clk: mediatek: Add MT8186 mmsys clock support clk: mediatek: Add MT8186 mfgsys clock support clk: mediatek: Add MT8186 imp i2c wrapper clock support clk: mediatek: Add MT8186 apmixedsys clock support clk: mediatek: Add MT8186 infrastructure clock support clk: mediatek: Add MT8186 topckgen clock support ... * clk-tegra: clk: tegra: Update kerneldoc to match prototypes clk: tegra: Replace .round_rate() with .determine_rate() clk: tegra: Register clocks from root to leaf clk: tegra: Add missing reset deassertion * clk-allwinner: clk: sunxi-ng: h616: Add PLL derived 32KHz clock clk: sunxi-ng: h6-r: Add RTC gate clock * clk-imx: clk: imx8mp: fix usb_root_clk parent clk: imx8mp: add clkout1/2 support clk: imx: scu: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage clk: imx8mp: Add DISP2 pixel clock clk: imx: scu: fix a potential memory leak in __imx_clk_gpr_scu() clk: imx: Add check for kcalloc clk: imx8mn: add GPT support dt-bindings: imx: add clock bindings for i.MX8MN GPT clk: imx: Remove the snvs clock clk: imx8m: check mcore_booted before register clk clk: imx: add mcore_booted module paratemter clk: imx8mq: add 27m phy pll ref clock commit 2c29798c5d6f5756516881cb45eae9d6ca3d2a80 Merge: 560a3164c9a3a b7fa6242f3e03 c6b61d48b369f 5baa12cfc433f 13982e866c74b Author: Stephen Boyd Date: Wed May 25 00:26:38 2022 -0700 Merge branches 'clk-ti', 'clk-cleanup', 'clk-airoha', 'clk-i2c-simple' and 'clk-renesas' into clk-next - Airoha EN7523 SoC system clocks - Use i2c driver probe_new to avoid id scans * clk-ti: clk: ti: clkctrl: replace usage of found with dedicated list iterator variable clk: ti: composite: Prefer kcalloc over open coded arithmetic clk: keystone: syscon-clk: Add support for AM62 epwm-tbclk dt-bindings: clock: ehrpwm: Add AM62 specific compatible * clk-cleanup: clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc() clk: fixed-rate: Remove redundant if statement clk: mux: remove redundant initialization of variable width clk: using pm_runtime_resume_and_get instead of pm_runtime_get_sync clk: actions: remove redundant assignment after a mask operation * clk-airoha: clk: en7523: fix wrong pointer check in en7523_clk_probe() clk: en7523: Add clock driver for Airoha EN7523 SoC dt-bindings: Add en7523-scu device tree binding documentation * clk-i2c-simple: clk: renesas-pcie: use simple i2c probe function clk: si570: use i2c_match_id and simple i2c probe clk: si544: use i2c_match_id and simple i2c probe clk: si5351: use i2c_match_id and simple i2c probe clk: si5341: use simple i2c probe function clk: si514: use simple i2c probe function clk: max9485: use simple i2c probe function clk: cs2000-cp: use simple i2c probe function clk: cdce925: use i2c_match_id and simple i2c probe clk: cdce706: use simple i2c probe function * clk-renesas: (48 commits) clk: renesas: r9a09g011: Add eth clock and reset entries clk: renesas: Add RZ/V2M support using the rzg2l driver clk: renesas: rzg2l: Add support for RZ/V2M reset monitor reg clk: renesas: rzg2l: Make use of CLK_MON registers optional clk: renesas: rzg2l: Set HIWORD mask for all mux and dividers clk: renesas: rzg2l: Add read only versions of the clk macros clk: renesas: rzg2l: Move the DEF_MUX array size calc into the macro dt-bindings: clock: renesas,rzg2l: Document RZ/V2M SoC clk: renesas: r9a07g044: Fix OSTM1 module clock name clk: renesas: r9a07g043: Add clock and reset entries for ADC clk: renesas: r9a07g043: Add TSU clock and reset entry clk: renesas: r9a07g043: Add RSPI clock and reset entries clk: renesas: r9a07g043: Add clock and reset entries for SPI Multi I/O Bus Controller clk: renesas: r9a07g044: Add DSI clock and reset entries clk: renesas: r9a07g044: Add LCDC clock and reset entries clk: renesas: r9a07g044: Add M4 Clock support clk: renesas: r9a07g044: Add M3 Clock support clk: renesas: r9a07g044: Add {M2, M2_DIV2} Clocks support clk: renesas: r9a07g044: Add M1 clock support clk: renesas: rzg2l: Add DSI divider clk support ... commit c17f8fd3f2184cf0f56626d1691dce417c450ca0 Merge: 856c7986d29dd 03e053b4f717c Author: Stephen Boyd Date: Wed May 25 00:08:38 2022 -0700 Merge tag 'qcom-clk-for-5.19-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull some Qualcomm clock driver reverts from Bjorn Andersson: After concerns were raised about the new PCIe pipe_clk mux implementation an updated implementation has evolved, but has not yet been accepted. This reverts the merged changes to avoid these concerns in the current release. * tag 'qcom-clk-for-5.19-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: Revert "clk: qcom: regmap-mux: add pipe clk implementation" Revert "clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" Revert "clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" commit 856c7986d29dd74aa37aceedba7ffebcf2c7b24e Merge: 3123109284176 703db1f5da1e3 Author: Stephen Boyd Date: Wed May 25 00:07:54 2022 -0700 Merge tag 'qcom-clk-for-5.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clock driver updates from Bjorn Andersson: This introduces the LPASS clock controller driver for sc7280 and the global clock controller for SC8280XP. It adds modem reset, corrects RPM clocks and moves to floor ops for SDCC on MSM8976. It introduces clocks needed to operate the Sensor Subsystem in MSM8998. It enhances the logic for parked shared RCG2s, to avoid problems on recent platforms. And lastly it introduces a new mechanism for handling the PCIe pipe_clk, which also needs to be parked on a safe source when the PHY is turned off. * tag 'qcom-clk-for-5.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: clk: qcom: rcg2: Cache CFG register updates for parked RCGs clk: qcom: add sc8280xp GCC driver dt-bindings: clock: Add Qualcomm SC8280XP GCC bindings clk: qcom: gcc-msm8976: Add modem reset dt-bindings: clk: qcom: gcc-msm8976: Add modem reset clk: qcom: gcc-msm8976: Set floor ops for SDCC dt-bindings: clock: qcom,gcc-apq8064: Fix typo in compatible and split apq8084 clk: qcom: smd: Update MSM8976 RPM clocks. clk: qcom: gcc-msm8998: add SSC-related clocks dt-bindings: clock: gcc-msm8998: Add definitions of SSC-related clocks dt-bindings: clock: qcom,rpmcc: add clocks property dt-bindings: clock: qcom,rpmcc: convert to dtschema clk: qcom: lpass: Add support for LPASS clock controller for SC7280 dt-bindings: clock: Add YAML schemas for LPASS clocks on SC7280 clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks clk: qcom: regmap-mux: add pipe clk implementation commit 78901cfa44981d170fb5caae0d5421c97782b0d0 Author: Chao Yu Date: Wed May 25 09:56:34 2022 +0800 f2fs: avoid unneeded error handling for revoke_entry_slab allocation In __f2fs_commit_atomic_write(), we will guarantee success of revoke_entry_slab allocation, so let's avoid unneeded error handling. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 66d34fcbbe63ebd8584b792e0d741f6648100894 Author: Sungjong Seo Date: Tue May 24 10:29:11 2022 +0900 f2fs: allow compression for mmap files in compress_mode=user Since commit e3c548323d32 ("f2fs: let's allow compression for mmap files"), it has been allowed to compress mmap files. However, in compress_mode=user, it is not allowed yet. To keep the same concept in both compress_modes, f2fs_ioc_(de)compress_file() should also allow it. Let's remove checking mmap files in f2fs_ioc_(de)compress_file() so that the compression for mmap files is also allowed in compress_mode=user. Signed-off-by: Sungjong Seo Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fdaf9a5840acaab18694a19e0eb0aa51162eeeed Merge: 8642174b52214 516edb456f121 Author: Linus Torvalds Date: Tue May 24 19:55:07 2022 -0700 Merge tag 'folio-5.19' of git://git.infradead.org/users/willy/pagecache Pull page cache updates from Matthew Wilcox: - Appoint myself page cache maintainer - Fix how scsicam uses the page cache - Use the memalloc_nofs_save() API to replace AOP_FLAG_NOFS - Remove the AOP flags entirely - Remove pagecache_write_begin() and pagecache_write_end() - Documentation updates - Convert several address_space operations to use folios: - is_dirty_writeback - readpage becomes read_folio - releasepage becomes release_folio - freepage becomes free_folio - Change filler_t to require a struct file pointer be the first argument like ->read_folio * tag 'folio-5.19' of git://git.infradead.org/users/willy/pagecache: (107 commits) nilfs2: Fix some kernel-doc comments Appoint myself page cache maintainer fs: Remove aops->freepage secretmem: Convert to free_folio nfs: Convert to free_folio orangefs: Convert to free_folio fs: Add free_folio address space operation fs: Convert drop_buffers() to use a folio fs: Change try_to_free_buffers() to take a folio jbd2: Convert release_buffer_page() to use a folio jbd2: Convert jbd2_journal_try_to_free_buffers to take a folio reiserfs: Convert release_buffer_page() to use a folio fs: Remove last vestiges of releasepage ubifs: Convert to release_folio reiserfs: Convert to release_folio orangefs: Convert to release_folio ocfs2: Convert to release_folio nilfs2: Remove comment about releasepage nfs: Convert to release_folio jfs: Convert to release_folio ... commit 8642174b52214dde4d8113f28fb4c9be5a432126 Merge: f289811258552 e9c3a8e820ed0 Author: Linus Torvalds Date: Tue May 24 19:21:30 2022 -0700 Merge tag 'iomap-5.19-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "There's a couple of corrections sent in by Andreas for some accounting errors. The biggest change this time around is that writeback errors longer clear pageuptodate nor does XFS invalidate the page cache anymore. This brings XFS (and gfs2/zonefs) behavior in line with every other Linux filesystem driver, and fixes some UAF bugs that only cropped up after willy turned on multipage folios for XFS in 5.18-rc1. Regrettably, it took all the way to the end of the 5.18 cycle to find the source of these bugs and reach a consensus that XFS' writeback failure behavior from 20 years ago is no longer necessary. Summary: - Fix a couple of accounting errors in the buffered io code. - Discontinue the practice of marking folios !uptodate and invalidating them when writeback fails. This fixes some UAF bugs when multipage folios are enabled, and brings the behavior of XFS/gfs/zonefs into alignment with the behavior of all the other Linux filesystems" * tag 'iomap-5.19-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: don't invalidate folios after writeback errors iomap: iomap_write_end cleanup iomap: iomap_write_failed fix commit f289811258552a8a8c15d2446f9ead1d567357f2 Merge: fea3043314f30 8e51ec6146fde Author: Linus Torvalds Date: Tue May 24 19:09:16 2022 -0700 Merge tag 'dlm-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This includes several large patches to improve endian handling and remove sparse warnings. The code previously used in/out, in-place endianness conversion functions. Other code cleanup includes the list iterator changes. Finally, a long standing bug was found and fixed, caused by missed decrement on an lock struct ref count" * tag 'dlm-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: (28 commits) dlm: use kref_put_lock in __put_lkb dlm: use kref_put_lock in put_rsb dlm: remove unnecessary error assign dlm: fix missing lkb refcount handling fs: dlm: cast resource pointer to uintptr_t dlm: replace usage of found with dedicated list iterator variable dlm: remove usage of list iterator for list_add() after the loop body dlm: fix pending remove if msg allocation fails dlm: fix wake_up() calls for pending remove dlm: check required context while close dlm: cleanup lock handling in dlm_master_lookup dlm: remove found label in dlm_master_lookup dlm: remove __user conversion warnings dlm: move conversion to compile time dlm: use __le types for dlm messages dlm: use __le types for rcom messages dlm: use __le types for dlm header dlm: use __le types for options header dlm: add __CHECKER__ for false positives dlm: move global to static inits ... commit fea3043314f30a87ca04fd1219661810600e256f Merge: 7208c9842c50f 5f41fdaea63dd Author: Linus Torvalds Date: Tue May 24 19:04:46 2022 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Various bug fixes and cleanups for ext4. In particular, move the crypto related fucntions from fs/ext4/super.c into a new fs/ext4/crypto.c, and fix a number of bugs found by fuzzers and error injection tools" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (25 commits) ext4: only allow test_dummy_encryption when supported ext4: fix bug_on in __es_tree_search ext4: avoid cycles in directory h-tree ext4: verify dir block before splitting it ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state ext4: fix bug_on in ext4_writepages ext4: refactor and move ext4_ioctl_get_encryption_pwsalt() ext4: cleanup function defs from ext4.h into crypto.c ext4: move ext4 crypto code to its own file crypto.c ext4: fix memory leak in parse_apply_sb_mount_options() ext4: reject the 'commit' option on ext2 filesystems ext4: remove duplicated #include of dax.h in inode.c ext4: fix race condition between ext4_write and ext4_convert_inline_data ext4: convert symlink external data block mapping to bdev ext4: add nowait mode for ext4_getblk() ext4: fix journal_ioprio mount option handling ext4: mark group as trimmed only if it was fully scanned ext4: fix use-after-free in ext4_rename_dir_prepare ext4: add unmount filesystem message ext4: remove unnecessary conditionals ... commit c4955d9cd2fc56c43e78c908dad4e2cac7cc9073 Merge: 03536823589a5 0ea917819d12f Author: Dave Airlie Date: Wed May 25 12:03:40 2022 +1000 Merge tag 'drm-intel-next-fixes-2022-05-24' of git://anongit.freedesktop.org/drm/drm-intel into drm-next drm/i915 fixes for v5.19 merge window: - Build, sparse, UB, and CFI fixes - Variable scope fix - Audio pipe logging fix - ICL+ DSI NULL dereference fix Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87sfozuj44.fsf@intel.com commit 7208c9842c50f97327aac20be62edc8ad230f05c Merge: bd1b7c1384ec1 c360abbb9db29 Author: Linus Torvalds Date: Tue May 24 19:00:41 2022 -0700 Merge tag 'gfs2-v5.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Clean up the allocation of glocks that have an address space attached - Quota locking fix and quota iomap conversion - Fix the FITRIM error reporting - Some list iterator cleanups * tag 'gfs2-v5.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Convert function bh_get to use iomap gfs2: use i_lock spin_lock for inode qadata gfs2: Return more useful errors from gfs2_rgrp_send_discards() gfs2: Use container_of() for gfs2_glock(aspace) gfs2: Explain some direct I/O oddities gfs2: replace 'found' with dedicated list iterator variable commit bd1b7c1384ec15294ee45bf3add7b7036e146dad Merge: 3842007b1a335 0a05fafe9def0 Author: Linus Torvalds Date: Tue May 24 18:52:35 2022 -0700 Merge tag 'for-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Features: - subpage: - support for PAGE_SIZE > 4K (previously only 64K) - make it work with raid56 - repair super block num_devices automatically if it does not match the number of device items - defrag can convert inline extents to regular extents, up to now inline files were skipped but the setting of mount option max_inline could affect the decision logic - zoned: - minimal accepted zone size is explicitly set to 4MiB - make zone reclaim less aggressive and don't reclaim if there are enough free zones - add per-profile sysfs tunable of the reclaim threshold - allow automatic block group reclaim for non-zoned filesystems, with sysfs tunables - tree-checker: new check, compare extent buffer owner against owner rootid Performance: - avoid blocking on space reservation when doing nowait direct io writes (+7% throughput for reads and writes) - NOCOW write throughput improvement due to refined locking (+3%) - send: reduce pressure to page cache by dropping extent pages right after they're processed Core: - convert all radix trees to xarray - add iterators for b-tree node items - support printk message index - user bulk page allocation for extent buffers - switch to bio_alloc API, use on-stack bios where convenient, other bio cleanups - use rw lock for block groups to favor concurrent reads - simplify workques, don't allocate high priority threads for all normal queues as we need only one - refactor scrub, process chunks based on their constraints and similarity - allocate direct io structures on stack and pass around only pointers, avoids allocation and reduces potential error handling Fixes: - fix count of reserved transaction items for various inode operations - fix deadlock between concurrent dio writes when low on free data space - fix a few cases when zones need to be finished VFS, iomap: - add helper to check if sb write has started (usable for assertions) - new helper iomap_dio_alloc_bio, export iomap_dio_bio_end_io" * tag 'for-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (173 commits) btrfs: zoned: introduce a minimal zone size 4M and reject mount btrfs: allow defrag to convert inline extents to regular extents btrfs: add "0x" prefix for unsupported optional features btrfs: do not account twice for inode ref when reserving metadata units btrfs: zoned: fix comparison of alloc_offset vs meta_write_pointer btrfs: send: avoid trashing the page cache btrfs: send: keep the current inode open while processing it btrfs: allocate the btrfs_dio_private as part of the iomap dio bio btrfs: move struct btrfs_dio_private to inode.c btrfs: remove the disk_bytenr in struct btrfs_dio_private btrfs: allocate dio_data on stack iomap: add per-iomap_iter private data iomap: allow the file system to provide a bio_set for direct I/O btrfs: add a btrfs_dio_rw wrapper btrfs: zoned: zone finish unused block group btrfs: zoned: properly finish block group on metadata write btrfs: zoned: finish block group when there are no more allocatable bytes left btrfs: zoned: consolidate zone finish functions btrfs: zoned: introduce btrfs_zoned_bg_is_full btrfs: improve error reporting in lookup_inline_extent_backref ... commit 3842007b1a33589d57f67eac479b132b77767514 Merge: 65965d9530b0c 14bdb047a54d7 Author: Linus Torvalds Date: Tue May 24 18:48:36 2022 -0700 Merge tag 'zonefs-5.19-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: "A single patch to fix zonefs_init_file_inode() return value" * tag 'zonefs-5.19-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Fix zonefs_init_file_inode() return value commit 65965d9530b0c320759cd18a9a5975fb2e098462 Merge: 850f6033cd2bf ba73eadd23d1c Author: Linus Torvalds Date: Tue May 24 18:42:04 2022 -0700 Merge tag 'erofs-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs (and fscache) updates from Gao Xiang: "After working on it on the mailing list for more than half a year, we finally form 'erofs over fscache' feature into shape. Hopefully it could bring more possibility to the communities. The story mainly started from a new project what we called "RAFS v6" [1] for Nydus image service almost a year ago, which enhances EROFS to be a new form of one bootstrap (which includes metadata representing the whole fs tree) + several data-deduplicated content addressable blobs (actually treated as multiple devices). Each blob can represent one container image layer but not quite exactly since all new data can be fully existed in the previous blobs so no need to introduce another new blob. It is actually not a new idea (at least on my side it's much like a simpilied casync [2] for now) and has many benefits over per-file blobs or some other exist ways since typically each RAFS v6 image only has dozens of device blobs instead of thousands of per-file blobs. It's easy to be signed with user keys as a golden image, transfered untouchedly with minimal overhead over the network, kept in some type of storage conveniently, and run with (optional) runtime verification but without involving too many irrelevant features crossing the system beyond EROFS itself. At least it's our final goal and we're keeping working on it. There was also a good summary of this approach from the casync author [3]. Regardless further optimizations, this work is almost done in the previous Linux release cycles. In this round, we'd like to introduce on-demand load for EROFS with the fscache/cachefiles infrastructure, considering the following advantages: - Introduce new file-based backend to EROFS. Although each image only contains dozens of blobs but in densely-deployed runC host for example, there could still be massive blobs on a machine, which is messy if each blob is treated as a device. In contrast, fscache and cachefiles are really great interfaces for us to make them work. - Introduce on-demand load to fscache and EROFS. Previously, fscache is mainly used to caching network-likewise filesystems, now it can support on-demand downloading for local fses too with the exact localfs on-disk format. It has many advantages which we're been described in the latest patchset cover letter [4]. In addition to that, most importantly, the cached data is still stored in the original local fs on-disk format so that it's still the one signed with private keys but only could be partially available. Users can fully trust it during running. Later, users can also back up cachefiles easily to another machine. - More reliable on-demand approach in principle. After data is all available locally, user daemon can be no longer online in some use cases, which helps daemon crash recovery (filesystems can still in service) and hot-upgrade (user daemon can be upgraded more frequently due to new features or protocols introduced.) - Other format can also be converted to EROFS filesystem format over the internet on the fly with the new on-demand load feature and mounted. That is entirely possible with on-demand load feature as long as such archive format metadata can be fetched in advance like stargz. In addition, although currently our target user is Nydus image service [5], but laterly, it can be used for other use cases like on-demand system booting, etc. As for the fscache on-demand load feature itself, strictly it can be used for other local fses too. Laterly we could promote most code to the iomap infrastructure and also enhance it in the read-write way if other local fses are interested. Thanks David Howells for taking so much time and patience on this these months, many thanks with great respect here again! Thanks Jeffle for working on this feature and Xin Yin from Bytedance for asynchronous I/O implementation as well as Zichen Tian, Jia Zhu, and Yan Song for testing, much appeciated. We're also exploring more possibly over fscache cache management over FSDAX for secure containers and working on more improvements and useful features for fscache, cachefiles, and on-demand load. In addition to "erofs over fscache", NFS export and idmapped mount are also completed in this cycle for container use cases as well. Summary: - Add erofs on-demand load support over fscache - Support NFS export for erofs - Support idmapped mounts for erofs - Don't prompt for risk any more when using big pcluster - Fix buffer copy overflow of ztailpacking feature - Several minor cleanups" [1] https://lore.kernel.org/r/20210730194625.93856-1-hsiangkao@linux.alibaba.com [2] https://github.com/systemd/casync [3] http://0pointer.net/blog/casync-a-tool-for-distributing-file-system-images.html [4] https://lore.kernel.org/r/20220509074028.74954-1-jefflexu@linux.alibaba.com [5] https://github.com/dragonflyoss/image-service * tag 'erofs-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: (29 commits) erofs: scan devices from device table erofs: change to use asynchronous io for fscache readpage/readahead erofs: add 'fsid' mount option erofs: implement fscache-based data readahead erofs: implement fscache-based data read for inline layout erofs: implement fscache-based data read for non-inline layout erofs: implement fscache-based metadata read erofs: register fscache context for extra data blobs erofs: register fscache context for primary data blob erofs: add erofs_fscache_read_folios() helper erofs: add anonymous inode caching metadata for data blobs erofs: add fscache context helper functions erofs: register fscache volume erofs: add fscache mode check helper erofs: make erofs_map_blocks() generally available cachefiles: document on-demand read mode cachefiles: add tracepoints for on-demand read mode cachefiles: enable on-demand read mode cachefiles: implement on-demand read cachefiles: notify the user daemon when withdrawing cookie ... commit 850f6033cd2bf3b1fcbf9a20d078edab7e7c67b4 Merge: f30fabe78acb3 64ba4b15e5c04 Author: Linus Torvalds Date: Tue May 24 18:30:27 2022 -0700 Merge tag 'exfat-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - fix referencing wrong parent directory information during rename - introduce a sys_tz mount option to use system timezone - improve performance while zeroing a cluster with dirsync mount option - fix slab-out-bounds in exat_clear_bitmap() reported from syzbot * tag 'exfat-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: check if cluster num is valid exfat: reduce block requests when zeroing a cluster block: add sync_blockdev_range() exfat: introduce mount option 'sys_tz' exfat: fix referencing wrong parent directory information after renaming commit f30fabe78acb31cd309f2fdfdb0be54df4cad68f Merge: 827060261cf3c e1bbcd277a53e Author: Linus Torvalds Date: Tue May 24 18:19:06 2022 -0700 Merge tag 'fs.idmapped.v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull fs idmapping updates from Christian Brauner: "This contains two minor updates: - An update to the idmapping documentation by Rodrigo making it easier to understand that we first introduce several use-cases that fail without idmapped mounts simply to explain how they can be handled with idmapped mounts. - When changing a mount's idmapping we now hold writers to make it more robust. This is similar to turning a mount ro with the difference that in contrast to turning a mount ro changing the idmapping can only ever be done once while a mount can transition between ro and rw as much as it wants. The vfs layer itself takes care to retrieve the idmapping of a mount once ensuring that the idmapping used for vfs permission checking is identical to the idmapping passed down to the filesystem. All filesystems with FS_ALLOW_IDMAP raised take the same precautions as the vfs in code-paths that are outside of direct control of the vfs such as ioctl()s. However, holding writers makes this more robust and predictable for both the kernel and userspace. This is a minor user-visible change. But it is extremely unlikely to matter. The caller must've created a detached mount via OPEN_TREE_CLONE and then handed that O_PATH fd to another process or thread which then must've gotten a writable fd for that mount and started creating files in there while the caller is still changing mount properties. While not impossible it will be an extremely rare corner-case and should in general be considered a bug in the application. Consider making a mount MOUNT_ATTR_NOEXEC or MOUNT_ATTR_NODEV while allowing someone else to perform lookups or exec'ing in parallel by handing them a copy of the OPEN_TREE_CLONE fd or another fd beneath that mount. I've pinged all major users of idmapped mounts pointing out this change and none of them have active writers on a mount while still changing mount properties. It would've been strange if they did. The rest and majority of the work will be coming through the overlayfs tree this cycle. In addition to overlayfs this cycle should also see support for idmapped mounts on erofs as I've acked a patch to this effect a little while ago" * tag 'fs.idmapped.v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: fs: hold writers when changing mount's idmapping docs: Add small intro to idmap examples commit 827060261cf3c7b79ee7185d5aa61c851beb9403 Merge: 268db333b561c 340ce50f75a6b Author: Linus Torvalds Date: Tue May 24 18:09:16 2022 -0700 Merge tag 'media/v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - dvb-usb drivers entries got reworked to avoid usage of magic numbers to refer to data position inside tables - vcodec driver has gained support for MT8186 and for vp8 and vp9 stateless codecs - hantro has gained support for Hantro G1 on RK366x - Added more h264 levels on coda960 - ccs gained support for MIPI CSI-2 28 bits per pixel raw data type - venus driver gained support for Qualcomm custom compressed pixel formats - lots of driver fixes and updates * tag 'media/v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: hantro: Enable HOLD_CAPTURE_BUF for H.264 media: hantro: Add H.264 field decoding support media: hantro: h264: Make dpb entry management more robust media: hantro: Stop using H.264 parameter pic_num media: rkvdec: Enable capture buffer holding for H264 media: rkvdec-h264: Add field decoding support media: rkvdec: Ensure decoded resolution fit coded resolution media: rkvdec: h264: Fix reference frame_num wrap for second field media: rkvdec: h264: Validate and use pic width and height in mbs media: rkvdec: Move H264 SPS validation in rkvdec-h264 media: rkvdec: h264: Fix bit depth wrap in pps packet media: rkvdec: h264: Fix dpb_valid implementation media: rkvdec: Stop overclocking the decoder media: v4l2: Reorder field reflist media: h264: Sort p/b reflist using frame_num media: v4l2: Trace calculated p/b0/b1 initial reflist media: h264: Store all fields into the unordered list media: h264: Store current picture fields media: h264: Increase reference lists size to 32 media: h264: Use v4l2_h264_reference for reflist ... commit 1ae41598f482616449f869daf53eebe37973dc27 Author: Palmer Dabbelt Date: Tue Apr 19 20:01:30 2022 -0700 RISC-V: ignore xipImage This built file shows up in "git status" without an explicit ignore. Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220420184056.7886-3-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit f83050a82d4f0b1cbf48ed458752bb913633d7ee Author: Palmer Dabbelt Date: Tue Apr 19 18:12:01 2022 -0700 RISC-V: Avoid empty create_*_mapping definitions These trigger a handful of build warnings. Reported-by: kernel test robot Fixes: 677b9eb8810e ("riscv: mm: Prepare pt_ops helper functions for sv57") Link: https://lore.kernel.org/r/20220420184056.7886-2-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 268db333b561c77dee3feb6831806412293b4a7e Merge: f4fb8596657c9 f6e109a0afede Author: Linus Torvalds Date: Tue May 24 16:34:14 2022 -0700 Merge tag 'devprop-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "These mostly extend the device property API and make it easier to use in some cases. Specifics: - Allow error pointer to be passed to fwnode APIs (Andy Shevchenko). - Introduce fwnode_for_each_parent_node() (Andy Shevchenko, Douglas Anderson). - Advertise fwnode and device property count API calls (Andy Shevchenko). - Clean up fwnode_is_ancestor_of() (Andy Shevchenko). - Convert device_{dma_supported,get_dma_attr} to fwnode (Sakari Ailus). - Release subnode properties with data nodes (Sakari Ailus). - Add ->iomap() and ->irq_get() to fwnode operations (Sakari Ailus)" * tag 'devprop-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: Advertise fwnode and device property count API calls device property: Fix recent breakage of fwnode_get_next_parent_dev() device property: Drop 'test' prefix in parameters of fwnode_is_ancestor_of() device property: Introduce fwnode_for_each_parent_node() device property: Allow error pointer to be passed to fwnode APIs ACPI: property: Release subnode properties with data nodes device property: Add irq_get to fwnode operation device property: Add iomap to fwnode operations ACPI: property: Move acpi_fwnode_device_get_match_data() up device property: Convert device_{dma_supported,get_dma_attr} to fwnode commit 3f3489248927a53fcfec571ff603163f6b676a46 Author: Miquel Raynal Date: Fri May 20 10:25:00 2022 +0200 rtc: rzn1: Fix a variable type The calculation in ->set_offset() handles both negative and positive offsets. The 'steps' variable will be checked to be in a specific [-x; +x] range, which means it must be a signed integer rather than unsigned. This also fixes the following smatch warning: warn: 'steps' 'true' implies 'steps > 0' is 'true' Fixes: be4a11cf98af ("rtc: rzn1: Add oscillator offset support") Reported-by: Dan Carpenter Signed-off-by: Miquel Raynal Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220520082500.489248-1-miquel.raynal@bootlin.com commit 0b6da785130d9e8cf33d001a7bf08a979c87d019 Author: Dan Carpenter Date: Thu May 19 16:56:19 2022 +0300 rtc: rzn1: Fix error code in probe There is a copy and paste error so this code returns the wrong variable. Fixes: deeb4b5393e1 ("rtc: rzn1: Add new RTC driver") Signed-off-by: Dan Carpenter Reviewed-by: Miquel Raynal Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/YoZMg1dmHHSJEfE9@kili commit f4fb8596657c998ca4cdb833bc0f509533a38ddd Merge: 09583dfed2cb9 bbb544f334919 Author: Linus Torvalds Date: Tue May 24 16:19:30 2022 -0700 Merge tag 'thermal-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These add a thermal library and thermal tools to wrap the netlink interface into event-based callbacks, improve overheat condition handling during suspend-to-idle on Intel SoCs, add some new hardware support, fix bugs and clean up code. Specifics: - Add thermal library and thermal tools to encapsulate the netlink into event based callbacks (Daniel Lezcano, Jiapeng Chong). - Improve overheat condition handling during suspend-to-idle in the Intel PCH thermal driver (Zhang Rui). - Use local ops instead of global ops in devfreq_cooling (Kant Fan). - Clean up _OSC handling in int340x (Davidlohr Bueso). - Switch hisi_termal from CONFIG_PM_SLEEP guards to pm_sleep_ptr() (Hesham Almatary). - Add new k3 j72xx bangdap driver and the corresponding bindings (Keerthy). - Fix missing of_node_put() in the SC iMX driver at probe time (Miaoqian Lin). - Fix memory leak in __thermal_cooling_device_register() when device_register() fails by calling thermal_cooling_device_destroy_sysfs() (Yang Yingliang). - Add sc8180x and sc8280xp compatible string in the DT bindings and lMH support for QCom tsens driver (Bjorn Andersson). - Fix OTP Calibration Register values conforming to the documentation on RZ/G2L and bindings documentation for RZ/G2UL (Biju Das). - Fix type in kerneldoc description for __thermal_bind_params (Corentin Labbe). - Fix potential NULL dereference in sr_thermal_probe() on Broadcom platform (Zheng Yongjun). - Add change mode ops to the thermal-of sensor (Manaf Meethalavalappu Pallikunhi). - Fix non-negative value support by preventing the value to be clamp to zero (Stefan Wahren). - Add compatible string and DT bindings for MSM8960 tsens driver (Dmitry Baryshkov). - Add hwmon support for K3 driver (Massimiliano Minella). - Refactor and add multiple generations support for QCom ADC driver (Jishnu Prakash). - Use platform_get_irq_optional() to get the interrupt on RCar driver and document Document RZ/V2L bindings (Lad Prabhakar). - Remove NULL check after container_of() call from the Intel HFI thermal driver (Haowen Bai)" * tag 'thermal-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (38 commits) thermal: intel: pch: improve the cooling delay log thermal: intel: pch: enhance overheat handling thermal: intel: pch: move cooling delay to suspend_noirq phase PM: wakeup: expose pm_wakeup_pending to modules thermal: k3_j72xx_bandgap: Add the bandgap driver support dt-bindings: thermal: k3-j72xx: Add VTM bindings documentation thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe thermal/core: Fix memory leak in __thermal_cooling_device_register() dt-bindings: thermal: tsens: Add sc8280xp compatible dt-bindings: thermal: lmh: Add Qualcomm sc8180x compatible thermal/drivers/qcom/lmh: Add sc8180x compatible thermal/drivers/rz2gl: Fix OTP Calibration Register values dt-bindings: thermal: rzg2l-thermal: Document RZ/G2UL bindings thermal: thermal_of: fix typo on __thermal_bind_params tools/thermal: remove unneeded semicolon tools/lib/thermal: remove unneeded semicolon thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe tools/thermal: Add thermal daemon skeleton tools/thermal: Add a temperature capture tool tools/thermal: Add util library ... commit 64d69b5daf6fe9b86236d34e57ba8ebf7d84f245 Author: Miquel Raynal Date: Fri May 20 10:22:21 2022 +0200 rtc: rzn1: Avoid mixing variables In the ->set_offset() callback, the 'val' variable is used for two different purposes at the same time, which is oviously wrong: - It contains the intermediate value of the SUBU register that must be written at the end of ->set_offset(). - It is used in the middle of the above calculations to poll the CTL2 register for a specific value. Let's introduce a 'ctl2' variable just for the readl_poll_timeout() call and use it there in place of 'var'. In order to avoid mixing those two variables again, let's rename the remaining occurences of 'val' into 'subu' and initialize it to 0 to avoid the uninitialized variable situation reported by Tom Rix and Colin Ian King already. Fixes: be4a11cf98af ("rtc: rzn1: Add oscillator offset support") Reported-by: Tom Rix Reported-by: Colin Ian King Signed-off-by: Miquel Raynal Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220520082221.488849-1-miquel.raynal@bootlin.com commit 09583dfed2cb9723da31601cb7080490c2e2e2d7 Merge: 1961b06c9126e 0d64482bf2991 Author: Linus Torvalds Date: Tue May 24 16:04:25 2022 -0700 Merge tag 'pm-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add support for 'artificial' Energy Models in which power numbers for different entities may be in different scales, add support for some new hardware, fix bugs and clean up code in multiple places. Specifics: - Update the Energy Model support code to allow the Energy Model to be artificial, which means that the power values may not be on a uniform scale with other devices providing power information, and update the cpufreq_cooling and devfreq_cooling thermal drivers to support artificial Energy Models (Lukasz Luba). - Make DTPM check the Energy Model type (Lukasz Luba). - Fix policy counter decrementation in cpufreq if Energy Model is in use (Pierre Gondois). - Add CPU-based scaling support to passive devfreq governor (Saravana Kannan, Chanwoo Choi). - Update the rk3399_dmc devfreq driver (Brian Norris). - Export dev_pm_ops instead of suspend() and resume() in the IIO chemical scd30 driver (Jonathan Cameron). - Add namespace variants of EXPORT[_GPL]_SIMPLE_DEV_PM_OPS and PM-runtime counterparts (Jonathan Cameron). - Move symbol exports in the IIO chemical scd30 driver into the IIO_SCD30 namespace (Jonathan Cameron). - Avoid device PM-runtime usage count underflows (Rafael Wysocki). - Allow dynamic debug to control printing of PM messages (David Cohen). - Fix some kernel-doc comments in hibernation code (Yang Li, Haowen Bai). - Preserve ACPI-table override during hibernation (Amadeusz Sławiński). - Improve support for suspend-to-RAM for PSCI OSI mode (Ulf Hansson). - Make Intel RAPL power capping driver support the RaptorLake and AlderLake N processors (Zhang Rui, Sumeet Pawnikar). - Remove redundant store to value after multiply in the RAPL power capping driver (Colin Ian King). - Add AlderLake processor support to the intel_idle driver (Zhang Rui). - Fix regression leading to no genpd governor in the PSCI cpuidle driver and fix the riscv-sbi cpuidle driver to allow a genpd governor to be used (Ulf Hansson). - Fix cpufreq governor clean up code to avoid using kfree() directly to free kobject-based items (Kevin Hao). - Prepare cpufreq for powerpc's asm/prom.h cleanup (Christophe Leroy). - Make intel_pstate notify frequency invariance code when no_turbo is turned on and off (Chen Yu). - Add Sapphire Rapids OOB mode support to intel_pstate (Srinivas Pandruvada). - Make cpufreq avoid unnecessary frequency updates due to mismatch between hardware and the frequency table (Viresh Kumar). - Make remove_cpu_dev_symlink() clear the real_cpus mask to simplify code (Viresh Kumar). - Rearrange cpufreq_offline() and cpufreq_remove_dev() to make the calling convention for some driver callbacks consistent (Rafael Wysocki). - Avoid accessing half-initialized cpufreq policies from the show() and store() sysfs functions (Schspa Shi). - Rearrange cpufreq_offline() to make the calling convention for some driver callbacks consistent (Schspa Shi). - Update CPPC handling in cpufreq (Pierre Gondois). - Extend dev_pm_domain_detach() doc (Krzysztof Kozlowski). - Move genpd's time-accounting to ktime_get_mono_fast_ns() (Ulf Hansson). - Improve the way genpd deals with its governors (Ulf Hansson). - Update the turbostat utility to version 2022.04.16 (Len Brown, Dan Merillat, Sumeet Pawnikar, Zephaniah E. Loss-Cutler-Hull, Chen Yu)" * tag 'pm-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (94 commits) PM: domains: Trust domain-idle-states from DT to be correct by genpd PM: domains: Measure power-on/off latencies in genpd based on a governor PM: domains: Allocate governor data dynamically based on a genpd governor PM: domains: Clean up some code in pm_genpd_init() and genpd_remove() PM: domains: Fix initialization of genpd's next_wakeup PM: domains: Fixup QoS latency measurements for IRQ safe devices in genpd PM: domains: Measure suspend/resume latencies in genpd based on governor PM: domains: Move the next_wakeup variable into the struct gpd_timing_data PM: domains: Allocate gpd_timing_data dynamically based on governor PM: domains: Skip another warning in irq_safe_dev_in_sleep_domain() PM: domains: Rename irq_safe_dev_in_no_sleep_domain() in genpd PM: domains: Don't check PM_QOS_FLAG_NO_POWER_OFF in genpd PM: domains: Drop redundant code for genpd always-on governor PM: domains: Add GENPD_FLAG_RPM_ALWAYS_ON for the always-on governor powercap: intel_rapl: remove redundant store to value after multiply cpufreq: CPPC: Enable dvfs_possible_from_any_cpu cpufreq: CPPC: Enable fast_switch ACPI: CPPC: Assume no transition latency if no PCCT ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported ACPI: CPPC: Check _OSC for flexible address space ... commit 1961b06c9126e5b2b949fab806c4e4304d1eae8b Merge: aa051d36ce4ae 5db9ce20951c8 Author: Linus Torvalds Date: Tue May 24 15:46:55 2022 -0700 Merge tag 'acpi-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA kernel code to upstream revision 20220331, improve handling of PCI devices that are in D3cold during system initialization, add support for a few features, fix bugs and clean up code. Specifics: - Update ACPICA code in the kernel to upstream revision 20220331 including the following changes: - Add support for the Windows 11 _OSI string (Mario Limonciello) - Add the CFMWS subtable to the CEDT table (Lawrence Hileman). - iASL: NHLT: Treat Terminator as specific_config (Piotr Maziarz). - iASL: NHLT: Fix parsing undocumented bytes at the end of Endpoint Descriptor (Piotr Maziarz). - iASL: NHLT: Rename linux specific strucures to device_info (Piotr Maziarz). - Add new ACPI 6.4 semantics to Load() and LoadTable() (Bob Moore). - Clean up double word in comment (Tom Rix). - Update copyright notices to the year 2022 (Bob Moore). - Remove some tabs and // comments - automated cleanup (Bob Moore). - Replace zero-length array with flexible-array member (Gustavo A. R. Silva). - Interpreter: Add units to time variable names (Paul Menzel). - Add support for ARM Performance Monitoring Unit Table (Besar Wicaksono). - Inform users about ACPI spec violation related to sleep length (Paul Menzel). - iASL/MADT: Add OEM-defined subtable (Bob Moore). - Interpreter: Fix some typo mistakes (Selvarasu Ganesan). - Updates for revision E.d of IORT (Shameer Kolothum). - Use ACPI_FORMAT_UINT64 for 64-bit output (Bob Moore). - Improve debug messages in the ACPI device PM code (Rafael Wysocki). - Block ASUS B1400CEAE from suspend to idle by default (Mario Limonciello). - Improve handling of PCI devices that are in D3cold during system initialization (Rafael Wysocki). - Fix BERT error region memory mapping (Lorenzo Pieralisi). - Add support for NVIDIA 16550-compatible port subtype to the SPCR parsing code (Jeff Brasen). - Use static for BGRT_SHOW kobj_attribute defines (Tom Rix). - Fix missing prototype warning for acpi_agdi_init() (Ilkka Koskinen). - Fix missing ERST record ID in the APEI code (Liu Xinpeng). - Make APEI error injection to refuse to inject into the zero page (Tony Luck). - Correct description of INT3407 / INT3532 DPTF attributes in sysfs (Sumeet Pawnikar). - Add support for high frequency impedance notification to the DPTF driver (Sumeet Pawnikar). - Make mp_config_acpi_gsi() a void function (Li kunyu). - Unify Package () representation for properties in the ACPI device properties documentation (Andy Shevchenko). - Include UUID in _DSM evaluation warning (Michael Niewöhner)" * tag 'acpi-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (41 commits) Revert "ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms" ACPI: utils: include UUID in _DSM evaluation warning ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default x86: ACPI: Make mp_config_acpi_gsi() a void function ACPI: DPTF: Add support for high frequency impedance notification ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() ACPI: bus: Avoid non-ACPI device objects in walks over children ACPI: DPTF: Correct description of INT3407 / INT3532 attributes ACPI: BGRT: use static for BGRT_SHOW kobj_attribute defines ACPI, APEI, EINJ: Refuse to inject into the zero page ACPI: PM: Always print final debug message in acpi_device_set_power() ACPI: SPCR: Add support for NVIDIA 16550-compatible port subtype ACPI: docs: enumeration: Unify Package () for properties (part 2) ACPI: APEI: Fix missing ERST record id ACPICA: Update version to 20220331 ACPICA: exsystem.c: Use ACPI_FORMAT_UINT64 for 64-bit output ACPICA: IORT: Updates for revision E.d ACPICA: executer/exsystem: Fix some typo mistakes ACPICA: iASL/MADT: Add OEM-defined subtable ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms ... commit aa051d36ce4ae23b488489f6b15abad68b59ca23 Merge: d8e0f976f104a 07d17217c668d Author: Linus Torvalds Date: Tue May 24 15:21:15 2022 -0700 Merge tag 'for-linus-2022052401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - support for pens with 3 buttons with Wacom driver (Joshua Dickens) - support for HID_DG_SCANTIME to report the timestamp for pen and touch events in Wacom driver (Joshua Dickens) - support for sensor discovery in amd-sfh driver (Basavaraj Natikar) - support for wider variety of Huion tablets ported from DIGImend project (José Expósito, Nikolai Kondrashov) - new device IDs and other assorted small code cleanups * tag 'for-linus-2022052401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (44 commits) HID: apple: Properly handle function keys on Keychron keyboards HID: uclogic: Switch to Digitizer usage for styluses HID: uclogic: Add pen support for XP-PEN Star 06 HID: uclogic: Differentiate touch ring and touch strip HID: uclogic: Always shift touch reports to zero HID: uclogic: Do not focus on touch ring only HID: uclogic: Return raw parameters from v2 pen init HID: uclogic: Move param printing to a function HID: core: Display "SENSOR HUB" for sensor hub bus string in hid_info HID: amd_sfh: Move bus declaration outside of amd-sfh HID: amd_sfh: Add physical location to HID device HID: amd_sfh: Modify the hid name HID: amd_sfh: Modify the bus name HID: amd_sfh: Add sensor name by index for debug info HID: amd_sfh: Add support for sensor discovery HID: bigben: fix slab-out-of-bounds Write in bigben_probe Hid: wacom: Fix kernel test robot warning HID: uclogic: Disable pen usage for Huion keyboard interfaces HID: uclogic: Support disabling pen usage HID: uclogic: Pass keyboard reports as is ... commit d8e0f976f104a0258c0426b3805b057411cd0bd2 Merge: 9b18d07ba3ae7 9c63b846e6df4 Author: Linus Torvalds Date: Tue May 24 15:13:30 2022 -0700 Merge tag 'spi-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "This is quite a quiet release but some new drivers mean that the diffstat is fairly large. The new drivers include the aspeed driver which is migrated from MTD as part of the ongoing move of controllers with specialised support for SPI flashes into the SPI subsystem. - Support for devices which flip CPHA during recieve only transfers (eg, if MOSI and MISO have inverted polarity). - Overhaul of the i.MX driver, including the addition of PIO support for better performance on small transfers. - Migration of the Aspeed driver from MTD. - Support for Aspeed AST2400, Ingenic JZ4775 and X1/2000 and MediaTek IPM and SFI" * tag 'spi-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (84 commits) spi: spi-au1550: replace ternary operator with min() mtd: spi-nor: aspeed: set the decoding size to at least 2MB for AST2600 spi: aspeed: Calibrate read timings spi: aspeed: Add support for the AST2400 SPI controller spi: aspeed: Workaround AST2500 limitations spi: aspeed: Adjust direct mapping to device size spi: aspeed: Add support for direct mapping spi: spi-mem: Convert Aspeed SMC driver to spi-mem spi: Convert the Aspeed SMC controllers device tree binding spi: spi-cadence: Update ISR status variable type to irqreturn_t spi: Doc fix - Describe add_lock and dma_map_dev in spi_controller spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: stm32-qspi: Remove SR_BUSY bit check before sending command spi: stm32-qspi: Always check SR_TCF flags in stm32_qspi_wait_cmd() spi: stm32-qspi: Fix wait_cmd timeout in APM mode spi: cadence-quadspi: remove unnecessary (void *) casts spi: cadence-quadspi: Add missing blank line in cqspi_request_mmap_dma() spi: spi-imx: mx51_ecspi_prepare_message(): skip writing MX51_ECSPI_CONFIG register if unchanged spi: spi-imx: add PIO polling support spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller ... commit 9b18d07ba3ae75fcb7a191fafe4e2954f07271be Merge: 5d23bb5f25ed9 a5b8e4a5ceec0 Author: Linus Torvalds Date: Tue May 24 15:09:47 2022 -0700 Merge tag 'regulator-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is mostly a drivers update including a couple of new drivers but we do have some fixes and improvements to the core as well. - Make sure we don't log spuriously about uncontrollable regulators. - Don't use delays when we should use sleeps for regulators with larger ramp times. - Support for MediaTek MT6358 and MT6366, Richtek RT5759 and Silicon Mitus SM5703" * tag 'regulator-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (36 commits) regulator: scmi: Fix refcount leak in scmi_regulator_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt regulator: qcom_smd: Fix up PM8950 regulator configuration regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET regulator: core: Add error flags to sysfs attributes regulator: dt-bindings: qcom,rpmh: document vdd-l7-bob-supply on PMR735A regulator: dt-bindings: qcom,rpmh: document supplies per variant regulator: dt-bindings: qcom,rpmh: update maintainers regulator: mt6315: Enforce regulator-compatible, not name regulator: pca9450: Enable DVS control via PMIC_STBY_REQ regulator: pca9450: Make warm reset on WDOG_B assertion regulator: Add property for WDOG_B warm reset regulator: pca9450: Make I2C Level Translator configurable regulator: Add property for I2C level shifter regulator: sm5703: Correct reference to the common regulator schema regulator: sm5703-regulator: Add regulators support for SM5703 MFD dt-bindings: regulator: Add bindings for Silicon Mitus SM5703 regulators regulator: richtek,rt4801: parse GPIOs per regulator regulator: dt-bindings: richtek,rt4801: use existing ena_gpiod feature regulator: core: Sleep (not delay) in set_voltage() ... commit 5d23bb5f25ed9cbf530b99640f4f17f59b79de9e Merge: 638971b77f1c4 5c422f0b970d2 Author: Linus Torvalds Date: Tue May 24 15:02:58 2022 -0700 Merge tag 'regmap-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "The main change here is Marek's addition of bulk read/write callbacks for individual regmaps, we've supported single register operations for a while but there's enough hardware out there which can use bulk equivalents to make it worthwhile" * tag 'regmap-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Add missing map->bus check regmap: Add bulk read/write callbacks into regmap_config regmap: cache: set max_register with reg_stride regmap: Constify static regmap_bus structs commit 638971b77f1c4fb9997c674ad66d1b96f7931c2b Merge: b1b5bf1640165 ded2c4c345001 Author: Linus Torvalds Date: Tue May 24 14:56:38 2022 -0700 Merge tag 'mmc-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Support zero-out using TRIM for eMMC - Allow to override the busy-timeout for the ioctl-cmds MMC host: - Continued the conversion of DT bindings into the JSON schema - jz4740: Apply DMA engine limits to maximum segment size - mmci_stm32: Use a buffer for unaligned DMA requests - mmc_spi: Enabled high-speed modes via parsing of DT - omap: Make clock management to be compliant with CCF - renesas_sdhi: - Support eMMC HS400 mode for R-Car V3H ES2.0 - Don't allow support for eMMC HS400 for R-Car V3M/D3 - sdhci_am654: Fix problem when SD card slot lacks the card detect line - sdhci-esdhc-imx: Add support for the imx8dxl variant - sdhci-brcmstb: Enable support for clock gating to save power - sdhci-msm: - Add support for the sdx65 variant - Add support for the sm8150 variant - sdhci-of-dwcmshc: Add support for the Rockchip rk3588 variant - sdhci-pci-gli: Add workaround to allow GL9755 to enter ASPM L1.2" * tag 'mmc-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (52 commits) mmc: sdhci-of-arasan: Add NULL check for data field mmc: core: Support zeroout using TRIM for eMMC mmc: sdhci-brcmstb: Fix compiler warning mmc: sdhci-msm: Add compatible string check for sdx65 dt-bindings: mmc: sdhci-msm: Document the SDX65 compatible mmc: sdhci-msm: Add compatible string check for sm8150 dt-bindings: mmc: sdhci-msm: Add compatible string for sm8150 mmc: sdhci-msm: Add SoC specific compatibles dt-bindings: mmc: sdhci-msm: Convert bindings to yaml dt-bindings: mmc: brcm,sdhci-brcmstb: cleanup example dt-bindings: mmc: brcm,sdhci-brcmstb: correct number of reg entries mmc: sdhci-brcmstb: Enable Clock Gating to save power mmc: sdhci-brcmstb: Re-organize flags mmc: mmci: Remove custom ios handler mmc: atmel-mci: Simplify if(chan) and if(!chan) mmc: core: use kobj_to_dev() dt-bindings: mmc: sdhci-of-dwcmhsc: Add rk3588 mmc: core: Add CIDs for cards to the entropy pool mmc: core: Allows to override the timeout value for ioctl() path mmc: sdhci-omap: Use of_device_get_match_data() helper ... commit b1b5bf1640165063fd9b7c6aeb5c7d63c4cb3c1d Merge: d335371940179 a508e33956b53 Author: Linus Torvalds Date: Tue May 24 14:50:54 2022 -0700 Merge tag 'for-linus-4.19-1' of https://github.com/cminyard/linux-ipmi Pull IPMI update from Corey Minyard: "Add limits on the number of users and messages, plus sysfs interfaces to control those limits. Other than that, little cleanups, use dev_xxx() insted of pr_xxx(), create initializers for structures, fix a refcount leak, etc" * tag 'for-linus-4.19-1' of https://github.com/cminyard/linux-ipmi: ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe ipmi: remove unnecessary type castings ipmi: Make two logs unique ipmi:si: Convert pr_debug() to dev_dbg() ipmi: Convert pr_debug() to dev_dbg() ipmi: Fix pr_fmt to avoid compilation issues ipmi: Add an intializer for ipmi_recv_msg struct ipmi: Add an intializer for ipmi_smi_msg struct ipmi:ssif: Check for NULL msg when handling events and messages ipmi: use simple i2c probe function ipmi: Add a sysfs count of total outstanding messages for an interface ipmi: Add a sysfs interface to view the number of users ipmi: Limit the number of message a user may have outstanding ipmi: Add a limit on the number of users that may use IPMI commit 32f479d05a445b52cb7fcbe6e06f579fb852be71 Merge: efa315818337c c94f732e8001a Author: Bjorn Helgaas Date: Tue May 24 16:42:28 2022 -0500 Merge branch 'remotes/lorenzo/pci/vmd' - Assign VMD IRQ domain before enumeration to avoid IOMMU interrupt remapping errors when MSI-X remapping is disabled (Nirmal Patel) - Revert VMD workaround that kept MSI-X remapping enabled when IOMMU remapping was enabled (Nirmal Patel) * remotes/lorenzo/pci/vmd: PCI: vmd: Revert 2565e5b69c44 ("PCI: vmd: Do not disable MSI-X remapping if interrupt remapping is enabled by IOMMU.") PCI: vmd: Assign VMD IRQ domain before enumeration commit efa315818337ce00d7452546e4966e2692acd9d9 Merge: 647b52ecabb47 6086987bdeb59 Author: Bjorn Helgaas Date: Tue May 24 16:42:27 2022 -0500 Merge branch 'remotes/lorenzo/pci/versatile' - Drop unnecessary "retval" variable, since it's never read (Colin Ian King) * remotes/lorenzo/pci/versatile: PCI: versatile: Remove redundant variable retval commit 647b52ecabb47ad72741861b604a18e38f156d0a Merge: ba3527d8ff7f6 096950e230b8d Author: Bjorn Helgaas Date: Tue May 24 16:42:27 2022 -0500 Merge branch 'remotes/lorenzo/pci/rockchip' - Fix bitmap size when searching for free outbound region (Dan Carpenter) * remotes/lorenzo/pci/rockchip: PCI: rockchip: Fix find_first_zero_bit() limit commit ba3527d8ff7f60b04c7b1495d4bd98edd8ecc3fa Merge: b0266c42894a1 3f467d122f27f Author: Bjorn Helgaas Date: Tue May 24 16:42:26 2022 -0500 Merge branch 'pci/host/qcom' - Add SM8150 SoC DT binding and support (Bhupesh Sharma) - Fix pipe clock imbalance (Johan Hovold) - Fix runtime PM imbalance on probe errors (Johan Hovold) - Fix PHY init imbalance on probe errors (Johan Hovold) - Convert DT binding to YAML (Dmitry Baryshkov) - Update DT binding to show that resets aren't required for MSM8996/APQ8096 platforms (Dmitry Baryshkov) - Add explicit register names per chipset in DT binding (Dmitry Baryshkov) - Add sc7280-specific clock and reset definitions to DT binding (Dmitry Baryshkov) * pci/host/qcom: dt-bindings: PCI: qcom: Add schema for sc7280 chipset dt-bindings: PCI: qcom: Specify reg-names explicitly dt-bindings: PCI: qcom: Do not require resets on msm8996 platforms dt-bindings: PCI: qcom: Convert to YAML PCI: qcom: Fix unbalanced PHY init on probe errors PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix pipe clock imbalance PCI: qcom: Add SM8150 SoC support dt-bindings: pci: qcom: Document PCIe bindings for SM8150 SoC commit b0266c42894a1c706d9bb760a36335b29cae7f20 Merge: 5ae34e8f9e9aa 0d5b8c298545c Author: Bjorn Helgaas Date: Tue May 24 16:42:26 2022 -0500 Merge branch 'remotes/lorenzo/pci/power-slot' - Add of_pci_get_slot_power_limit() to parse the 'slot-power-limit-milliwatt' DT property (Pali Rohár) - Add mvebu support for sending Set_Slot_Power_Limit message (Pali Rohár) * remotes/lorenzo/pci/power-slot: PCI: mvebu: Add support for sending Set_Slot_Power_Limit message PCI: Add function for parsing 'slot-power-limit-milliwatt' DT property PCI: Add PCI_EXP_SLTCTL_ASPL_DISABLE macro commit 5ae34e8f9e9aaf11baff6ef828109fea214f0ad7 Merge: 979db15b4a712 7013654af694f Author: Bjorn Helgaas Date: Tue May 24 16:42:25 2022 -0500 Merge branch 'remotes/lorenzo/pci/microchip' - Add missing semicolon after MODULE_DEVICE_TABLE() (Uwe Kleine-König) - Add chained_irq_enter()/chained_irq_exit() calls to mc_handle_msi() and mc_handle_intx() to avoid lost interrupts (Conor Dooley) - Fix interrupt handling race (Daire McNamara) * remotes/lorenzo/pci/microchip: PCI: microchip: Fix potential race in interrupt handling PCI: microchip: Add missing chained_irq_enter()/exit() calls PCI: microchip: Add a missing semicolon commit 979db15b4a7124a8a2c5198426d5aa9176b1fdc6 Merge: 8d8270069cfb3 1d565935e3b9c Author: Bjorn Helgaas Date: Tue May 24 16:42:25 2022 -0500 Merge branch 'remotes/lorenzo/pci/mediatek' - Fix refcount leak in mtk_pcie_subsys_powerup() (Miaoqian Lin) - Reset PHY and MAC at probe time (AngeloGioacchino Del Regno) * remotes/lorenzo/pci/mediatek: PCI: mediatek-gen3: Assert resets to ensure expected init state PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() commit 8d8270069cfb3118076f9a49e60bed4daff29558 Merge: b8dc34460ceca a3b18f5f1d42e Author: Bjorn Helgaas Date: Tue May 24 16:42:24 2022 -0500 Merge branch 'remotes/lorenzo/pci/layerscape' - Add a "big-endian" DT property to indicate that the PEX_LUT and PF register blocks are implemented in big-endian (Hou Zhiqiang) - Add EP mode compatible strings for ls1028a (Xiaowei Bao) - Define DT properties for AER/PME interrupts (Li Yang) * remotes/lorenzo/pci/layerscape: dt-bindings: pci: layerscape-pci: define AER/PME interrupts dt-bindings: pci: layerscape-pci: Add EP mode compatible strings for ls1028a dt-bindings: pci: layerscape-pci: Update the description of SCFG property dt-bindings: pci: layerscape-pci: Add a optional property big-endian commit b8dc34460ceca2e09edd9a1cfde3ba5fac5ebdac Merge: 39348d2eb2f5b a6809941c1f17 Author: Bjorn Helgaas Date: Tue May 24 16:42:24 2022 -0500 Merge branch 'remotes/lorenzo/pci/imx6' - Fix PERST# start-up sequence (Francesco Dolcini) * remotes/lorenzo/pci/imx6: PCI: imx6: Fix PERST# start-up sequence commit 39348d2eb2f5b4ffe47b708240ed243d05c563c4 Merge: 086ab94321f48 e8aae154df612 Author: Bjorn Helgaas Date: Tue May 24 16:42:24 2022 -0500 Merge branch 'remotes/lorenzo/pci/dwc' - Return error instead of success if DMA mapping of MSI area fails (Jiantao Zhang) - Drop tegra194 MSI register save/restore, which is unnecessary since the DWC core does it (Jisheng Zhang) - Factor out qcom enable/disable resources code (Dmitry Baryshkov) - Remove "snps,dw-pcie" from rockchip-dwc DT "compatible" property because it's not fully compatible with rockchip (Peter Geis) - Reset rockchip-dwc controller at probe (Peter Geis) - Add rockchip-dwc INTx support (Peter Geis) * remotes/lorenzo/pci/dwc: PCI: rockchip-dwc: Add legacy interrupt support PCI: rockchip-dwc: Reset core at driver probe dt-bindings: PCI: Remove fallback from Rockchip DesignWare binding PCI: qcom-ep: Move enable/disable resources code to common functions PCI: tegra194: Remove unnecessary MSI enable reg save and restore PCI: dwc: Fix setting error return on MSI DMA mapping failure commit 086ab94321f48b4b7d37d12c78e6e1274f082eb7 Merge: 8d8b2669f98e8 95b00f68209e2 Author: Bjorn Helgaas Date: Tue May 24 16:42:23 2022 -0500 Merge branch 'remotes/lorenzo/pci/cadence' - Fix bitmap size when searching for free outbound region (Dan Carpenter) - Do device-specific setup to allow PTM Responder to be enabled (Christian Gmeiner) - Don't advertise FLR in Device Capabilities register because the controller incorrectly resets Margining Lane Status and Margining Lane Control on FLR (Parshuram Thombare) * remotes/lorenzo/pci/cadence: PCI: cadence: Clear FLR in device capabilities register PCI: cadence: Allow PTM Responder to be enabled PCI: cadence: Fix find_first_zero_bit() limit commit 8d8b2669f98e8276ce0c26f5d9562a8ace2f9744 Merge: f1bde2786d8e1 a91ee0e9fca9d Author: Bjorn Helgaas Date: Tue May 24 16:42:23 2022 -0500 Merge branch 'pci/virtualization' - Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang, Jay Zhou) * pci/virtualization: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() commit f1bde2786d8e1218e40b47788f3a4929c2a3ece0 Merge: 6b5e9bdce6cf6 0ae084d5a6744 Author: Bjorn Helgaas Date: Tue May 24 16:42:22 2022 -0500 Merge branch 'pci/resource' - Clip only host bridge windows for E820 regions and log what is clipped (Bjorn Helgaas) - Add kernel cmdline options to use/ignore E820 reserved regions (Hans de Goede) - Disable E820 reserved region clipping for IdeaPads, Yoga, Yoga Slip, Acer Spin 5, Clevo Barebone systems where clipping leaves no usable address space for touchpads, Thunderbolt devices, etc (Hans de Goede) - Disable E820 reserved region clipping by default starting in 2023 (Hans de Goede) * pci/resource: x86/PCI: Disable E820 reserved region clipping starting in 2023 x86/PCI: Disable E820 reserved region clipping via quirks x86/PCI: Add kernel cmdline options to use/ignore E820 reserved regions x86/PCI: Clip only host bridge windows for E820 regions x86: Log resource clipping for E820 regions x86/PCI: Eliminate remove_e820_regions() common subexpressions commit 6b5e9bdce6cf6e2e88b50e85aec0a2193dc69890 Merge: 4f5bc91ce1be9 0f40ac35e4ecb Author: Bjorn Helgaas Date: Tue May 24 16:42:22 2022 -0500 Merge branch 'pci/pm' - Define pci_restore_standard_config() only for CONFIG_PM_SLEEP, since it's not used otherwise (Krzysztof Kozlowski) - Power up all devices during runtime resume (Rafael J. Wysocki) - Resume subordinate bus in bus type callbacks (Rafael J. Wysocki) - Drop pci_dev runtime_d3cold flag since no uses remain (Rafael J. Wysocki) - Move power-up to D0 code to pci_power_up() and rename pci_raw_set_power_state() to pci_set_low_power_state() (Rafael J. Wysocki) - Set current_state to D3cold if the device is not accessible (Rafael J. Wysocki) - Do not call pci_update_current_state() from pci_power_up() (Rafael J. Wysocki) - Write 0 to PMCSR in pci_power_up() in all cases (Rafael J. Wysocki) - Split part of pci_power_up() off to pci_set_full_power_state() (Rafael J. Wysocki) - Do not restore BARs if device is not in D0 (Rafael J. Wysocki) * pci/pm: PCI/PM: Replace pci_set_power_state() in pci_pm_thaw_noirq() PCI/PM: Rearrange pci_set_power_state() PCI/PM: Clean up pci_set_low_power_state() PCI/PM: Do not restore BARs if device is not in D0 PCI/PM: Split pci_power_up() PCI/PM: Write 0 to PMCSR in pci_power_up() in all cases PCI/PM: Do not call pci_update_current_state() from pci_power_up() PCI/PM: Unfold pci_platform_power_transition() in pci_power_up() PCI/PM: Set current_state to D3cold if the device is not accessible PCI/PM: Relocate pci_set_low_power_state() PCI/PM: Split pci_raw_set_power_state() PCI/PM: Rearrange pci_update_current_state() PCI/PM: Drop the runtime_d3cold device flag PCI/PM: Resume subordinate bus in bus type callbacks PCI/PM: Power up all devices during runtime resume PCI/PM: Define pci_restore_standard_config() only for CONFIG_PM_SLEEP commit 4f5bc91ce1be9c0b5ad99cf2d3b97f8d28ac13e7 Merge: e840e475397ed 1af7c26c59ebc Author: Bjorn Helgaas Date: Tue May 24 16:42:22 2022 -0500 Merge branch 'pci/p2pdma' - Update pci_p2pdma_whitelist[] checking so we accept Skylake-E Root Ports even if they're not at devfn 00.0 (Shlomo Pongratz) * pci/p2pdma: PCI/P2PDMA: Whitelist Intel Skylake-E Root Ports at any devfn commit e840e475397ed81f3885af563b1a725debf2a3ac Merge: 85ae3970a0e39 f21949c149680 Author: Bjorn Helgaas Date: Tue May 24 16:42:21 2022 -0500 Merge branch 'pci/misc' - Change pci_set_dma_mask() documentation references to dma_set_mask() (Alex Williamson) * pci/misc: PCI/doc: Update obsolete pci_set_dma_mask() references commit 85ae3970a0e393cbb07ec30ac99d82cfd6c3f922 Merge: 55fd033bae79a b2851926c6d9d Author: Bjorn Helgaas Date: Tue May 24 16:42:21 2022 -0500 Merge branch 'pci/hotplug' - Allow D3 only if Root Port can signal and wake from D3 so we don't miss hotplug events on AMD Yellow Carp (Mario Limonciello) - Clean up hotplug include files to enable future powerpc cleanup (Christophe Leroy) * pci/hotplug: PCI: hotplug: Clean up include files PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 commit 55fd033bae79a2d51a1804f10dc54b1182a8aa32 Merge: ae0d0d18a8056 203926da2bff8 Author: Bjorn Helgaas Date: Tue May 24 16:42:21 2022 -0500 Merge branch 'pci/error' - Clear AER "multiple errors" bits to avoid race that left them set forever (Kuppuswamy Sathyanarayanan) * pci/error: PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits commit ae0d0d18a8056b59a84384d617eeca3e6c43ccc4 Merge: 3123109284176 03038d84ace72 Author: Bjorn Helgaas Date: Tue May 24 16:42:20 2022 -0500 Merge branch 'pci/aspm' - Quirk Intel DG2 ASPM L1 acceptable latency to be unlimited. The device advertises that it can only tolerate 1us, which means L1 is rarely if ever used (Mika Westerberg) * pci/aspm: PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited commit 3f467d122f27f3a0be7fa7f2f60c7dd9475c4a81 Author: Dmitry Baryshkov Date: Fri May 6 18:21:03 2022 +0300 dt-bindings: PCI: qcom: Add schema for sc7280 chipset Add support for sc7280-specific clock and reset definitions. Link: https://lore.kernel.org/r/20220506152107.1527552-5-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring commit c6523c4a301d3adff7ddcf57515b9c847beb7566 Author: Dmitry Baryshkov Date: Fri May 6 18:21:02 2022 +0300 dt-bindings: PCI: qcom: Specify reg-names explicitly Instead of specifying the enum of possible reg-names, specify them explicitly. This allows us to specify which chipsets need the "atu" regions and which do not. Also it clearly describes which platforms enumerate PCIe cores using the dbi region and which use parf region for that. Link: https://lore.kernel.org/r/20220506152107.1527552-4-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring commit 6700a9b00f0aad206903b6ff216db56faf964654 Author: Dmitry Baryshkov Date: Fri May 6 18:21:01 2022 +0300 dt-bindings: PCI: qcom: Do not require resets on msm8996 platforms On MSM8996/APQ8096 platforms the PCIe controller doesn't have any resets. So move the requirement stanza under the corresponding if condition. Link: https://lore.kernel.org/r/20220506152107.1527552-3-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring commit 075a9d55932edc8bddf85c6f8c0764928691cde4 Author: Dmitry Baryshkov Date: Fri May 6 18:21:00 2022 +0300 dt-bindings: PCI: qcom: Convert to YAML Changes to the schema: - Fixed the ordering of clock-names/reset-names according to the dtsi files. - Mark vdda-supply as required only for apq/ipq8064 (as it was marked as generally required in the txt file). Changes to examples: - Inline clock and reset numbers rather than including dt-bindings files because of conflicts between the headers - Split ranges and reg properties to follow current practice - Change -gpio to -gpios - Update IRQ flags to LEVEL_HIGH rater than NONE - Removed extra "snps,dw-pcie" compatibility. Note: while it was not clearly described in text schema, the majority of Qualcomm platforms follow the snps,dw-pcie schema and use two compatibility strings in the DT files: platform-specific one and a fallback to the generic snps,dw-pcie one. However the platform itself is not compatible with the snps,dw-pcie interface, so we are going to remove it. Link: https://lore.kernel.org/r/20220506152107.1527552-2-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring commit 83013631f0f9961416abd812e228c8efbc2f6069 Author: Johan Hovold Date: Fri Apr 1 15:38:54 2022 +0200 PCI: qcom: Fix unbalanced PHY init on probe errors Undo the PHY initialisation (e.g. balance runtime PM) if host initialisation fails during probe. Link: https://lore.kernel.org/r/20220401133854.10421-3-johan+linaro@kernel.org Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") Signed-off-by: Johan Hovold Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Acked-by: Stanimir Varbanov Cc: stable@vger.kernel.org # 4.5 commit 87d83b96c8d6c6c2d2096bd0bdba73bcf42b8ef0 Author: Johan Hovold Date: Fri Apr 1 15:38:53 2022 +0200 PCI: qcom: Fix runtime PM imbalance on probe errors Drop the leftover pm_runtime_disable() calls from the late probe error paths that would, for example, prevent runtime PM from being reenabled after a probe deferral. Link: https://lore.kernel.org/r/20220401133854.10421-2-johan+linaro@kernel.org Fixes: 6e5da6f7d824 ("PCI: qcom: Fix error handling in runtime PM support") Signed-off-by: Johan Hovold Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Acked-by: Stanimir Varbanov Cc: stable@vger.kernel.org # 4.20 Cc: Bjorn Andersson commit fdf6a2f533115ec5d4d9629178f8196331f1ac50 Author: Johan Hovold Date: Fri Apr 1 15:33:51 2022 +0200 PCI: qcom: Fix pipe clock imbalance Fix a clock imbalance introduced by ed8cc3b1fc84 ("PCI: qcom: Add support for SDM845 PCIe controller"), which enables the pipe clock both in init() and in post_init() but only disables in post_deinit(). Note that the pipe clock was also never disabled in the init() error paths and that enabling the clock before powering up the PHY looks questionable. Link: https://lore.kernel.org/r/20220401133351.10113-1-johan+linaro@kernel.org Fixes: ed8cc3b1fc84 ("PCI: qcom: Add support for SDM845 PCIe controller") Signed-off-by: Johan Hovold Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Bjorn Andersson Cc: stable@vger.kernel.org # 5.6 commit a935601eed18d739c11da5504b551c7c4754f2ec Author: Bhupesh Sharma Date: Sat Mar 26 11:38:10 2022 +0530 PCI: qcom: Add SM8150 SoC support The PCIe IP (rev 1.5.0) on SM8150 SoC is similar to the one used on SM8250. Add SM8150 support, reusing the members of ops_1_9_0. Link: https://lore.kernel.org/r/20220326060810.1797516-3-bhupesh.sharma@linaro.org Signed-off-by: Bhupesh Sharma Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Dmitry Baryshkov Reviewed-by: Rob Herring Cc: Vinod Koul commit a6e25b39adc3f68b9bc46f8e100345ee9bf62f8c Author: Bhupesh Sharma Date: Sat Mar 26 11:38:09 2022 +0530 dt-bindings: pci: qcom: Document PCIe bindings for SM8150 SoC Document the PCIe DT bindings for SM8150 SoC. The PCIe IP is similar to the one used on SM8250. Link: https://lore.kernel.org/r/20220326060810.1797516-2-bhupesh.sharma@linaro.org Signed-off-by: Bhupesh Sharma Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring Cc: Lorenzo Pieralisi Cc: Bjorn Andersson commit d335371940179318df97d66baef13987ee6e796b Merge: 076f222a690e1 2c51d0d88020b Author: Linus Torvalds Date: Tue May 24 14:31:29 2022 -0700 Merge tag 'mtd/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "MTD core changes: - Call of_platform_populate() for MTD partitions - Check devicetree alias for index - mtdoops: - Add a timestamp to the mtdoops header. - Create a header structure for the saved mtdoops. - Fix the size of the header read buffer. - mtdblock: Warn if opened on NAND - Bindings: - reserved-memory: Support MTD/block device - jedec,spi-nor: remove unneeded properties - Extend fixed-partitions binding - Add Sercomm (Suzhou) Corporation vendor prefix MTD driver changes: - st_spi_fsm: add missing clk_disable_unprepare() in stfsm_remove() - phram: - Allow cached mappings - Allow probing via reserved-memory - maps: ixp4xx: Drop driver - bcm47xxpart: Print correct offset on read error CFI driver changes: - Rename chip_ready variables - Add S29GL064N ID definition - Use chip_ready() for write on S29GL064N - Move and rename chip_check/chip_ready/chip_good_for_write NAND core changes: - Print offset instead of page number for bad blocks Raw NAND controller drivers: - Cadence: Fix possible null-ptr-deref in cadence_nand_dt_probe() - CS553X: simplify the return expression of cs553x_write_ctrl_byte() - Davinci: Remove redundant unsigned comparison to zero - Denali: Use managed device resources - GPMI: - Add large oob bch setting support - Rename the variable ecc_chunk_size - Uninline the gpmi_check_ecc function - Add strict ecc strength check - Refactor BCH geometry settings function - Intel: Fix possible null-ptr-deref in ebu_nand_probe() - MPC5121: Check before clk_disable_unprepare() not needed - Mtk: - MTD_NAND_ECC_MEDIATEK should depend on ARCH_MEDIATEK - Also parse the default nand-ecc-engine property if available - Make mtk_ecc.c a separated module - OMAP ELM: - Convert the bindings to yaml - Describe the bindings for AM64 ELM - Add support for its compatible - Renesas: Use runtime PM instead of the raw clock API and update the bindings accordingly - Rockchip: Check before clk_disable_unprepare() not needed - TMIO: Check return value after calling platform_get_resource() Raw NAND chip driver: - Kioxia: Add support for TH58NVG3S0HBAI4 and TC58NVG0S3HTA00 SPI-NAND chip drivers: - Gigadevice: - Add support for: - GD5FxGM7xExxG - GD5F{2,4}GQ5xExxG - GD5F1GQ5RExxG - GD5FxGQ4xExxG - Fix Quad IO for GD5F1GQ5UExxG - XTX: Add support for XT26G0xA SPI NOR core changes: - Read back written SR value to make sure the write was done correctly. - Introduce a common function for Read ID that manufacturer drivers can use to verify the Octal DTR switch worked correctly. - Add helpers for read/write any register commands so manufacturer drivers don't open code it every time. - Clarify rdsr dummy cycles documentation. - Add debugfs entry to expose internal flash parameters and state. SPI NOR manufacturer drivers changes: - Add support for Winbond W25Q512NW-IM, and Eon EN25QH256A. - Move spi_nor_write_ear() to Winbond module since only Winbond flashes use it. - Rework Micron and Cypress Octal DTR enable methods to improve readability. - Use the common Read ID function to verify switch to Octal DTR mode for Micron and Cypress flashes. - Skip polling status on volatile register writes for Micron and Cypress flashes since the operation is instant" * tag 'mtd/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (68 commits) mtd: st_spi_fsm: add missing clk_disable_unprepare() in stfsm_remove() dt-bindings: mtd: partitions: Extend fixed-partitions binding dt-bindings: Add Sercomm (Suzhou) Corporation vendor prefix mtd: phram: Allow cached mappings mtd: call of_platform_populate() for MTD partitions mtd: rawnand: renesas: Use runtime PM instead of the raw clock API dt-bindings: mtd: renesas: Fix the NAND controller description mtd: rawnand: mpc5121: Check before clk_disable_unprepare() not needed mtd: rawnand: rockchip: Check before clk_disable_unprepare() not needed mtd: nand: MTD_NAND_ECC_MEDIATEK should depend on ARCH_MEDIATEK mtd: rawnand: cs553x: simplify the return expression of cs553x_write_ctrl_byte() mtd: rawnand: kioxia: Add support for TH58NVG3S0HBAI4 mtd: spi-nor: debugfs: fix format specifier mtd: spi-nor: support eon en25qh256a variant mtd: spi-nor: winbond: add support for W25Q512NW-IM mtd: spi-nor: expose internal parameters via debugfs mtd: spi-nor: export spi_nor_hwcaps_pp2cmd() mtd: spi-nor: move spi_nor_write_ear() to winbond module mtd: spi-nor: amend the rdsr dummy cycles documentation mtd: cfi_cmdset_0002: Rename chip_ready variables ... commit 076f222a690e11b433d2b1e218dbd9bdb08fb190 Merge: 0350785b0a092 8877ecb0fc8d7 Author: Linus Torvalds Date: Tue May 24 14:23:10 2022 -0700 Merge tag 'hwmon-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Driver for the Microchip LAN966x SoC - PMBus driver for Infineon Digital Multi-phase xdp152 family controllers Chip support added to existing drivers: - asus-ec-sensors: - Support for ROG STRIX X570-E GAMING WIFI II, PRIME X470-PRO, and ProArt X570 Creator WIFI - External temperature sensor support for ASUS WS X570-ACE - nct6775: - Support for I2C driver - Support for ASUS PRO H410T / PRIME H410M-R / ROG X570-E GAMING WIFI II - lm75: - Support for - Atmel AT30TS74 - pmbus/max16601: - Support for MAX16602 - aquacomputer_d5next: - Support for Aquacomputer Farbwerk - Support for Aquacomputer Octo - jc42: - Support for S-34TS04A Kernel API changes / clarifications: - The chip parameter of with_info API is now mandatory - New hwmon_device_register_for_thermal API call for use by the thermal subsystem Improvements: - PMBus and JC42 drivers now register with thermal subsystem - PMBus drivers now support get_voltage/set_voltage power operations - The adt7475 driver now supports pin configuration - The lm90 driver now supports setting extended range temperatures configuration with a devicetree property - The dell-smm driver now registers as cooling device - The OCC driver delays hwmon registration until requested by userspace ... and various other minor fixes and improvements" * tag 'hwmon-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (71 commits) hwmon: (aquacomputer_d5next) Fix an error handling path in aqc_probe() hwmon: (sl28cpld) Fix typo in comment hwmon: (pmbus) Check PEC support before reading other registers hwmon: (dimmtemp) Fix bitmap handling hwmon: (lm90) enable extended range according to DTS node dt-bindings: hwmon: lm90: add ti,extended-range-enable property dt-bindings: hwmon: lm90: add missing ti,tmp461 hwmon: (ibmaem) Directly use ida_alloc()/free() hwmon: Directly use ida_alloc()/free() hwmon: (asus-ec-sensors) fix Formula VIII definition dt-bindings: trivial-devices: Add xdp152 hwmon: (sl28cpld-hwmon) Use HWMON_CHANNEL_INFO macro hwmon: (pwm-fan) Use HWMON_CHANNEL_INFO macro hwmon: (peci/dimmtemp) Use HWMON_CHANNEL_INFO macro hwmon: (peci/cputemp) Use HWMON_CHANNEL_INFO macro hwmon: (mr75203) Use HWMON_CHANNEL_INFO macro hwmon: (ltc2992) Use HWMON_CHANNEL_INFO macro hwmon: (as370-hwmon) Use HWMON_CHANNEL_INFO macro hwmon: Make chip parameter for with_info API mandatory thermal/drivers/thermal_hwmon: Use hwmon_device_register_for_thermal() ... commit 0350785b0a092c99c5ddd2ace0260dbe7b3f919f Merge: 7cf6a8a17f5b1 048ae41bb0806 Author: Linus Torvalds Date: Tue May 24 13:50:39 2022 -0700 Merge tag 'integrity-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull IMA updates from Mimi Zohar: "New is IMA support for including fs-verity file digests and signatures in the IMA measurement list as well as verifying the fs-verity file digest based signatures, both based on policy. In addition, are two bug fixes: - avoid reading UEFI variables, which cause a page fault, on Apple Macs with T2 chips. - remove the original "ima" template Kconfig option to address a boot command line ordering issue. The rest is a mixture of code/documentation cleanup" * tag 'integrity-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: integrity: Fix sparse warnings in keyring_handler evm: Clean up some variables evm: Return INTEGRITY_PASS for enum integrity_status value '0' efi: Do not import certificates from UEFI Secure Boot for T2 Macs fsverity: update the documentation ima: support fs-verity file digest based version 3 signatures ima: permit fsverity's file digests in the IMA measurement list ima: define a new template field named 'd-ngv2' and templates fs-verity: define a function to return the integrity protected file digest ima: use IMA default hash algorithm for integrity violations ima: fix 'd-ng' comments and documentation ima: remove the IMA_TEMPLATE Kconfig option ima: remove redundant initialization of pointer 'file'. commit 7cf6a8a17f5b134b7e783c2d45c53298faef82a7 Merge: a9d1046a84657 7f3113e3b9f72 Author: Linus Torvalds Date: Tue May 24 13:16:50 2022 -0700 Merge tag 'tpmdd-next-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: - Tightened validation of key hashes for SYSTEM_BLACKLIST_HASH_LIST. An invalid hash format causes a compilation error. Previously, they got included to the kernel binary but were silently ignored at run-time. - Allow root user to append new hashes to the blacklist keyring. - Trusted keys backed with Cryptographic Acceleration and Assurance Module (CAAM), which part of some of the new NXP's SoC's. Now there is total three hardware backends for trusted keys: TPM, ARM TEE and CAAM. - A scattered set of fixes and small improvements for the TPM driver. * tag 'tpmdd-next-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: MAINTAINERS: add KEYS-TRUSTED-CAAM doc: trusted-encrypted: describe new CAAM trust source KEYS: trusted: Introduce support for NXP CAAM-based trusted keys crypto: caam - add in-kernel interface for blob generator crypto: caam - determine whether CAAM supports blob encap/decap KEYS: trusted: allow use of kernel RNG for key material KEYS: trusted: allow use of TEE as backend without TCG_TPM support tpm: Add field upgrade mode support for Infineon TPM2 modules tpm: Fix buffer access in tpm2_get_tpm_pt() char: tpm: cr50_i2c: Suppress duplicated error message in .remove() tpm: cr50: Add new device/vendor ID 0x504a6666 tpm: Remove read16/read32/write32 calls from tpm_tis_phy_ops tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() tpm/tpm_ftpm_tee: Return true/false (not 1/0) from bool functions certs: Explain the rationale to call panic() certs: Allow root user to append signed hashes to the blacklist keyring certs: Check that builtin blacklist hashes are valid certs: Make blacklist_vet_description() more strict certs: Factor out the blacklist hash creation tools/certs: Add print-cert-tbs-hash.sh commit a9d1046a846571422a92d2b8fbf8a8b24221b9a3 Merge: cb44e4f061e16 eaff451d4b7c8 Author: Linus Torvalds Date: Tue May 24 13:13:50 2022 -0700 Merge tag 'Smack-for-5.19' of https://github.com/cschaufler/smack-next Pull smack update from Casey Schaufler: "A single change to remove a pointless assignment" * tag 'Smack-for-5.19' of https://github.com/cschaufler/smack-next: smack: Remove redundant assignments commit cb44e4f061e16be65b8a16505e121490c66d30d0 Merge: efd1df1982e92 5e469829baa1b Author: Linus Torvalds Date: Tue May 24 13:09:13 2022 -0700 Merge tag 'landlock-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock updates from Mickaël Salaün: - improve the path_rename LSM hook implementations for RENAME_EXCHANGE; - fix a too-restrictive filesystem control for a rare corner case; - set the nested sandbox limitation to 16 layers; - add a new LANDLOCK_ACCESS_FS_REFER access right to properly handle file reparenting (i.e. full rename and link support); - add new tests and documentation; - format code with clang-format to make it easier to maintain and contribute. * tag 'landlock-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (30 commits) landlock: Explain how to support Landlock landlock: Add design choices documentation for filesystem access rights landlock: Document good practices about filesystem policies landlock: Document LANDLOCK_ACCESS_FS_REFER and ABI versioning samples/landlock: Add support for file reparenting selftests/landlock: Add 11 new test suites dedicated to file reparenting landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER LSM: Remove double path_rename hook calls for RENAME_EXCHANGE landlock: Move filesystem helpers and add a new one landlock: Fix same-layer rule unions landlock: Create find_rule() from unmask_layers() landlock: Reduce the maximum number of layers to 16 landlock: Define access_mask_t to enforce a consistent access mask size selftests/landlock: Test landlock_create_ruleset(2) argument check ordering landlock: Change landlock_restrict_self(2) check ordering landlock: Change landlock_add_rule(2) argument check ordering selftests/landlock: Add tests for O_PATH selftests/landlock: Fully test file rename with "remove" access selftests/landlock: Extend access right tests to directories selftests/landlock: Add tests for unknown access rights ... commit e98a860f65428a3cae7ed7b3e8ebcf6320d7fc5e Author: Bjorn Andersson Date: Mon May 23 16:37:19 2022 -0700 leds: qcom-lpg: Require pattern to follow documentation The leds-trigger-pattern documentation describes how the brightness of the LED should transition linearly from one brightness value to the next, over the given delta_t. But the pattern engine in the Qualcomm LPG hardware only supports holding the brightness for each entry for the period. This subset of patterns can be represented in the leds-trigger-pattern by injecting zero-time transitions after each entry in the pattern, resulting in a pattern that pattern that can be rendered by the LPG. Rework LPG pattern interface to require these zero-time transitions, to make it comply with this subset of patterns and reject the patterns it can't render. Fixes: 24e2d05d1b68 ("leds: Add driver for Qualcomm LPG") Signed-off-by: Bjorn Andersson Signed-off-by: Pavel Machek commit efd1df1982e9203b4f56cb0d5946a24885260ce5 Merge: a6b450573b912 1af0e4a0233fe Author: Linus Torvalds Date: Tue May 24 13:06:32 2022 -0700 Merge tag 'selinux-pr-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "We've got twelve patches queued for v5.19, with most being fairly minor. The highlights are below: - The checkreqprot and runtime disable knobs have been deprecated for some time with no active users that we can find. In an effort to move things along we are adding a pause when the knobs are used to help make the deprecation more noticeable in case anyone is still using these hacks in the shadows. - We've added the anonymous inode class name to the AVC audit records when anonymous inodes are involved. This should make writing policy easier when anonymous inodes are involved. - More constification work. This is fairly straightforward and the source of most of the diffstat. - The usual minor cleanups: remove unnecessary assignments, assorted style/checkpatch fixes, kdoc fixes, macro while-loop encapsulations, #include tweaks, etc" * tag 'selinux-pr-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: security: declare member holding string literal const selinux: log anon inode class name selinux: declare data arrays const selinux: fix indentation level of mls_ops block selinux: include necessary headers in headers selinux: avoid extra semicolon selinux: update parameter documentation selinux: resolve checkpatch errors selinux: don't sleep when CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is true selinux: checkreqprot is deprecated, add some ssleep() discomfort selinux: runtime disable is deprecated, add some ssleep() discomfort selinux: Remove redundant assignments commit a6b450573b912316ad36262bfc70e7c3870c56d1 Merge: dc8af1ffd657c 70578ff3367dd Author: Linus Torvalds Date: Tue May 24 12:49:48 2022 -0700 Merge tag 'execve-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Fix binfmt_flat GOT handling for riscv (Niklas Cassel) - Remove unused/broken binfmt_flat shared library and coredump code (Eric W. Biederman) * tag 'execve-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_flat: Remove shared library support binfmt_flat: Drop vestiges of coredump support binfmt_flat: do not stop relocating GOT entries prematurely on riscv commit dc8af1ffd657c90733088e0093c7990305b2b4e9 Merge: 0bf13a84362e7 5e91d2a414694 Author: Linus Torvalds Date: Tue May 24 12:37:24 2022 -0700 Merge tag 'seccomp-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: - Rework USER_NOTIF notification ordering and kill logic (Sargun Dhillon) - Improved PTRACE_O_SUSPEND_SECCOMP selftest (Jann Horn) - Gracefully handle failed unshare() in selftests (Yang Guang) - Spelling fix (Colin Ian King) * tag 'seccomp-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Fix spelling mistake "Coud" -> "Could" selftests/seccomp: Add test for wait killable notifier selftests/seccomp: Refactor get_proc_stat to split out file reading code seccomp: Add wait_killable semantic to seccomp user notifier selftests/seccomp: Ensure that notifications come in FIFO order seccomp: Use FIFO semantics to order notifications selftests/seccomp: Add SKIP for failed unshare() selftests/seccomp: Test PTRACE_O_SUSPEND_SECCOMP without CAP_SYS_ADMIN commit 5f41fdaea63ddf96d921ab36b2af4a90ccdb5744 Author: Eric Biggers Date: Thu May 19 13:44:37 2022 -0700 ext4: only allow test_dummy_encryption when supported Make the test_dummy_encryption mount option require that the encrypt feature flag be already enabled on the filesystem, rather than automatically enabling it. Practically, this means that "-O encrypt" will need to be included in MKFS_OPTIONS when running xfstests with the test_dummy_encryption mount option. (ext4/053 also needs an update.) Moreover, as long as the preconditions for test_dummy_encryption are being tightened anyway, take the opportunity to start rejecting it when !CONFIG_FS_ENCRYPTION rather than ignoring it. The motivation for requiring the encrypt feature flag is that: - Having the filesystem auto-enable feature flags is problematic, as it bypasses the usual sanity checks. The specific issue which came up recently is that in kernel versions where ext4 supports casefold but not encrypt+casefold (v5.1 through v5.10), the kernel will happily add the encrypt flag to a filesystem that has the casefold flag, making it unmountable -- but only for subsequent mounts, not the initial one. This confused the casefold support detection in xfstests, causing generic/556 to fail rather than be skipped. - The xfstests-bld test runners (kvm-xfstests et al.) already use the required mkfs flag, so they will not be affected by this change. Only users of test_dummy_encryption alone will be affected. But, this option has always been for testing only, so it should be fine to require that the few users of this option update their test scripts. - f2fs already requires it (for its equivalent feature flag). Signed-off-by: Eric Biggers Reviewed-by: Gabriel Krisman Bertazi Link: https://lore.kernel.org/r/20220519204437.61645-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit d36f6ed761b53933b0b4126486c10d3da7751e7f Author: Baokun Li Date: Wed May 18 20:08:16 2022 +0800 ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567 ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980 ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031 ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257 v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63 v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82 vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368 dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490 ext4_quota_enable fs/ext4/super.c:6137 [inline] ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163 ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754 mount_bdev+0x2e9/0x3b0 fs/super.c:1158 mount_fs+0x4b/0x1e4 fs/super.c:1261 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_enable_quotas ext4_quota_enable ext4_iget __ext4_iget ext4_ext_check_inode ext4_ext_check __ext4_ext_check ext4_valid_extent_entries Check for overlapping extents does't take effect dquot_enable vfs_load_quota_inode v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent ext4_es_cache_extent __es_tree_search ext4_es_end BUG_ON(es->es_lblk + es->es_len < es->es_lblk) The error ext4 extents is as follows: 0af3 0300 0400 0000 00000000 extent_header 00000000 0100 0000 12000000 extent1 00000000 0100 0000 18000000 extent2 02000000 0400 0000 14000000 extent3 In the ext4_valid_extent_entries function, if prev is 0, no error is returned even if lblock<=prev. This was intended to skip the check on the first extent, but in the error image above, prev=0+1-1=0 when checking the second extent, so even though lblock<=prev, the function does not return an error. As a result, bug_ON occurs in __es_tree_search and the system panics. To solve this problem, we only need to check that: 1. The lblock of the first extent is not less than 0. 2. The lblock of the next extent is not less than the next block of the previous extent. The same applies to extent_idx. Cc: stable@kernel.org Fixes: 5946d089379a ("ext4: check for overlapping extents in ext4_valid_extent_entries()") Reported-by: Hulk Robot Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220518120816.1541863-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 3ba733f879c2a88910744647e41edeefbc0d92b2 Author: Jan Kara Date: Wed May 18 11:33:29 2022 +0200 ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its hands while doing a node split and consequently accessing unallocated memory. Fix the problem by verifying traversed block numbers are unique. Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 46c116b920ebec58031f0a78c5ea9599b0d2a371 Author: Jan Kara Date: Wed May 18 11:33:28 2022 +0200 ext4: verify dir block before splitting it Before splitting a directory block verify its directory entries are sane so that the splitting code does not access memory it should not. Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220518093332.13986-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit c878bea3c9d724ddfa05a813f30de3d25a0ba83f Author: Theodore Ts'o Date: Tue May 17 13:27:55 2022 -0400 ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state The EXT4_FC_REPLAY bit in sbi->s_mount_state is used to indicate that we are in the middle of replay the fast commit journal. This was actually a mistake, since the sbi->s_mount_info is initialized from es->s_state. Arguably s_mount_state is misleadingly named, but the name is historical --- s_mount_state and s_state dates back to ext2. What should have been used is the ext4_{set,clear,test}_mount_flag() inline functions, which sets EXT4_MF_* bits in sbi->s_mount_flags. The problem with using EXT4_FC_REPLAY is that a maliciously corrupted superblock could result in EXT4_FC_REPLAY getting set in s_mount_state. This bypasses some sanity checks, and this can trigger a BUG() in ext4_es_cache_extent(). As a easy-to-backport-fix, filter out the EXT4_FC_REPLAY bit for now. We should eventually transition away from EXT4_FC_REPLAY to something like EXT4_MF_REPLAY. Cc: stable@kernel.org Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20220420192312.1655305-1-phind.uet@gmail.com Link: https://lore.kernel.org/r/20220517174028.942119-1-tytso@mit.edu Reported-by: syzbot+c7358a3cd05ee786eb31@syzkaller.appspotmail.com commit d87c48ce4d8951f46d21f17ea86bba8853049862 Author: Ronnie Sahlberg Date: Tue May 10 09:42:07 2022 +1000 cifs: cache the dirents for entries in a cached directory This adds caching of the directory entries for a cached directory while we keep a lease on the directory. Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit c360abbb9db298d0548b31e1a86a48ebb157d7cd Author: Bob Peterson Date: Fri Feb 11 10:50:36 2022 -0500 gfs2: Convert function bh_get to use iomap Before this patch, function bh_get used block_map to figure out the block it needed to read in from the quota_change file. This patch changes it to use iomap directly to make it more efficient. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 5fcff61eea9efd1f4b60e89d2d686b5feaea100f Author: Bob Peterson Date: Fri Feb 11 10:50:08 2022 -0500 gfs2: use i_lock spin_lock for inode qadata Before this patch, functions gfs2_qa_get and _put used the i_rw_mutex to prevent simultaneous access to its i_qadata. But i_rw_mutex is now used for many other things, including iomap_begin and end, which causes a conflict according to lockdep. We cannot just remove the lock since simultaneous opens (gfs2_open -> gfs2_open_common -> gfs2_qa_get) can then stomp on each others values for i_qadata. This patch solves the conflict by using the i_lock spin_lock in the inode to prevent simultaneous access. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit f4a47561fcc1494ee3f273163189cf4462b6a245 Author: Andrew Price Date: Tue Mar 22 18:49:19 2022 +0000 gfs2: Return more useful errors from gfs2_rgrp_send_discards() The bug that 27ca8273f ("gfs2: Make sure FITRIM minlen is rounded up to fs block size") fixes was a little confusing as the user saw "Input/output error" which masked the -EINVAL that sb_issue_discard() returned. sb_issue_discard() can fail for various reasons, so we should return its return value from gfs2_rgrp_send_discards() to avoid all errors being reported as IO errors. This improves error reporting for FITRIM and makes no difference to the -o discard code path because the return value from gfs2_rgrp_send_discards() gets thrown away in that case (and the option switches off). Presumably that's why it was ok to just return -EIO in the past, before FITRIM was implemented. Tested with xfstests. Signed-off-by: Andrew Price Signed-off-by: Andreas Gruenbacher commit 11d8b79e849db099b04584913880a799549aaad5 Author: Kees Cook Date: Sun May 8 03:06:30 2022 -0700 gfs2: Use container_of() for gfs2_glock(aspace) Clang's structure layout randomization feature gets upset when it sees struct address_space (which is randomized) cast to struct gfs2_glock. This is due to seeing the mapping pointer as being treated as an array of gfs2_glock, rather than "something else, before struct address_space": In file included from fs/gfs2/acl.c:23: fs/gfs2/meta_io.h:44:12: error: casting from randomized structure pointer type 'struct address_space *' to 'struct gfs2_glock *' return (((struct gfs2_glock *)mapping) - 1)->gl_name.ln_sbd; ^ Replace the instances of open-coded pointer math with container_of() usage, and update the allocator to match. Some cleanups and conversion of gfs2_glock_get() and gfs2_glock_dealloc() by Andreas. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202205041550.naKxwCBj-lkp@intel.com Cc: Bob Peterson Cc: Andreas Gruenbacher Cc: Bill Wendling Cc: cluster-devel@redhat.com Signed-off-by: Kees Cook Signed-off-by: Andreas Gruenbacher commit 53bb540fd591f6fdd4cb5c9a785d9790ac33862d Author: Andreas Gruenbacher Date: Tue Apr 26 23:31:06 2022 +0200 gfs2: Explain some direct I/O oddities Add some comments explaining the oddities of partial direct I/O reads and writes. Signed-off-by: Andreas Gruenbacher commit 0bf13a84362e750a90008af259b098d7c0e0755b Merge: 51518aa68c1ff ed5edd5a70b95 Author: Linus Torvalds Date: Tue May 24 12:27:09 2022 -0700 Merge tag 'kernel-hardening-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kernel hardening updates from Kees Cook: - usercopy hardening expanded to check other allocation types (Matthew Wilcox, Yuanzheng Song) - arm64 stackleak behavioral improvements (Mark Rutland) - arm64 CFI code gen improvement (Sami Tolvanen) - LoadPin LSM block dev API adjustment (Christoph Hellwig) - Clang randstruct support (Bill Wendling, Kees Cook) * tag 'kernel-hardening-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (34 commits) loadpin: stop using bdevname mm: usercopy: move the virt_addr_valid() below the is_vmalloc_addr() gcc-plugins: randstruct: Remove cast exception handling af_unix: Silence randstruct GCC plugin warning niu: Silence randstruct warnings big_keys: Use struct for internal payload gcc-plugins: Change all version strings match kernel randomize_kstack: Improve docs on requirements/rationale lkdtm/stackleak: fix CONFIG_GCC_PLUGIN_STACKLEAK=n arm64: entry: use stackleak_erase_on_task_stack() stackleak: add on/off stack variants lkdtm/stackleak: check stack boundaries lkdtm/stackleak: prevent unexpected stack usage lkdtm/stackleak: rework boundary management lkdtm/stackleak: avoid spurious failure stackleak: rework poison scanning stackleak: rework stack high bound handling stackleak: clarify variable names stackleak: rework stack low bound handling stackleak: remove redundant check ... commit 51518aa68c1ffb54f2fdfed5324af30325529b32 Merge: c1f4cfdbef409 e6af1bb07704b Author: Linus Torvalds Date: Tue May 24 12:22:56 2022 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity updates from Eric Biggers: "A couple small cleanups for fs/verity/" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fs-verity: Use struct_size() helper in enable_verity() fs-verity: remove unused parameter desc_size in fsverity_create_info() commit c1f4cfdbef409971fd9d6b1faae4d7cc72af3e20 Merge: ac2ab99072cce 218d921b581ea Author: Linus Torvalds Date: Tue May 24 12:17:45 2022 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: "Some cleanups for fs/crypto/: - Split up the misleadingly-named FS_CRYPTO_BLOCK_SIZE constant. - Consistently report the encryption implementation that is being used. - Add helper functions for the test_dummy_encryption mount option that work properly with the new mount API. ext4 and f2fs will use these" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fscrypt: add new helper functions for test_dummy_encryption fscrypt: factor out fscrypt_policy_to_key_spec() fscrypt: log when starting to use inline encryption fscrypt: split up FS_CRYPTO_BLOCK_SIZE commit 5752bf645f9dd7db600651f726eb04a97c9f597f Author: Shyam Prasad N Date: Fri Apr 8 13:31:37 2022 +0000 cifs: avoid parallel session setups on same channel After allowing channels to reconnect in parallel, it now becomes important to take care that multiple processes do not call negotiate/session setup in parallel on the same channel. This change avoids that by marking a channel as "in_reconnect". During session setup if the channel in question has this flag set, we return immediately. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit dd3cd8709ed5f4ae8998e0cd44c05bd26bc879e8 Author: Shyam Prasad N Date: Thu Apr 7 13:15:49 2022 +0000 cifs: use new enum for ses_status ses->status today shares statusEnum with server->tcpStatus. This has been confusing, and tcon->status has deviated to use a new enum. Follow suit and use new enum for ses_status as well. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 1a6a41d4cedd9b302e2200e6f0e3c44dbbe13689 Author: Shyam Prasad N Date: Wed Mar 30 09:22:20 2022 +0000 cifs: do not use tcpStatus after negotiate completes Recent changes to multichannel to allow channel reconnects to work in parallel and independent of each other did so by making use of tcpStatus for the connection, and status for the session. However, this did not take into account the multiuser scenario, where same connection is used by multiple connections. However, tcpStatus should be tracked only till the end of negotiate exchange, and not used for session setup. This change fixes this. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit ac2ab99072cce553c78f326ea22d72856f570d88 Merge: eadb2f47a3ced 1ce6c8d68f8ac Author: Linus Torvalds Date: Tue May 24 11:58:10 2022 -0700 Merge tag 'random-5.19-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator updates from Jason Donenfeld: "These updates continue to refine the work began in 5.17 and 5.18 of modernizing the RNG's crypto and streamlining and documenting its code. New for 5.19, the updates aim to improve entropy collection methods and make some initial decisions regarding the "premature next" problem and our threat model. The cloc utility now reports that random.c is 931 lines of code and 466 lines of comments, not that basic metrics like that mean all that much, but at the very least it tells you that this is very much a manageable driver now. Here's a summary of the various updates: - The random_get_entropy() function now always returns something at least minimally useful. This is the primary entropy source in most collectors, which in the best case expands to something like RDTSC, but prior to this change, in the worst case it would just return 0, contributing nothing. For 5.19, additional architectures are wired up, and architectures that are entirely missing a cycle counter now have a generic fallback path, which uses the highest resolution clock available from the timekeeping subsystem. Some of those clocks can actually be quite good, despite the CPU not having a cycle counter of its own, and going off-core for a stamp is generally thought to increase jitter, something positive from the perspective of entropy gathering. Done very early on in the development cycle, this has been sitting in next getting some testing for a while now and has relevant acks from the archs, so it should be pretty well tested and fine, but is nonetheless the thing I'll be keeping my eye on most closely. - Of particular note with the random_get_entropy() improvements is MIPS, which, on CPUs that lack the c0 count register, will now combine the high-speed but short-cycle c0 random register with the lower-speed but long-cycle generic fallback path. - With random_get_entropy() now always returning something useful, the interrupt handler now collects entropy in a consistent construction. - Rather than comparing two samples of random_get_entropy() for the jitter dance, the algorithm now tests many samples, and uses the amount of differing ones to determine whether or not jitter entropy is usable and how laborious it must be. The problem with comparing only two samples was that if the cycle counter was extremely slow, but just so happened to be on the cusp of a change, the slowness wouldn't be detected. Taking many samples fixes that to some degree. This, combined with the other improvements to random_get_entropy(), should make future unification of /dev/random and /dev/urandom maybe more possible. At the very least, were we to attempt it again today (we're not), it wouldn't break any of Guenter's test rigs that broke when we tried it with 5.18. So, not today, but perhaps down the road, that's something we can revisit. - We attempt to reseed the RNG immediately upon waking up from system suspend or hibernation, making use of the various timestamps about suspend time and such available, as well as the usual inputs such as RDRAND when available. - Batched randomness now falls back to ordinary randomness before the RNG is initialized. This provides more consistent guarantees to the types of random numbers being returned by the various accessors. - The "pre-init injection" code is now gone for good. I suspect you in particular will be happy to read that, as I recall you expressing your distaste for it a few months ago. Instead, to avoid a "premature first" issue, while still allowing for maximal amount of entropy availability during system boot, the first 128 bits of estimated entropy are used immediately as it arrives, with the next 128 bits being buffered. And, as before, after the RNG has been fully initialized, it winds up reseeding anyway a few seconds later in most cases. This resulted in a pretty big simplification of the initialization code and let us remove various ad-hoc mechanisms like the ugly crng_pre_init_inject(). - The RNG no longer pretends to handle the "premature next" security model, something that various academics and other RNG designs have tried to care about in the past. After an interesting mailing list thread, these issues are thought to be a) mainly academic and not practical at all, and b) actively harming the real security of the RNG by delaying new entropy additions after a potential compromise, making a potentially bad situation even worse. As well, in the first place, our RNG never even properly handled the premature next issue, so removing an incomplete solution to a fake problem was particularly nice. This allowed for numerous other simplifications in the code, which is a lot cleaner as a consequence. If you didn't see it before, https://lore.kernel.org/lkml/YmlMGx6+uigkGiZ0@zx2c4.com/ may be a thread worth skimming through. - While the interrupt handler received a separate code path years ago that avoids locks by using per-cpu data structures and a faster mixing algorithm, in order to reduce interrupt latency, input and disk events that are triggered in hardirq handlers were still hitting locks and more expensive algorithms. Those are now redirected to use the faster per-cpu data structures. - Rather than having the fake-crypto almost-siphash-based random32 implementation be used right and left, and in many places where cryptographically secure randomness is desirable, the batched entropy code is now fast enough to replace that. - As usual, numerous code quality and documentation cleanups. For example, the initialization state machine now uses enum symbolic constants instead of just hard coding numbers everywhere. - Since the RNG initializes once, and then is always initialized thereafter, a pretty heavy amount of code used during that initialization is never used again. It is now completely cordoned off using static branches and it winds up in the .text.unlikely section so that it doesn't reduce cache compactness after the RNG is ready. - A variety of functions meant for waiting on the RNG to be initialized were only used by vsprintf, and in not a particularly optimal way. Replacing that usage with a more ordinary setup made it possible to remove those functions. - A cleanup of how we warn userspace about the use of uninitialized /dev/urandom and uninitialized get_random_bytes() usage. Interestingly, with the change you merged for 5.18 that attempts to use jitter (but does not block if it can't), the majority of users should never see those warnings for /dev/urandom at all now, and the one for in-kernel usage is mainly a debug thing. - The file_operations struct for /dev/[u]random now implements .read_iter and .write_iter instead of .read and .write, allowing it to also implement .splice_read and .splice_write, which makes splice(2) work again after it was broken here (and in many other places in the tree) during the set_fs() removal. This was a bit of a last minute arrival from Jens that hasn't had as much time to bake, so I'll be keeping my eye on this as well, but it seems fairly ordinary. Unfortunately, read_iter() is around 3% slower than read() in my tests, which I'm not thrilled about. But Jens and Al, spurred by this observation, seem to be making progress in removing the bottlenecks on the iter paths in the VFS layer in general, which should remove the performance gap for all drivers. - Assorted other bug fixes, cleanups, and optimizations. - A small SipHash cleanup" * tag 'random-5.19-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: (49 commits) random: check for signals after page of pool writes random: wire up fops->splice_{read,write}_iter() random: convert to using fops->write_iter() random: convert to using fops->read_iter() random: unify batched entropy implementations random: move randomize_page() into mm where it belongs random: remove mostly unused async readiness notifier random: remove get_random_bytes_arch() and add rng_has_arch_random() random: move initialization functions out of hot pages random: make consistent use of buf and len random: use proper return types on get_random_{int,long}_wait() random: remove extern from functions in header random: use static branch for crng_ready() random: credit architectural init the exact amount random: handle latent entropy and command line from random_init() random: use proper jiffies comparison macro random: remove ratelimiting for in-kernel unseeded randomness random: move initialization out of reseeding hot path random: avoid initializing twice in credit race random: use symbolic constants for crng_init states ... commit 57d7becda9c9e612e6b00676f2eecfac3e719e88 Merge: 9029ac03f20a5 3c3673bde50c3 Author: Jakub Kicinski Date: Tue May 24 11:40:00 2022 -0700 Merge branch 'ptp-ocp-various-updates' Jonathan Lemon says: ==================== ptp: ocp: various updates Collection of cleanups and updates to the timecard. ==================== Link: https://lore.kernel.org/r/20220519212153.450437-1-jonathan.lemon@gmail.com Signed-off-by: Jakub Kicinski commit 3c3673bde50c31d1f5ab0b39e9eeb555285786bb Author: Vadim Fedorenko Date: Thu May 19 14:21:53 2022 -0700 ptp: ocp: Add firmware header checks Right now it's possible to flash any kind of binary via devlink and break the card easily. This diff adds an optional header check when installing the firmware. Signed-off-by: Vadim Fedorenko Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit b88fdbba931e9c79772120cb60a6ea8adaf0b451 Author: Jonathan Lemon Date: Thu May 19 14:21:52 2022 -0700 ptp: ocp: fix PPS source selector debugfs reporting The NTL timecard design has a PPS1 selector which selects the the PPS source automatically, according to Section 1.9 of the documentation. If there is a SMA PPS input detected: - send signal to MAC and PPS slave selector. If there is a MAC PPS input detected: - send GNSS1 to the MAC - send MAC to the PPS slave If there is a GNSS1 input detected: - send GNSS1 to the MAC - send GNSS1 to the PPS slave.MAC Change the debugfs summary so it reflects the correct mapping, for assistance in debugging. No functional change. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit ee4cd7250c8f5fd47b77b2235057f4b52c1576a6 Author: Jonathan Lemon Date: Thu May 19 14:21:51 2022 -0700 ptp: ocp: add .init function for sma_op vector Create an .init function for the op vector, and a corresponding wrapper function, for different sma mapping setups. Add a default_fcn to the sma information, and use it when displaying information for pins which have fixed functions. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit caab82cdbfe449c1597ab455c09d0fa514ef6947 Author: Jonathan Lemon Date: Thu May 19 14:21:50 2022 -0700 ptp: ocp: vectorize the sma accessor functions Move the SMA get and set functions into an operations vector for different boards. Create wrappers for the accessor functions. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 3f3fe41c0bdfe541aa7aa9a8625efe3bd3ef60cc Author: Jonathan Lemon Date: Thu May 19 14:21:49 2022 -0700 ptp: ocp: constify selectors The ocp selectors are all constant, so label them as such. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit aa56a7ffc0fb9ad5f754af79ee91ebe9ec96f28d Author: Jonathan Lemon Date: Thu May 19 14:21:48 2022 -0700 ptp: ocp: parameterize input/output sma selectors Group the sma input/output tables together and select the correct group from the bp information. This allows adding new groups with different sma mappings. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 5a728ac578c07f29d8b36bbd907cdea132c1607d Author: Jonathan Lemon Date: Thu May 19 14:21:47 2022 -0700 ptp: ocp: revise firmware display Preparse the firmware image information into loader/tag/version, and set the fw capabilities based on the tag/version. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 81fa652e168558fa35bd81d6c2427319b7b8589f Author: Vadim Fedorenko Date: Thu May 19 14:21:46 2022 -0700 ptp: ocp: add Celestica timecard PCI ids Celestica is producing card with their own vendor id and device id. Add these ids to driver to support this card. Signed-off-by: Vadim Fedorenko Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 3a35e53a11bcde88ea89cbf839771e6af4681daf Author: Jonathan Lemon Date: Thu May 19 14:21:45 2022 -0700 ptp: ocp: Remove #ifdefs around PCI IDs These #ifdefs are not required, so remove them. Suggested-by: Jakub Kicinski Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 8119c9ee7854033c8aba11059bec4ddd146fd63e Author: Jonathan Lemon Date: Thu May 19 14:21:44 2022 -0700 ptp: ocp: 32-bit fixups for pci start address Use 'resource_size_t' instead of 'unsigned long' when computing the pci start address, for the benefit of 32-bit platforms. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski commit 9029ac03f20a5999bc5627277c6cf008ab8e23ed Author: liuyacan Date: Tue May 24 17:02:30 2022 +0800 Revert "net/smc: fix listen processing for SMC-Rv2" This reverts commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d. Some rollback issue will be fixed in other patches in the future. Link: https://lore.kernel.org/all/20220523055056.2078994-1-liuyacan@corp.netease.com/ Fixes: 8c3b8dc5cc9b ("net/smc: fix listen processing for SMC-Rv2") Signed-off-by: liuyacan Link: https://lore.kernel.org/r/20220524090230.2140302-1-liuyacan@corp.netease.com Signed-off-by: Jakub Kicinski commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 Author: Daniel Thompson Date: Mon May 23 19:11:02 2022 +0100 lockdown: also lock down previous kgdb use KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan Signed-off-by: Stephen Brennan Reviewed-by: Douglas Anderson Signed-off-by: Daniel Thompson Signed-off-by: Linus Torvalds commit 48a75b979940f8aa838143e976455aa0e629e638 Author: Nathan Chancellor Date: Tue May 24 07:56:55 2022 -0700 ath6kl: Use cc-disable-warning to disable -Wdangling-pointer Clang does not support this option so the build fails: error: unknown warning option '-Wno-dangling-pointer' [-Werror,-Wunknown-warning-option] Use cc-disable-warning so that the option is only added when it is supported. Fixes: bd1d129daa3e ("wifi: ath6k: silence false positive -Wno-dangling-pointer warning on GCC 12") Reported-by: "kernelci.org bot" Signed-off-by: Nathan Chancellor Reviewed-by: Tom Rix Link: https://lore.kernel.org/r/20220524145655.869822-1-nathan@kernel.org Signed-off-by: Jakub Kicinski commit 6f3f04c19074972ea12edeed23b07a32894e9e03 Merge: cfeb2522c3777 991d8d8142cad Author: Linus Torvalds Date: Tue May 24 11:11:13 2022 -0700 Merge tag 'sched-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Updates to scheduler metrics: - PELT fixes & enhancements - PSI fixes & enhancements - Refactor cpu_util_without() - Updates to instrumentation/debugging: - Remove sched_trace_*() helper functions - can be done via debug info - Fix double update_rq_clock() warnings - Introduce & use "preemption model accessors" to simplify some of the Kconfig complexity. - Make softirq handling RT-safe. - Misc smaller fixes & cleanups. * tag 'sched-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: topology: Remove unused cpu_cluster_mask() sched: Reverse sched_class layout sched/deadline: Remove superfluous rq clock update in push_dl_task() sched/core: Avoid obvious double update_rq_clock warning smp: Make softirq handling RT safe in flush_smp_call_function_queue() smp: Rename flush_smp_call_function_from_idle() sched: Fix missing prototype warnings sched/fair: Remove cfs_rq_tg_path() sched/fair: Remove sched_trace_*() helper functions sched/fair: Refactor cpu_util_without() sched/fair: Revise comment about lb decision matrix sched/psi: report zeroes for CPU full at the system level sched/fair: Delete useless condition in tg_unthrottle_up() sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq sched/fair: Move calculate of avg_load to a better location mailmap: Update my email address to @redhat.com MAINTAINERS: Add myself as scheduler topology reviewer psi: Fix trigger being fired unexpectedly at initial ftrace: Use preemption model accessors for trace header printout kcsan: Use preemption model accessors commit b90c7e97c48bb1a94cd49cc32a4d2a62a06cbf1c Author: Dennis Dalessandro Date: Fri May 20 14:37:27 2022 -0400 RDMA/hfi1: Remove all traces of diagpkt support One of the concessions we made to get our driver upstream was to remove the diagnostic packet support. There is however still some cruft that was left over. Remove it. Link: https://lore.kernel.org/r/20220520183727.48973.93587.stgit@awfm-01.cornelisnetworks.com Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 1994c3134068aee50a7c3805f9d01f8736604ac2 Author: Dennis Dalessandro Date: Fri May 20 14:37:22 2022 -0400 RDMA/hfi1: Consolidate software versions There is no need to have separate user and kernel software versions. There is a single software that the kernel is compatible with. Also remove the notion of a "kernel type" that is long since deprecated. Link: https://lore.kernel.org/r/20220520183722.48973.60262.stgit@awfm-01.cornelisnetworks.com Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 676bffa02e4a511bcc32051ca9a7d544dc6bc6e5 Author: Dennis Dalessandro Date: Fri May 20 14:37:17 2022 -0400 RDMA/hfi1: Remove pointless driver version Driver versions have long been forbidden in the RDMA subsystem. We removed most of the code relating to them and have been very strict about not allowing. However there is some leftover versioning that we do not need. Get rid of that. Link: https://lore.kernel.org/r/20220520183717.48973.17418.stgit@awfm-01.cornelisnetworks.com Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit f93e91a0372c922c20d5bee260b0f43b4b8a1bee Author: Dennis Dalessandro Date: Fri May 20 14:37:12 2022 -0400 RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the multiplication. So arithmetic overflow and thus in incorrect value is possible. Correct an instance of this in the inter packet delay calculation. Fix by ensuring one of the operands is u64 which will promote the other to u64 as well ensuring no overflow. Cc: stable@vger.kernel.org Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://lore.kernel.org/r/20220520183712.48973.29855.stgit@awfm-01.cornelisnetworks.com Reviewed-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 629e052d0c98e46dde9f0824f0aa437f678d9b8f Author: Douglas Miller Date: Fri May 20 14:37:06 2022 -0400 RDMA/hfi1: Prevent panic when SDMA is disabled If the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to hfi1_write_iter() will dereference a NULL pointer and panic. A typical stack frame is: sdma_select_user_engine [hfi1] hfi1_user_sdma_process_request [hfi1] hfi1_write_iter [hfi1] do_iter_readv_writev do_iter_write vfs_writev do_writev do_syscall_64 The fix is to test for SDMA in hfi1_write_iter() and fail the I/O with EINVAL. Link: https://lore.kernel.org/r/20220520183706.48973.79803.stgit@awfm-01.cornelisnetworks.com Signed-off-by: Douglas Miller Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit cfeb2522c3777923c2bd24772b914195dc93c86b Merge: 22922deae13fc bae19fdd7e9e7 Author: Linus Torvalds Date: Tue May 24 10:59:38 2022 -0700 Merge tag 'perf-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events updates from Ingo Molnar: "Platform PMU changes: - x86/intel: - Add new Intel Alder Lake and Raptor Lake support - x86/amd: - AMD Zen4 IBS extensions support - Add AMD PerfMonV2 support - Add AMD Fam19h Branch Sampling support Generic changes: - signal: Deliver SIGTRAP on perf event asynchronously if blocked Perf instrumentation can be driven via SIGTRAP, but this causes a problem when SIGTRAP is blocked by a task & terminate the task. Allow user-space to request these signals asynchronously (after they get unblocked) & also give the information to the signal handler when this happens: "To give user space the ability to clearly distinguish synchronous from asynchronous signals, introduce siginfo_t::si_perf_flags and TRAP_PERF_FLAG_ASYNC (opted for flags in case more binary information is required in future). The resolution to the problem is then to (a) no longer force the signal (avoiding the terminations), but (b) tell user space via si_perf_flags if the signal was synchronous or not, so that such signals can be handled differently (e.g. let user space decide to ignore or consider the data imprecise). " - Unify/standardize the /sys/devices/cpu/events/* output format. - Misc fixes & cleanups" * tag 'perf-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (32 commits) perf/x86/amd/core: Fix reloading events for SVM perf/x86/amd: Run AMD BRS code only on supported hw perf/x86/amd: Fix AMD BRS period adjustment perf/x86/amd: Remove unused variable 'hwc' perf/ibs: Fix comment perf/amd/ibs: Advertise zen4_ibs_extensions as pmu capability attribute perf/amd/ibs: Add support for L3 miss filtering perf/amd/ibs: Use ->is_visible callback for dynamic attributes perf/amd/ibs: Cascade pmu init functions' return value perf/x86/uncore: Add new Alder Lake and Raptor Lake support perf/x86/uncore: Clean up uncore_pci_ids[] perf/x86/cstate: Add new Alder Lake and Raptor Lake support perf/x86/msr: Add new Alder Lake and Raptor Lake support perf/x86: Add new Alder Lake and Raptor Lake support perf/amd/ibs: Use interrupt regs ip for stack unwinding perf/x86/amd/core: Add PerfMonV2 overflow handling perf/x86/amd/core: Add PerfMonV2 counter control perf/x86/amd/core: Detect available counters perf/x86/amd/core: Detect PerfMonV2 support x86/msr: Add PerfCntrGlobal* registers ... commit 05c03dfd09c069c4ffd783b47b2da5dcc9421f2c Author: Douglas Miller Date: Fri May 20 14:37:01 2022 -0400 RDMA/hfi1: Prevent use of lock before it is initialized If there is a failure during probe of hfi1 before the sdma_map_lock is initialized, the call to hfi1_free_devdata() will attempt to use a lock that has not been initialized. If the locking correctness validator is on then an INFO message and stack trace resembling the following may be seen: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. Call Trace: register_lock_class+0x11b/0x880 __lock_acquire+0xf3/0x7930 lock_acquire+0xff/0x2d0 _raw_spin_lock_irq+0x46/0x60 sdma_clean+0x42a/0x660 [hfi1] hfi1_free_devdata+0x3a7/0x420 [hfi1] init_one+0x867/0x11a0 [hfi1] pci_device_probe+0x40e/0x8d0 The use of sdma_map_lock in sdma_clean() is for freeing the sdma_map memory, and sdma_map is not allocated/initialized until after sdma_map_lock has been initialized. This code only needs to be run if sdma_map is not NULL, and so checking for that condition will avoid trying to use the lock before it is initialized. Fixes: 473291b3ea0e ("IB/hfi1: Fix for early release of sdma context") Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://lore.kernel.org/r/20220520183701.48973.72434.stgit@awfm-01.cornelisnetworks.com Reported-by: Zheyu Ma Signed-off-by: Douglas Miller Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 22922deae13fc8d3769790c2eb388e9afce9771d Merge: 2319be135672f 22682a07acc30 Author: Linus Torvalds Date: Tue May 24 10:36:38 2022 -0700 Merge tag 'objtool-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Comprehensive interface overhaul: ================================= Objtool's interface has some issues: - Several features are done unconditionally, without any way to turn them off. Some of them might be surprising. This makes objtool tricky to use, and prevents porting individual features to other arches. - The config dependencies are too coarse-grained. Objtool enablement is tied to CONFIG_STACK_VALIDATION, but it has several other features independent of that. - The objtool subcmds ("check" and "orc") are clumsy: "check" is really a subset of "orc", so it has all the same options. The subcmd model has never really worked for objtool, as it only has a single purpose: "do some combination of things on an object file". - The '--lto' and '--vmlinux' options are nonsensical and have surprising behavior. Overhaul the interface: - get rid of subcmds - make all features individually selectable - remove and/or clarify confusing/obsolete options - update the documentation - fix some bugs found along the way - Fix x32 regression - Fix Kbuild cleanup bugs - Add scripts/objdump-func helper script to disassemble a single function from an object file. - Rewrite scripts/faddr2line to be section-aware, by basing it on 'readelf', moving it away from 'nm', which doesn't handle multiple sections well, which can result in decoding failure. - Rewrite & fix symbol handling - which had a number of bugs wrt. object files that don't have global symbols - which is rare but possible. Also fix a bunch of symbol handling bugs found along the way. * tag 'objtool-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) objtool: Fix objtool regression on x32 systems objtool: Fix symbol creation scripts/faddr2line: Fix overlapping text section failures scripts: Create objdump-func helper script objtool: Remove libsubcmd.a when make clean objtool: Remove inat-tables.c when make clean objtool: Update documentation objtool: Remove --lto and --vmlinux in favor of --link objtool: Add HAVE_NOINSTR_VALIDATION objtool: Rename "VMLINUX_VALIDATION" -> "NOINSTR_VALIDATION" objtool: Make noinstr hacks optional objtool: Make jump label hack optional objtool: Make static call annotation optional objtool: Make stack validation frame-pointer-specific objtool: Add CONFIG_OBJTOOL objtool: Extricate sls from stack validation objtool: Rework ibt and extricate from stack validation objtool: Make stack validation optional objtool: Add option to print section addresses objtool: Don't print parentheses in function addresses ... commit 2319be135672f6e45aa937bceaae6c2668c7867c Merge: 143a6252e1b8a 8491d1bdf5de1 Author: Linus Torvalds Date: Tue May 24 10:18:23 2022 -0700 Merge tag 'locking-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: - rwsem cleanups & optimizations/fixes: - Conditionally wake waiters in reader/writer slowpaths - Always try to wake waiters in out_nolock path - Add try_cmpxchg64() implementation, with arch optimizations - and use it to micro-optimize sched_clock_{local,remote}() - Various force-inlining fixes to address objdump instrumentation-check warnings - Add lock contention tracepoints: lock:contention_begin lock:contention_end - Misc smaller fixes & cleanups * tag 'locking-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/clock: Use try_cmpxchg64 in sched_clock_{local,remote} locking/atomic/x86: Introduce arch_try_cmpxchg64 locking/atomic: Add generic try_cmpxchg64 support futex: Remove a PREEMPT_RT_FULL reference. locking/qrwlock: Change "queue rwlock" to "queued rwlock" lockdep: Delete local_irq_enable_in_hardirq() locking/mutex: Make contention tracepoints more consistent wrt adaptive spinning locking: Apply contention tracepoints in the slow path locking: Add lock contention tracepoints locking/rwsem: Always try to wake waiters in out_nolock path locking/rwsem: Conditionally wake waiters in reader/writer slowpaths locking/rwsem: No need to check for handoff bit if wait queue empty lockdep: Fix -Wunused-parameter for _THIS_IP_ x86/mm: Force-inline __phys_addr_nodebug() x86/kvm/svm: Force-inline GHCB accessors task_stack, x86/cea: Force-inline stack helpers commit 7f60951ff4d1664dfa2c304d144d195989199ef3 Author: Christophe JAILLET Date: Sun May 22 15:25:08 2022 +0200 RDMA/rxe: Fix an error handling path in rxe_get_mcg() The commit in the Fixes tag has shuffled some code. Now 'mcg_num' is incremented before the kzalloc(). So if the memory allocation fails, this increment must be undone. Fixes: a926a903b7dc ("RDMA/rxe: Do not call dev_mc_add/del() under a spinlock") Link: https://lore.kernel.org/r/fe137cd8b1f17593243aa73d59c18ea71ab9ee36.1653225896.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Jason Gunthorpe commit a6f844da39af8046798ba5cadf92a0c54da80b26 Merge: b599b31033aa6 4b0986a3613c9 Author: Jason Gunthorpe Date: Tue May 24 12:40:28 2022 -0300 Merge tag 'v5.18' into rdma.git for-next Following patches have dependencies. Resolve the merge conflict in drivers/net/ethernet/mellanox/mlx5/core/main.c by keeping the new names for the fs functions following linux-next: https://lore.kernel.org/r/20220519113529.226bc3e2@canb.auug.org.au/ Signed-off-by: Jason Gunthorpe commit d37aa2efc89b387cda93bf15317883519683d435 Author: Masahiro Yamada Date: Tue May 24 22:55:41 2022 +0900 gcc-plugins: use KERNELVERSION for plugin version Commit 61f60bac8c05 ("gcc-plugins: Change all version strings match kernel") broke parallel builds. Instead of adding the dependency between GCC plugins and utsrelease.h, let's use KERNELVERSION, which does not require any build artifact. Another reason why I want to avoid utsrelease.h is because it depends on CONFIG_LOCALVERSION(_AUTO) and localversion* files. (include/generated/utsrelease.h depends on include/config/kernel.release, which is generated by scripts/setlocalversion) I want to keep host tools independent of the kernel configuration. There is no good reason to rebuild GCC plugins just because of CONFIG_LOCALVERSION being changed. We just want to associate the plugin versions with the kernel source version. KERNELVERSION should be enough for our purpose. Fixes: 61f60bac8c05 ("gcc-plugins: Change all version strings match kernel") Reported-by: kernel test robot Link: https://lore.kernel.org/linux-mm/202205230239.EZxeZ3Fv-lkp@intel.com Reported-by: Guenter Roeck Signed-off-by: Masahiro Yamada Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220524135541.1453693-1-masahiroy@kernel.org commit 421cfe6596f6cb316991c02bf30a93bd81092853 Author: Matthew Rosato Date: Thu May 19 14:33:11 2022 -0400 vfio: remove VFIO_GROUP_NOTIFY_SET_KVM Rather than relying on a notifier for associating the KVM with the group, let's assume that the association has already been made prior to device_open. The first time a device is opened associate the group KVM with the device. This fixes a user-triggerable oops in GVT. Reviewed-by: Tony Krowiak Reviewed-by: Kevin Tian Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe Signed-off-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Acked-by: Zhi Wang Link: https://lore.kernel.org/r/20220519183311.582380-2-mjrosato@linux.ibm.com Signed-off-by: Alex Williamson commit 5a7cb9f3978d1fe8cfba798b4c9c054ce226e8fd Author: Geert Uytterhoeven Date: Fri May 20 12:24:16 2022 +0200 gpio: sifive: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the sifive driver: gpio gpiochip1: (38001000.gpio-controller): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the sifive driver immutable. Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Reviewed-by: Damien Le Moal Signed-off-by: Bartosz Golaszewski commit 718b972d32da093ac4358c0abb099c65292dc536 Author: Geert Uytterhoeven Date: Fri May 20 12:18:56 2022 +0200 gpio: rcar: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the gpio-rcar driver: gpio gpiochip0: (e6050000.gpio): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the gpio-rcar driver immutable. Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 61550be779dcb82cb96852721bac652144a0d0b9 Author: Geert Uytterhoeven Date: Fri May 20 12:20:57 2022 +0200 gpio: pcf857x: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the pcf857x driver: gpio gpiochip1: (pcf8575): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the pcf857x driver immutable. Signed-off-by: Geert Uytterhoeven Signed-off-by: Bartosz Golaszewski commit ac2f6f9385aa27b9a73156885be9765299b8e11f Author: Geert Uytterhoeven Date: Fri May 20 12:21:54 2022 +0200 gpio: pca953x: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the pca953x driver: gpio gpiochip7: (0-0020): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the pca953x driver immutable. Signed-off-by: Geert Uytterhoeven Signed-off-by: Bartosz Golaszewski commit cfc2b00ebed6660a10d1be09f2dd6957556ce6a5 Author: Geert Uytterhoeven Date: Fri May 20 12:23:18 2022 +0200 gpio: dwapb: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the dwapb driver: gpio gpiochip0: (50200000.gpio): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the dwapb driver immutable. Signed-off-by: Geert Uytterhoeven Reviewed-by: Damien Le Moal Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit b599b31033aa6928309d1cf8180c3daf260574e1 Author: Julia Lawall Date: Sat May 21 13:11:37 2022 +0200 IB/core: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-87-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Jason Gunthorpe commit 83567cee0472fb7b57cc6e931ab002aeb69a26d4 Author: Julia Lawall Date: Sat May 21 13:11:36 2022 +0200 RDMA/core: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-86-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Jason Gunthorpe commit 684b916b3028507b99756ad29e9b57c5b74e8be2 Author: Julia Lawall Date: Sat May 21 13:11:33 2022 +0200 IB/hf1: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-83-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Jason Gunthorpe commit 25ec8b35b37488789885decf58f7d57fadce7d15 Author: Julia Lawall Date: Sat May 21 13:11:06 2022 +0200 IB/qib: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-56-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Jason Gunthorpe commit d0d4df06cca5a844f15bb17102259ac0d0bae480 Author: Julia Lawall Date: Sat May 21 13:10:14 2022 +0200 IB/iser: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-4-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Reviewed-by: Sagi Grimberg Acked-by: Max Gurtovoy Signed-off-by: Jason Gunthorpe commit 6b8be804ff376f6657ccdf6b29974e7c793d88c4 Author: Greg Ungerer Date: Wed May 18 16:14:05 2022 +1000 m68knommu: fix 68000 CPU link with no platform selected If building for a nommu m68k classic CPU and no platform (board) is selected then the final link fails with: LD vmlinux.o m68k-linux-ld: cannot find arch/m68k/kernel/head.o: No such file or directory make: *** [Makefile:1158: vmlinux] Error 1 Not selecting a platform is ok, that is a generic 68000 system build. All of the platform selections are for 68328 variants. The underlying problem is that the CPU config option (CONFIG_M68000) ends up not being set, it is currently only selected by one of the platform choices. Change CONFIG_M68000 so that it is always enabled for the nommu m68k classic configuration. Signed-off-by: Greg Ungerer commit 348cce32cc324507a9db265b9ff454d141a57add Author: Greg Ungerer Date: Mon May 16 16:46:07 2022 +1000 m68k: removed unused "mach_get_ss" The m68k machine helper function "mach_get_ss" function pointer is set for some machines, but ultimately never used anywhere. Remove it. Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Reviewed-by: Arnd Bergmann Signed-off-by: Greg Ungerer commit 1300eec9e51f23c34c4487d2b06f58ca22e1ad3d Author: Greg Ungerer Date: Mon May 16 16:36:07 2022 +1000 m68knommu: fix undefined reference to `mach_get_rtc_pll' Configuring for a nommu classic m68k target and enabling the generic rtc driver (CONFIG_RTC_DRV_GENERIC) will result in the following compile error: m68k-linux-ld: arch/m68k/kernel/time.o: in function `rtc_ioctl': time.c:(.text+0x82): undefined reference to `mach_get_rtc_pll' m68k-linux-ld: time.c:(.text+0xbc): undefined reference to `mach_set_rtc_pll' m68k-linux-ld: time.c:(.text+0xf4): undefined reference to `mach_set_rtc_pll' There are no definitions of "mach_set_rtc_pll" and "mach_get_rtc_pll" in the nommu code paths. Move these definitions and the associated "mach_hwclk", so that they are around their use case in time.c. This means they will always be defined on the builds that require them, and not on those that cannot use them - such as ColdFire (both with and without MMU enabled). Reported-by: kernel test robot Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Reviewed-by: Arnd Bergmann Signed-off-by: Greg Ungerer commit 79f9fbe303520d2c32b70f04f2bb02cc2baaa4c3 Author: Nathan Chancellor Date: Mon May 23 15:47:02 2022 -0700 mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n When CONFIG_PM_SLEEP is not set, there is a warning that qcom_ipcc_pm_resume() is unused: drivers/mailbox/qcom-ipcc.c:258:12: error: 'qcom_ipcc_pm_resume' defined but not used [-Werror=unused-function] 258 | static int qcom_ipcc_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Commit 1a3c7bb08826 ("PM: core: Add new *_PM_OPS macros, deprecate old ones") reworked the PM_OPS macros to avoid this problem. Use NOIRQ_SYSTEM_SLEEP_PM_OPS directly so that qcom_ipcc_pm_resume() always appears to be used to the compiler, even though it will be dead code eliminated in the !CONFIG_PM_SLEEP case. Fixes: c25f77899753 ("mailbox: qcom-ipcc: Log the pending interrupt during resume") Signed-off-by: Nathan Chancellor Reviewed-by: Sibi Sankar Signed-off-by: Jassi Brar commit 32feee36c30ea06e38ccb8ae6e5c44c6eec790a6 Author: Coly Li Date: Tue May 24 18:23:36 2022 +0800 bcache: avoid journal no-space deadlock by reserving 1 journal bucket The journal no-space deadlock was reported time to time. Such deadlock can happen in the following situation. When all journal buckets are fully filled by active jset with heavy write I/O load, the cache set registration (after a reboot) will load all active jsets and inserting them into the btree again (which is called journal replay). If a journaled bkey is inserted into a btree node and results btree node split, new journal request might be triggered. For example, the btree grows one more level after the node split, then the root node record in cache device super block will be upgrade by bch_journal_meta() from bch_btree_set_root(). But there is no space in journal buckets, the journal replay has to wait for new journal bucket to be reclaimed after at least one journal bucket replayed. This is one example that how the journal no-space deadlock happens. The solution to avoid the deadlock is to reserve 1 journal bucket in run time, and only permit the reserved journal bucket to be used during cache set registration procedure for things like journal replay. Then the journal space will never be fully filled, there is no chance for journal no-space deadlock to happen anymore. This patch adds a new member "bool do_reserve" in struct journal, it is inititalized to 0 (false) when struct journal is allocated, and set to 1 (true) by bch_journal_space_reserve() when all initialization done in run_cache_set(). In the run time when journal_reclaim() tries to allocate a new journal bucket, free_journal_buckets() is called to check whether there are enough free journal buckets to use. If there is only 1 free journal bucket and journal->do_reserve is 1 (true), the last bucket is reserved and free_journal_buckets() will return 0 to indicate no free journal bucket. Then journal_reclaim() will give up, and try next time to see whetheer there is free journal bucket to allocate. By this method, there is always 1 jouranl bucket reserved in run time. During the cache set registration, journal->do_reserve is 0 (false), so the reserved journal bucket can be used to avoid the no-space deadlock. Reported-by: Nikhil Kshirsagar Signed-off-by: Coly Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220524102336.10684-5-colyli@suse.de Signed-off-by: Jens Axboe commit 80db4e4707e78cb22287da7d058d7274bd4cb370 Author: Coly Li Date: Tue May 24 18:23:35 2022 +0800 bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() After making bch_sectors_dirty_init() being multithreaded, the existing incremental dirty sector counting in bch_root_node_dirty_init() doesn't release btree occupation after iterating 500000 (INIT_KEYS_EACH_TIME) bkeys. Because a read lock is added on btree root node to prevent the btree to be split during the dirty sectors counting, other I/O requester has no chance to gain the write lock even restart bcache_btree(). That is to say, the incremental dirty sectors counting is incompatible to the multhreaded bch_sectors_dirty_init(). We have to choose one and drop another one. In my testing, with 512 bytes random writes, I generate 1.2T dirty data and a btree with 400K nodes. With single thread and incremental dirty sectors counting, it takes 30+ minites to register the backing device. And with multithreaded dirty sectors counting, the backing device registration can be accomplished within 2 minutes. The 30+ minutes V.S. 2- minutes difference makes me decide to keep multithreaded bch_sectors_dirty_init() and drop the incremental dirty sectors counting. This is what this patch does. But INIT_KEYS_EACH_TIME is kept, in sectors_dirty_init_fn() the CPU will be released by cond_resched() after every INIT_KEYS_EACH_TIME keys iterated. This is to avoid the watchdog reports a bogus soft lockup warning. Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") Signed-off-by: Coly Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220524102336.10684-4-colyli@suse.de Signed-off-by: Jens Axboe commit 4dc34ae1b45fe26e772a44379f936c72623dd407 Author: Coly Li Date: Tue May 24 18:23:34 2022 +0800 bcache: improve multithreaded bch_sectors_dirty_init() Commit b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") makes bch_sectors_dirty_init() to be much faster when counting dirty sectors by iterating all dirty keys in the btree. But it isn't in ideal shape yet, still can be improved. This patch does the following changes to improve current parallel dirty keys iteration on the btree, - Add read lock to root node when multiple threads iterating the btree, to prevent the root node gets split by I/Os from other registered bcache devices. - Remove local variable "char name[32]" and generate kernel thread name string directly when calling kthread_run(). - Allocate "struct bch_dirty_init_state state" directly on stack and avoid the unnecessary dynamic memory allocation for it. - Decrease BCH_DIRTY_INIT_THRD_MAX from 64 to 12 which is enough indeed. - Increase &state->started to count created kernel thread after it succeeds to create. - When wait for all dirty key counting threads to finish, use wait_event() to replace wait_event_interruptible(). With the above changes, the code is more clear, and some potential error conditions are avoided. Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") Signed-off-by: Coly Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220524102336.10684-3-colyli@suse.de Signed-off-by: Jens Axboe commit 622536443b6731ec82c563aae7807165adbe9178 Author: Coly Li Date: Tue May 24 18:23:33 2022 +0800 bcache: improve multithreaded bch_btree_check() Commit 8e7102273f59 ("bcache: make bch_btree_check() to be multithreaded") makes bch_btree_check() to be much faster when checking all btree nodes during cache device registration. But it isn't in ideal shap yet, still can be improved. This patch does the following thing to improve current parallel btree nodes check by multiple threads in bch_btree_check(), - Add read lock to root node while checking all the btree nodes with multiple threads. Although currently it is not mandatory but it is good to have a read lock in code logic. - Remove local variable 'char name[32]', and generate kernel thread name string directly when calling kthread_run(). - Allocate local variable "struct btree_check_state check_state" on the stack and avoid unnecessary dynamic memory allocation for it. - Reduce BCH_BTR_CHKTHREAD_MAX from 64 to 12 which is enough indeed. - Increase check_state->started to count created kernel thread after it succeeds to create. - When wait for all checking kernel threads to finish, use wait_event() to replace wait_event_interruptible(). With this change, the code is more clear, and some potential error conditions are avoided. Fixes: 8e7102273f59 ("bcache: make bch_btree_check() to be multithreaded") Signed-off-by: Coly Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220524102336.10684-2-colyli@suse.de Signed-off-by: Jens Axboe commit 832296804bc7171730884e78c761c29f6d258e13 Author: Oder Chiou Date: Mon May 16 18:30:55 2022 +0800 ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM The pin "Platform Clock" was only used by the Intel Byt CR platform. In the others, the error log will be informed. The patch will set the flag to avoid the pin "Platform Clock" manipulated by the other platforms. Signed-off-by: Oder Chiou Reported-by: Sameer Pujar Link: https://lore.kernel.org/r/20220516103055.20003-1-oder_chiou@realtek.com Signed-off-by: Mark Brown commit 795d82ed389b0592aefa49c4b1c498351da65a63 Author: Tiezhu Yang Date: Tue May 24 10:27:50 2022 +0800 MIPS: Use memblock_add_node() in early_parse_mem() under CONFIG_NUMA Use memblock_add_node to add new memblock region within a NUMA node in early_parse_mem() under CONFIG_NUMA, otherwise the mem parameter can not work well. Signed-off-by: Tiezhu Yang Signed-off-by: Thomas Bogendoerfer commit fb3d6967d508a59b2e8df8358aad1c35579a2833 Author: Tiezhu Yang Date: Tue May 24 10:27:49 2022 +0800 MIPS: Return -EINVAL if mem parameter is empty in early_parse_mem() In the current code, the users usually need to make sure the value of mem parameter is correct, but it is better to do some check to avoid potential boot hangs. This commit checks whether mem parameter is empty, if yes, return -EINVAL before call memblock_remove() and memblock_add(). Signed-off-by: Tiezhu Yang Signed-off-by: Thomas Bogendoerfer commit 31f12fdc2f1ed59f1a919f57b8b31af614b8c5ee Author: Juerg Haefliger Date: Tue May 24 10:03:11 2022 +0200 MIPS: Kconfig: Fix indentation and add endif comment The convention for indentation seems to be a single tab. Help text is further indented by an additional two whitespaces. Fix the lines that violate these rules. While add it, add a missing trailing endif comment. Signed-off-by: Juerg Haefliger Signed-off-by: Thomas Bogendoerfer commit c85ab4fe33065ca1fdcac26f0c00c837fe727ba7 Author: Christophe Leroy Date: Tue May 24 07:42:05 2022 +0200 powerpc/64s: Only set HAVE_ARCH_UNMAPPED_AREA when CONFIG_PPC_64S_HASH_MMU is set When CONFIG_PPC_64S_HASH_MMU is not set, slice.c is not built and arch_get_unmapped_area() and arch_get_unmapped_area_topdown() are not provided because RADIX uses the generic ones. Therefore, neither set HAVE_ARCH_UNMAPPED_AREA nor HAVE_ARCH_UNMAPPED_AREA_TOPDOWN. Fixes: ab57bd7570d4 ("powerpc/mm: Move get_unmapped_area functions to slice.c") Reported-by: Laurent Dufour Signed-off-by: Christophe Leroy Tested-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e438c6cc09f94085e56733ed2d6e84333c35292a.1653370913.git.christophe.leroy@csgroup.eu commit 14554d92c1c5a127dd0dab8fce8f08bf70d8b39b Author: Christophe Leroy Date: Tue May 24 07:35:10 2022 +0200 powerpc/xics: Include missing header Include of_adresses.h to get of_iomap() prototype. Fixes: 86c38fec69a4 ("powerpc: Remove asm/prom.h from all files that don't need it") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f20a14be1a29fa0a9ebcfc5ebf05eb69c5120d10.1653370502.git.christophe.leroy@csgroup.eu commit 60571929d06b028800f27b51a7c81de1144944cf Author: Kailang Yang Date: Tue May 24 16:14:04 2022 +0800 ALSA: hda/realtek - Add new type for ALC245 Add new type for ALC245. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/cef26a7cd3d146eb96a3994ce79e34d2@realtek.com Signed-off-by: Takashi Iwai commit 07d17217c668d5b9974572b2d69c6736f60b9925 Merge: 2e688e654f48d d88591a555325 Author: Jiri Kosina Date: Tue May 24 10:59:51 2022 +0200 Merge branch 'for-5.19/wacom' into for-linus - support for pens with 3 buttons (Joshua Dickens) - support for HID_DG_SCANTIME to report the timestamp for pen and touch events (Joshua Dickens) commit 2e688e654f48dde6e5899ff62cdf7b2d87f4ad89 Merge: fa4c7c64360e4 f7d8e387d9aef Author: Jiri Kosina Date: Tue May 24 10:58:06 2022 +0200 Merge branch 'for-5.19/uclogic' into for-linus - support for wider variety of Huion tablets ported from DIGImend project (José Expósito, Nikolai Kondrashov) commit fa4c7c64360e41bddc53273e185e4b5712c9d534 Merge: 35b4e60e0c5a7 06be0d6442a07 Author: Jiri Kosina Date: Tue May 24 10:57:06 2022 +0200 Merge branch 'for-5.19/megaworld' into for-linus commit 35b4e60e0c5a7ad885e5d95da71ed66d77736893 Merge: cf620bdad825f 5c9b8fae88bc2 Author: Jiri Kosina Date: Tue May 24 10:56:46 2022 +0200 Merge branch 'for-5.19/lenovo' into for-linus commit cf620bdad825f8d824a5f2896c82734dfd81a0b4 Merge: 8959f00799a17 fa33382c7f74a Author: Jiri Kosina Date: Tue May 24 10:55:37 2022 +0200 Merge branch 'for-5.19/apple' into for-linus - Support for Keychron keyboards (Bryan Cain) commit 8959f00799a174af300f88bf8360b903976363c9 Merge: fc4ef9d572497 806fc359a3945 Author: Jiri Kosina Date: Tue May 24 10:54:42 2022 +0200 Merge branch 'for-5.19/amd-sfh' into for-linus - support for sensor discovery and code cleanups (Basavaraj Natikar) commit 14bdb047a54d7a44af8633848ad097bbaf1b2cb6 Author: Damien Le Moal Date: Tue May 24 08:29:39 2022 +0900 zonefs: Fix zonefs_init_file_inode() return value Commit 87c9ce3ffec9 ("zonefs: Add active seq file accounting") wrongly changed zonefs_init_file_inode() to always return 0 even if the call to zonefs_zone_mgmt() fails. Fix this by propagating zonefs_zone_mgmt() return value as the return value for zonefs_init_file_inode(). Fixes: 87c9ce3ffec9 ("zonefs: Add active seq file accounting") Signed-off-by: Damien Le Moal commit 5ce2176b81f77366bd02c27509b83049f0020544 Author: Masahiro Yamada Date: Fri May 13 20:39:24 2022 +0900 genksyms: adjust the output format to modpost Make genksyms output symbol versions in the format modpost expects, so the 'sed' is unneeded. This commit makes *.symversions completely unneeded. I will keep *.symversions in .gitignore and 'make clean' for a while. Otherwise, 'git status' might be surprising. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 7375cbcf2343a9337b19846e76dfd94c3af98a27 Author: Masahiro Yamada Date: Fri May 13 20:39:23 2022 +0900 kbuild: stop merging *.symversions Now modpost reads symbol versions from .*.cmd files. The merged *.symversions are no longer needed. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 7b4537199a4a8480b8c3ba37a2d44765ce76cd9b Author: Masahiro Yamada Date: Fri May 13 20:39:22 2022 +0900 kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS include/{linux,asm-generic}/export.h defines a weak symbol, __crc_* as a placeholder. Genksyms writes the version CRCs into the linker script, which will be used for filling the __crc_* symbols. The linker script format depends on CONFIG_MODULE_REL_CRCS. If it is enabled, __crc_* holds the offset to the reference of CRC. It is time to get rid of this complexity. Now that modpost parses text files (.*.cmd) to collect all the CRCs, it can generate C code that will be linked to the vmlinux or modules. Generate a new C file, .vmlinux.export.c, which contains the CRCs of symbols exported by vmlinux. It is compiled and linked to vmlinux in scripts/link-vmlinux.sh. Put the CRCs of symbols exported by modules into the existing *.mod.c files. No additional build step is needed for modules. As before, *.mod.c are compiled and linked to *.ko in scripts/Makefile.modfinal. No linker magic is used here. The new C implementation works in the same way, whether CONFIG_RELOCATABLE is enabled or not. CONFIG_MODULE_REL_CRCS is no longer needed. Previously, Kbuild invoked additional $(LD) to update the CRCs in objects, but this step is unneeded too. Signed-off-by: Masahiro Yamada Tested-by: Nathan Chancellor Tested-by: Nicolas Schier Reviewed-by: Nicolas Schier Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 9c04a8ff03def4df3f81219ffbe1ec9b44ff5348 Author: Krzysztof Kozlowski Date: Fri Apr 22 12:41:01 2022 +0200 clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. Fixes: 89355274e1f7 ("clocksource/drivers/oxnas-rps: Add Oxford Semiconductor RPS Dual Timer") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20220422104101.55754-1-krzysztof.kozlowski@linaro.org Signed-off-by: Daniel Lezcano commit 8c0d9461ab760439b09ae321803ee85df1136e08 Author: Dan Carpenter Date: Thu May 19 16:58:23 2022 +0300 clocksource/drivers/timer-ti-dm: Remove unnecessary NULL check The "pdata" pointer cannot be NULL because it's checked at the start of the function. Delete the check. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YoZM65RFDQAfqV6J@kili Signed-off-by: Daniel Lezcano commit 0e85a22d01dfe9ad9a9d9e87cd4a88acce1aad65 Author: Craig McLure Date: Tue May 24 08:21:15 2022 +0200 ALSA: usb-audio: Configure sync endpoints before data Devices such as the TC-Helicon GoXLR require the sync endpoint to be configured in advance of the data endpoint in order for sound output to work. This patch simply changes the ordering of EP configuration to resolve this. Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215079 Signed-off-by: Craig McLure Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/20220524062115.25968-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5d7c854593a460706dacf8e1b16c9bdcb1c2d7bb Author: Christophe Leroy Date: Mon Mar 28 08:26:48 2022 +0200 livepatch: Remove klp_arch_set_pc() and asm/livepatch.h All three versions of klp_arch_set_pc() do exactly the same: they call ftrace_instruction_pointer_set(). Call ftrace_instruction_pointer_set() directly and remove klp_arch_set_pc(). As klp_arch_set_pc() was the only thing remaining in asm/livepatch.h on x86 and s390, remove asm/livepatch.h livepatch.h remains on powerpc but its content is exclusively used by powerpc specific code. Signed-off-by: Christophe Leroy Acked-by: Petr Mladek Acked-by: Peter Zijlstra (Intel) Acked-by: Miroslav Benes Signed-off-by: Petr Mladek commit 52832252dded19e291a7b8842542ea61d1765f2f Author: Steve French Date: Mon May 23 23:17:12 2022 -0500 smb3: add mount parm nosparse To reduce risk of applications breaking that mount to servers with only partial sparse file support, add optional mount parm "nosparse" which disables setting files sparse (and thus will return EOPNOTSUPP on certain fallocate operations). Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 677fb7525331375ba2f90f4bc94a80b9b6e697a3 Merge: 1ef0736c0711e 7fb0269720d7d Author: Jakub Kicinski Date: Mon May 23 21:19:17 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net drivers/net/ethernet/cadence/macb_main.c 5cebb40bc955 ("net: macb: Fix PTP one step sync support") 138badbc21a0 ("net: macb: use NAPI for TX completion path") https://lore.kernel.org/all/20220523111021.31489367@canb.auug.org.au/ net/smc/af_smc.c 75c1edf23b95 ("net/smc: postpone sk_refcnt increment in connect()") 3aba103006bc ("net/smc: align the connect behaviour with TCP") https://lore.kernel.org/all/20220524114408.4bf1af38@canb.auug.org.au/ Signed-off-by: Jakub Kicinski commit 143a6252e1b8ab424b4b293512a97cca7295c182 Merge: d6edf95109661 0616ea3f1b93a Author: Linus Torvalds Date: Mon May 23 21:06:11 2022 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: - Initial support for the ARMv9 Scalable Matrix Extension (SME). SME takes the approach used for vectors in SVE and extends this to provide architectural support for matrix operations. No KVM support yet, SME is disabled in guests. - Support for crashkernel reservations above ZONE_DMA via the 'crashkernel=X,high' command line option. - btrfs search_ioctl() fix for live-lock with sub-page faults. - arm64 perf updates: support for the Hisilicon "CPA" PMU for monitoring coherent I/O traffic, support for Arm's CMN-650 and CMN-700 interconnect PMUs, minor driver fixes, kerneldoc cleanup. - Kselftest updates for SME, BTI, MTE. - Automatic generation of the system register macros from a 'sysreg' file describing the register bitfields. - Update the type of the function argument holding the ESR_ELx register value to unsigned long to match the architecture register size (originally 32-bit but extended since ARMv8.0). - stacktrace cleanups. - ftrace cleanups. - Miscellaneous updates, most notably: arm64-specific huge_ptep_get(), avoid executable mappings in kexec/hibernate code, drop TLB flushing from get_clear_flush() (and rename it to get_clear_contig()), ARCH_NR_GPIO bumped to 2048 for ARCH_APPLE. * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (145 commits) arm64/sysreg: Generate definitions for FAR_ELx arm64/sysreg: Generate definitions for DACR32_EL2 arm64/sysreg: Generate definitions for CSSELR_EL1 arm64/sysreg: Generate definitions for CPACR_ELx arm64/sysreg: Generate definitions for CONTEXTIDR_ELx arm64/sysreg: Generate definitions for CLIDR_EL1 arm64/sve: Move sve_free() into SVE code section arm64: Kconfig.platforms: Add comments arm64: Kconfig: Fix indentation and add comments arm64: mm: avoid writable executable mappings in kexec/hibernate code arm64: lds: move special code sections out of kernel exec segment arm64/hugetlb: Implement arm64 specific huge_ptep_get() arm64/hugetlb: Use ptep_get() to get the pte value of a huge page arm64: kdump: Do not allocate crash low memory if not needed arm64/sve: Generate ZCR definitions arm64/sme: Generate defintions for SVCR arm64/sme: Generate SMPRI_EL1 definitions arm64/sme: Automatically generate SMPRIMAP_EL2 definitions arm64/sme: Automatically generate SMIDR_EL1 defines arm64/sme: Automatically generate defines for SMCR ... commit d6edf95109661e5fb9b20613478470d2e8fa4455 Merge: 95fbef17e8253 b6f21d14f1ac1 Author: Linus Torvalds Date: Mon May 23 21:04:25 2022 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - amba bus updates - simplify ldr_this_cpu assembler macro for uniprocessor builds - avoid explicit assembler literal loads - more spectre-bhb improvements - add Cortex-A9 Errata 764319 workaround - add all unwind tables for modules * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9204/2: module: Add all unwind tables when load module ARM: 9206/1: A9: Add ARM ERRATA 764319 workaround (Updated) ARM: 9201/1: spectre-bhb: rely on linker to emit cross-section literal loads ARM: 9200/1: spectre-bhb: avoid cross-subsection jump using a numbered label ARM: 9199/1: spectre-bhb: use local DSB and elide ISB in loop8 sequence ARM: 9198/1: spectre-bhb: simplify BPIALL vector macro ARM: 9195/1: entry: avoid explicit literal loads ARM: 9194/1: assembler: simplify ldr_this_cpu for !SMP builds ARM: 9192/1: amba: fix memory leak in amba_device_try_add() ARM: 9193/1: amba: Add amba_read_periphid() helper commit 95fbef17e8253775876a08ec2011d3665b86a55f Merge: 67c642e0d9aa9 94d3477897481 Author: Linus Torvalds Date: Mon May 23 21:01:30 2022 -0700 Merge tag 's390-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Make use of the IBM z16 processor activity instrumentation facility to count cryptography operations: add a new PMU device driver so that perf can make use of this. - Add new IBM z16 extended counter set to cpumf support. - Add vdso randomization support. - Add missing KCSAN instrumentation to barriers and spinlocks, which should make s390's KCSAN support complete. - Add support for IPL-complete-control facility: notify the hypervisor that kexec finished work and the kernel starts. - Improve error logging for PCI. - Various small changes to workaround llvm's integrated assembler limitations, and one bug, to make it finally possible to compile the kernel with llvm's integrated assembler. This also requires to raise the minimum clang version to 14.0.0. - Various other small enhancements, bug fixes, and cleanups all over the place. * tag 's390-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (48 commits) s390/head: get rid of 31 bit leftovers scripts/min-tool-version.sh: raise minimum clang version to 14.0.0 for s390 s390/boot: do not emit debug info for assembly with llvm's IAS s390/boot: workaround llvm IAS bug s390/purgatory: workaround llvm's IAS limitations s390/entry: workaround llvm's IAS limitations s390/alternatives: remove padding generation code s390/alternatives: provide identical sized orginal/alternative sequences s390/cpumf: add new extended counter set for IBM z16 s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES s390/stp: clock_delta should be signed s390/stp: fix todoff size s390/pai: add support for cryptography counters entry: Rename arch_check_user_regs() to arch_enter_from_user_mode() s390/compat: cleanup compat_linux.h header file s390/entry: remove broken and not needed code s390/boot: convert parmarea to C s390/boot: convert initial lowcore to C s390/ptrace: move short psw definitions to ptrace header file s390/head: initialize all new psws ... commit 67c642e0d9aa927c1340638e472f2467fefd1dbf Merge: fdd8f6585cef1 64d83f0677466 Author: Linus Torvalds Date: Mon May 23 20:59:19 2022 -0700 Merge tag 'csky-for-linus-5.19-rc1' of https://github.com/c-sky/csky-linux Pull arch/csky updates from Guo Ren: - Three atomic optimizations - memcpy/memcpy_io optimization - Some coding conventions for Kbuild, removing warnings * tag 'csky-for-linus-5.19-rc1' of https://github.com/c-sky/csky-linux: csky: Move $(core-y) into arch/csky/Kbuild csky: Remove unused core-y for dts csky: Remove unused $(dtb-y) from boot/Makefile csky: atomic: Add conditional atomic operations' optimization csky: atomic: Add custom atomic.h implementation csky: atomic: Optimize cmpxchg with acquire & release csky: optimize memcpy_{from,to}io() and memset_io() csky: Add C based string functions csky: Fix versioncheck warnings csky: patch_text: Fixup last cpu should be master csky: fix typos in comments commit fdd8f6585cef1c8c0fac745c1baa687301d55a90 Merge: 17a05c8f1e18b 30b5e6ef4a32e Author: Linus Torvalds Date: Mon May 23 20:56:17 2022 -0700 Merge tag 'm68k-for-v5.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Introduce virtual m68k machine based on Android Goldfish devices - defconfig updates - Minor fixes and improvements * tag 'm68k-for-v5.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: atari: Make Atari ROM port I/O write macros return void m68k: math-emu: Fix dependencies of math emulation support m68k: math-emu: Fix typos in comments m68k: Wire up syscall_trace_enter/leave for m68k m68k: defconfig: Update defconfigs for v5.18-rc1 m68k: Introduce a virtual m68k machine clocksource/drivers: Add a goldfish-timer clocksource rtc: goldfish: Use gf_ioread32()/gf_iowrite32() tty: goldfish: Introduce gf_ioread32()/gf_iowrite32() commit 17a05c8f1e18b3ef846d0032a19002568282ac29 Merge: d61306047533e dc60001e1a305 Author: Linus Torvalds Date: Mon May 23 20:54:17 2022 -0700 Merge tag 'xtensa-20220523' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa architecture updates from Max Filippov: - support coprocessors on SMP - support KCSAN - support handling protection faults in noMMU configurations - support using coprocessors in the kernel mode - support hibernation - enable context tracking - enable HAVE_VIRT_CPU_ACCOUNTING_GEN - support division by 0 exception on cores without HW division option - clean up locking in the ISS network driver - clean up kernel entry assemly code - various minor fixes * tag 'xtensa-20220523' of https://github.com/jcmvbkbc/linux-xtensa: (36 commits) xtensa: Return true/false (not 1/0) from bool function xtensa: improve call0 ABI probing xtensa: support artificial division by 0 exception xtensa: add trap handler for division by zero xtensa/simdisk: fix proc_read_simdisk() xtensa: no need to initialise statics to 0 xtensa: clean up labels in the kernel entry assembly xtensa: don't leave invalid TLB entry in fast_store_prohibited xtensa: fix declaration of _SecondaryResetVector_text_* irqchip: irq-xtensa-mx: fix initial IRQ affinity xtensa: enable ARCH_HAS_DEBUG_VM_PGTABLE xtensa: add hibernation support xtensa: support coprocessors on SMP xtensa: get rid of stack frame in coprocessor_flush xtensa: merge SAVE_CP_REGS_TAB and LOAD_CP_REGS_TAB xtensa: add xtensa_xsr macro xtensa: handle coprocessor exceptions in kernel mode xtensa: use callx0 opcode in fast_coprocessor xtensa: clean up excsave1 initialization xtensa: clean up declarations in coprocessor.h ... commit d61306047533eb6f63a7bd51dfa7f868503bf0ba Merge: 8443516da676b 5b3353949e89d Author: Linus Torvalds Date: Mon May 23 20:49:45 2022 -0700 Merge tag 'for-linus-5.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - decouple the PV interface from kernel internals in the Xen scsifront/scsiback pv drivers - harden the Xen scsifront PV driver against a malicious backend driver - simplify Xen PV frontend driver ring page setup - support Xen setups with multiple domains created at boot time to tolerate Xenstore coming up late - two small cleanup patches * tag 'for-linus-5.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: (29 commits) xen: add support for initializing xenstore later as HVM domain xen: sync xs_wire.h header with upstream xen x86: xen: remove STACK_FRAME_NON_STANDARD from xen_cpuid xen-blk{back,front}: Update contact points for buffer_squeeze_duration_ms and feature_persistent xen/xenbus: eliminate xenbus_grant_ring() xen/sndfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/usbfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/scsifront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/pcifront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/drmfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/tpmfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/netfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/blkfront: use xenbus_setup_ring() and xenbus_teardown_ring() xen/xenbus: add xenbus_setup_ring() service function xen: update ring.h xen/shbuf: switch xen-front-pgdir-shbuf to use INVALID_GRANT_REF xen/dmabuf: switch gntdev-dmabuf to use INVALID_GRANT_REF xen/sound: switch xen_snd_front to use INVALID_GRANT_REF xen/drm: switch xen_drm_front to use INVALID_GRANT_REF xen/usb: switch xen-hcd to use INVALID_GRANT_REF ... commit 8443516da676be839b54ee11350baa2605f0a445 Merge: cfe1cb014bf94 badb81a58b9e6 Author: Linus Torvalds Date: Mon May 23 20:38:39 2022 -0700 Merge tag 'platform-drivers-x86-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: "This includes some small changes to kernel/stop_machine.c and arch/x86 which are deps of the new Intel IFS support. Highlights: - New drivers: - Intel "In Field Scan" (IFS) support - Winmate FM07/FM07P buttons - Mellanox SN2201 support - AMD PMC driver enhancements - Lots of various other small fixes and hardware-id additions" * tag 'platform-drivers-x86-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (54 commits) platform/x86/intel/ifs: Add CPU_SUP_INTEL dependency platform/x86: intel_cht_int33fe: Set driver data platform/x86: intel-hid: fix _DSM function index handling platform/x86: toshiba_acpi: use kobj_to_dev() platform/x86: samsung-laptop: use kobj_to_dev() platform/x86: gigabyte-wmi: Add support for Z490 AORUS ELITE AC and X570 AORUS ELITE WIFI tools/power/x86/intel-speed-select: Fix warning for perf_cap.cpu tools/power/x86/intel-speed-select: Display error on turbo mode disabled Documentation: In-Field Scan platform/x86/intel/ifs: add ABI documentation for IFS trace: platform/x86/intel/ifs: Add trace point to track Intel IFS operations platform/x86/intel/ifs: Add IFS sysfs interface platform/x86/intel/ifs: Add scan test support platform/x86/intel/ifs: Authenticate and copy to secured memory platform/x86/intel/ifs: Check IFS Image sanity platform/x86/intel/ifs: Read IFS firmware image platform/x86/intel/ifs: Add stub driver for In-Field Scan stop_machine: Add stop_core_cpuslocked() for per-core operations x86/msr-index: Define INTEGRITY_CAPABILITIES MSR x86/microcode/intel: Expose collect_cpu_info_early() for IFS ... commit cfe1cb014bf947c8a85e542ab0f7a417adca7059 Merge: d6ecaa0024485 e3a3bbe3e99de Author: Linus Torvalds Date: Mon May 23 20:34:58 2022 -0700 Merge tag 'x86_sgx_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SGX updates from Dave Hansen: "A set of patches to prevent crashes in SGX enclaves under heavy memory pressure: SGX uses normal RAM allocated from special shmem files as backing storage when it runs out of SGX memory (EPC). The code was overly aggressive when freeing shmem pages and was inadvertently freeing perfectly good data. This resulted in failures in the SGX instructions used to swap data back into SGX memory. This turned out to be really hard to trigger in mainline. It was originally encountered testing the out-of-tree "SGX2" patches, but later reproduced on mainline. Fix the data loss by being more careful about truncating pages out of the backing storage and more judiciously setting pages dirty" * tag 'x86_sgx_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Ensure no data in PCMD page after truncate x86/sgx: Fix race between reclaimer and page fault handler x86/sgx: Obtain backing storage page with enclave mutex held x86/sgx: Mark PCMD page as dirty when modifying contents x86/sgx: Disconnect backing page references from dirty status commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 Author: Hannes Reinecke Date: Mon May 23 14:02:44 2022 +0200 scsi: myrb: Fix up null pointer access on myrb_cleanup() When myrb_probe() fails the callback might not be set, so we need to validate the 'disable_intr' callback in myrb_cleanup() to not cause a null pointer exception. And while at it do not call myrb_cleanup() if we cannot enable the PCI device at all. Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de Reported-by: Zheyu Ma Tested-by: Zheyu Ma Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 7ad36c8b2b80c8d296478f9854135d379cc63551 Author: Christoph Hellwig Date: Mon May 23 10:38:38 2022 +0200 scsi: core: Unexport scsi_bus_type scsi_bus_type is not used by any code outside of scsi_mod.ko. Link: https://lore.kernel.org/r/20220523083838.227987-1-hch@lst.de Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 7274ce0558adb4b9b1f5c5b613fb4fe331c18911 Author: Christoph Hellwig Date: Mon May 23 10:38:13 2022 +0200 scsi: sd: Don't call blk_cleanup_disk() in sd_probe() In SCSI the midlayer has ownership of the request_queue, so on probe failure we must only put the gendisk, but leave the request_queue alone. Link: https://lore.kernel.org/r/20220523083813.227935-1-hch@lst.de Fixes: 03252259e18e ("scsi: sd: Clean up gendisk if device_add_disk() failed") Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 476e45923b5df19534178d0ed5c87c517dd6f669 Author: Dan Carpenter Date: Mon May 23 11:28:18 2022 +0300 scsi: ufs: ufshcd: Delete unnecessary NULL check The 'info' pointer points to somewhere in the middle of the 'hba' struct. It can't possibly be NULL. Delete the NULL check. Link: https://lore.kernel.org/r/YotFotj43TkB8Rid@kili Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 823ae99e09f7ada9e72c76cb2a9cc6a75a09971e Author: Julia Lawall Date: Sat May 21 13:11:41 2022 +0200 scsi: isci: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-91-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit f6e2694ebb2534f81bdc94501df3db589ba0aea9 Author: Julia Lawall Date: Sat May 21 13:11:39 2022 +0200 scsi: pmcraid: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-89-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit 8946ea283808d0905b11d12649976a227762d7e7 Author: Julia Lawall Date: Sat May 21 13:11:08 2022 +0200 scsi: smartpqi: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-58-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit 379ad771bb941dfcaa00d8c03667216eb74b8390 Author: Julia Lawall Date: Sat May 21 13:11:25 2022 +0200 scsi: qedf: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-75-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit 0676f275837ccab6c75a49bb0533ed519a0a9d7f Author: Julia Lawall Date: Sat May 21 13:10:50 2022 +0200 scsi: esas2r: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-40-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit 5445e08e115906163a39917c747b00083f88f270 Author: Julia Lawall Date: Sat May 21 13:10:22 2022 +0200 scsi: storvsc: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-12-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Martin K. Petersen commit d6ecaa0024485effd065124fe774de2e22095f2d Merge: 88699f8fbfd48 bf00745e7791f Author: Linus Torvalds Date: Mon May 23 19:46:50 2022 -0700 Merge tag 'x86_vdso_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso update from Borislav Petkov: - Get rid of CONFIG_LEGACY_VSYSCALL_EMULATE as nothing should be using it anymore * tag 'x86_vdso_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vsyscall: Remove CONFIG_LEGACY_VSYSCALL_EMULATE commit 88699f8fbfd482167362a881d37156cc3e2b0475 Merge: abc8babefbc1f 9c55d99e099bd Author: Linus Torvalds Date: Mon May 23 19:40:33 2022 -0700 Merge tag 'x86_microcode_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loader update from Borislav Petkov: - Make CPU vendor dependency explicit against random config build failures * tag 'x86_microcode_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Add explicit CPU vendor dependency commit abc8babefbc1fc6f013573bc933d66bc906cf726 Merge: 3e2cbc016b1d0 1ef64b1e89e6d Author: Linus Torvalds Date: Mon May 23 19:32:59 2022 -0700 Merge tag 'x86_misc_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: "A variety of fixes which don't fit any other tip bucket: - Remove unnecessary function export - Correct asm constraint - Fix __setup handlers retval" * tag 'x86_misc_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Cleanup the control_va_addr_alignment() __setup handler x86: Fix return value of __setup handlers x86/delay: Fix the wrong asm constraint in delay_loop() x86/amd_nb: Unexport amd_cache_northbridges() commit 3e2cbc016b1d08463925db9b9bd3bd253f64b8b0 Merge: 916654201008d 0180a1e823d7c Author: Linus Torvalds Date: Mon May 23 19:24:47 2022 -0700 Merge tag 'x86_splitlock_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 splitlock updates from Borislav Petkov: - Add Raptor Lake to the set of CPU models which support splitlock - Make life miserable for apps using split locks by slowing them down considerably while the rest of the system remains responsive. The hope is it will hurt more and people will really fix their misaligned locks apps. As a result, free a TIF bit. * tag 'x86_splitlock_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/split_lock: Enable the split lock feature on Raptor Lake x86/split-lock: Remove unused TIF_SLD bit x86/split_lock: Make life miserable for split lockers commit 916654201008d5fb4d5f5dcf0b373d291da615ac Merge: e3228a86a33ba 7a116a2dd32d9 Author: Linus Torvalds Date: Mon May 23 19:16:09 2022 -0700 Merge tag 'x86_apic_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 APIC updates from Borislav Petkov: - Always do default APIC routing setup so that cpumasks are properly allocated and are present when later accessed ("nosmp" and x2APIC) - Clarify the bit overlap between an old APIC and a modern, integrated one * tag 'x86_apic_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Do apic driver probe for "nosmp" use case x86/apic: Clarify i82489DX bit overlap in APIC_LVT0 commit e3228a86a33ba7e2f4205c1a06fdd05cc5c4eeb5 Merge: 1abcb10d6edf5 b57a7c9dd732c Author: Linus Torvalds Date: Mon May 23 19:14:17 2022 -0700 Merge tag 'x86_kdump_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 kdump fixlet from Borislav Petkov: - A single debug message fix * tag 'x86_kdump_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/crash: Fix minor typo/bug in debug message commit 1abcb10d6edf5c4c53d29e9ab5488c7734183828 Merge: c415b53ad00d2 327c348988c6f Author: Linus Torvalds Date: Mon May 23 19:11:08 2022 -0700 Merge tag 'x86_platform_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Borislav Petkov: - A couple of changes enabling SGI UV5 support * tag 'x86_platform_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/uv: Log gap hole end size x86/platform/uv: Update TSC sync state for UV5 x86/platform/uv: Update NMI Handler for UV5 commit 9ccfc23a72b669678e4c9ccba98d3d91db1c04cf Author: Steve French Date: Mon May 23 20:54:04 2022 -0500 smb3: don't set rc when used and unneeded in query_info_compound rc is not checked so should not be set coming back from open_cached_dir (the cfid pointer is checked instead to see if open_cached_dir failed) Addresses-Coverity: 1518021 ("Code maintainability issues (UNUSED_VALUE)") Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit c415b53ad00d27a0655bbe7691dc005787da4f8d Merge: e36ae2290fd1f 944fad4583bc8 Author: Linus Torvalds Date: Mon May 23 18:59:24 2022 -0700 Merge tag 'x86_mm_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm fixlet from Borislav Petkov: - A sparse address space annotation fix * tag 'x86_mm_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fault: Cast an argument to the proper address space in prefetch() commit bbdf6cf56c88845fb0b713cbf5c6623c53fe40d8 Author: Steve French Date: Mon May 23 20:42:03 2022 -0500 smb3: check for null tcon Although unlikely to be null, it is confusing to use a pointer before checking for it to be null so move the use down after null check. Addresses-Coverity: 1517586 ("Null pointer dereferences (REVERSE_INULL)") Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit e36ae2290fd1ff3768c3688627e442cd11d4ca1e Merge: de8ac81747fca b91c0922bf1ed Author: Linus Torvalds Date: Mon May 23 18:49:16 2022 -0700 Merge tag 'x86_fpu_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu updates from Borislav Petkov: - Add support for XSAVEC - the Compacted XSTATE saving variant - and thus allow for guests to use this compacted XSTATE variant when the hypervisor exports that support - A variable shadowing cleanup * tag 'x86_fpu_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Cleanup variable shadowing x86/fpu/xsave: Support XSAVEC in the kernel commit de8ac81747fca15925f3488ead7804560cdea532 Merge: a13dc4d409387 69505e3d9a39a Author: Linus Torvalds Date: Mon May 23 18:42:07 2022 -0700 Merge tag 'x86_core_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core x86 updates from Borislav Petkov: - Remove all the code around GS switching on 32-bit now that it is not needed anymore - Other misc improvements * tag 'x86_core_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: bug: Use normal relative pointers in 'struct bug_entry' x86/nmi: Make register_nmi_handler() more robust x86/asm: Merge load_gs_index() x86/32: Remove lazy GS macros ELF: Remove elf_core_copy_kernel_regs() x86/32: Simplify ELF_CORE_COPY_REGS commit 93ed91c020aa4f021600a633f1f87790a5e50b91 Author: Steve French Date: Sun May 22 21:25:24 2022 -0500 cifs: fix minor compile warning Add ifdef around nodfs variable from patch: "cifs: don't call cifs_dfs_query_info_nonascii_quirk() if nodfs was set" which is unused when CONFIG_DFS_UPCALL is not set. Signed-off-by: Steve French commit a42078b9e8983c7e2dc9a6e86239735e3a558083 Author: Steve French Date: Sun May 22 21:14:42 2022 -0500 Add various fsctl structs Add missing structure definition for various newer fsctl operations - duplicate_extents_ex - get_integrity_information - query_file_regions - query_on_disk_volume_info And move some fsctl defintions to smbfs_common Signed-off-by: Steve French commit 22c5b91336546000020fb47f4b80f4cbae47e78b Author: Steve French Date: Sun May 22 18:30:38 2022 -0500 Add defines for various newer FSCTLs Checking MS-FSCC section 2.3 found six FSCTL defines that were missing Reviewed-by: David Disseldorp Signed-off-by: Steve French commit a13dc4d40938787cfc9e520ed426df4ebf48b1aa Merge: 1de564b8c1a6f d936411dc9cae Author: Linus Torvalds Date: Mon May 23 18:17:09 2022 -0700 Merge tag 'x86_cleanups_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - Serious sanitization and cleanup of the whole APERF/MPERF and frequency invariance code along with removing the need for unnecessary IPIs - Finally remove a.out support - The usual trivial cleanups and fixes all over x86 * tag 'x86_cleanups_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits) x86: Remove empty files x86/speculation: Add missing srbds=off to the mitigations= help text x86/prctl: Remove pointless task argument x86/aperfperf: Make it correct on 32bit and UP kernels x86/aperfmperf: Integrate the fallback code from show_cpuinfo() x86/aperfmperf: Replace arch_freq_get_on_cpu() x86/aperfmperf: Replace aperfmperf_get_khz() x86/aperfmperf: Store aperf/mperf data for cpu frequency reads x86/aperfmperf: Make parts of the frequency invariance code unconditional x86/aperfmperf: Restructure arch_scale_freq_tick() x86/aperfmperf: Put frequency invariance aperf/mperf data into a struct x86/aperfmperf: Untangle Intel and AMD frequency invariance init x86/aperfmperf: Separate AP/BP frequency invariance init x86/smp: Move APERF/MPERF code where it belongs x86/aperfmperf: Dont wake idle CPUs in arch_freq_get_on_cpu() x86/process: Fix kernel-doc warning due to a changed function name x86: Remove a.out support x86/mm: Replace nodes_weight() with nodes_empty() where appropriate x86: Replace cpumask_weight() with cpumask_empty() where appropriate x86/pkeys: Remove __arch_set_user_pkey_access() declaration ... commit 1de564b8c1a6f9f8bf3a106daa0be9f2cba7d045 Merge: 42b682a30f86e aeb84412037b8 Author: Linus Torvalds Date: Mon May 23 18:15:44 2022 -0700 Merge tag 'x86_build_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Borislav Petkov: - Add a "make x86_debug.config" target which enables a bunch of useful config debug options when trying to debug an issue - A gcc-12 build warnings fix * tag 'x86_build_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Wrap literal addresses in absolute_pointer() x86/configs: Add x86 debugging Kconfig fragment plus docs commit 42b682a30f86e0ab10557dbfa437f01befb5a8ec Merge: c5a3d3c01e90e 036c07c0c3b8a Author: Linus Torvalds Date: Mon May 23 18:08:46 2022 -0700 Merge tag 'x86_asm_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Borislav Petkov: - A bunch of changes towards streamlining low level asm helpers' calling conventions so that former can be converted to C eventually - Simplify PUSH_AND_CLEAR_REGS so that it can be used at the system call entry paths instead of having opencoded, slightly different variants of it everywhere - Misc other fixes * tag 'x86_asm_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry: Fix register corruption in compat syscall objtool: Fix STACK_FRAME_NON_STANDARD reloc type linkage: Fix issue with missing symbol size x86/entry: Remove skip_r11rcx x86/entry: Use PUSH_AND_CLEAR_REGS for compat x86/entry: Simplify entry_INT80_compat() x86/mm: Simplify RESERVE_BRK() x86/entry: Convert SWAPGS to swapgs and remove the definition of SWAPGS x86/entry: Don't call error_entry() for XENPV x86/entry: Move CLD to the start of the idtentry macro x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry() x86/entry: Switch the stack after error_entry() returns x86/traps: Use pt_regs directly in fixup_bad_iret() commit c5a3d3c01e90e74166f95eec9db6fcc3ba72a9d6 Merge: 3a755ebcc2557 2147c438fde13 Author: Linus Torvalds Date: Mon May 23 18:01:31 2022 -0700 Merge tag 'x86_cpu_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CPU feature updates from Borislav Petkov: - Remove a bunch of chicken bit options to turn off CPU features which are not really needed anymore - Misc fixes and cleanups * tag 'x86_cpu_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Add missing prototype for unpriv_ebpf_notify() x86/pm: Fix false positive kmemleak report in msr_build_context() x86/speculation/srbds: Do not try to turn mitigation off when not supported x86/cpu: Remove "noclflush" x86/cpu: Remove "noexec" x86/cpu: Remove "nosmep" x86/cpu: Remove CONFIG_X86_SMAP and "nosmap" x86/cpu: Remove "nosep" x86/cpu: Allow feature bit names from /proc/cpuinfo in clearcpuid= commit 3a755ebcc2557e22b895b8976257f682c653db1d Merge: 5b828263b180c c796f02162e42 Author: Linus Torvalds Date: Mon May 23 17:51:12 2022 -0700 Merge tag 'x86_tdx_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull Intel TDX support from Borislav Petkov: "Intel Trust Domain Extensions (TDX) support. This is the Intel version of a confidential computing solution called Trust Domain Extensions (TDX). This series adds support to run the kernel as part of a TDX guest. It provides similar guest protections to AMD's SEV-SNP like guest memory and register state encryption, memory integrity protection and a lot more. Design-wise, it differs from AMD's solution considerably: it uses a software module which runs in a special CPU mode called (Secure Arbitration Mode) SEAM. As the name suggests, this module serves as sort of an arbiter which the confidential guest calls for services it needs during its lifetime. Just like AMD's SNP set, this series reworks and streamlines certain parts of x86 arch code so that this feature can be properly accomodated" * tag 'x86_tdx_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits) x86/tdx: Fix RETs in TDX asm x86/tdx: Annotate a noreturn function x86/mm: Fix spacing within memory encryption features message x86/kaslr: Fix build warning in KASLR code in boot stub Documentation/x86: Document TDX kernel architecture ACPICA: Avoid cache flush inside virtual machines x86/tdx/ioapic: Add shared bit for IOAPIC base address x86/mm: Make DMA memory shared for TD guest x86/mm/cpa: Add support for TDX shared memory x86/tdx: Make pages shared in ioremap() x86/topology: Disable CPU online/offline control for TDX guests x86/boot: Avoid #VE during boot for TDX platforms x86/boot: Set CR0.NE early and keep it set during the boot x86/acpi/x86/boot: Add multiprocessor wake-up support x86/boot: Add a trampoline for booting APs via firmware handoff x86/tdx: Wire up KVM hypercalls x86/tdx: Port I/O: Add early boot support x86/tdx: Port I/O: Add runtime hypercalls x86/boot: Port I/O: Add decompression-time support for TDX x86/boot: Port I/O: Allow to hook up alternative helpers ... commit 5b828263b180c16037382e8ffddd0611a363aabe Merge: eb39e37d5cebd fa619f5156cf1 Author: Linus Torvalds Date: Mon May 23 17:47:19 2022 -0700 Merge tag 'ras_core_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - Simplification of the AMD MCE error severity grading logic along with supplying critical panic MCEs with accompanying error messages for more human-friendly diagnostics. - Misc fixes * tag 'ras_core_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Add messages for panic errors in AMD's MCE grading x86/mce: Simplify AMD severity grading logic x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails x86/mce: Avoid unnecessary padding in struct mce_bank commit abd4fd43f2af03e2e852e6b1b98faeee9e3eae55 Author: Bagas Sanjaya Date: Wed May 18 15:35:24 2022 +0700 platform/chrome: Use imperative mood for ChromeOS ACPI sysfs ABI descriptions The current descriptions all begin with ("This file shows something") clause, which is incorrect wording since these mean return value from sysfs. Use imperative mood ("Returns something") instead, in line with corresponding ACPI documentation at firmware-guide/. Cc: Benson Leung Cc: Guenter Roeck Cc: Andy Shevchenko Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Cc: Dmitry Torokhov Cc: Enric Balletbo i Serra Cc: Muhammad Usama Anjum Cc: Tzung-Bi Shih Cc: Linux Kernel Mailing List Cc: Linux Next Mailing List Signed-off-by: Bagas Sanjaya Reviewed-by: Muhammad Usama Anjum Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20220518083524.37380-3-bagasdotme@gmail.com commit a6c13d87b4b7ae7f7f4574014f5478f7fe92540c Author: Bagas Sanjaya Date: Wed May 18 15:35:23 2022 +0700 platform/chrome: Use tables for values lists of ChromeOS ACPI sysfs ABI Stephen Rothwell reported htmldocs warning when merging chrome-platform tree: Documentation/ABI/testing/sysfs-driver-chromeos-acpi:2: WARNING: Unexpected indentation. Documentation/ABI/testing/sysfs-driver-chromeos-acpi:11: WARNING: Unexpected indentation. Documentation/ABI/testing/sysfs-driver-chromeos-acpi:22: WARNING: Unexpected indentation. Documentation/ABI/testing/sysfs-driver-chromeos-acpi:56: WARNING: Unexpected indentation. The warning is due to missing blank line separator surrounding values lists. Instead of using lists, use tables to be consistent with rest of sysfs ABI documentation. Link: https://lore.kernel.org/linux-next/20220516213832.19127535@canb.auug.org.au/ Fixes: 0a4cad9c11ad ("platform/chrome: Add ChromeOS ACPI device driver") Reported-by: Stephen Rothwell Cc: Benson Leung Cc: Guenter Roeck Cc: Andy Shevchenko Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Cc: Dmitry Torokhov Cc: Enric Balletbo i Serra Cc: Muhammad Usama Anjum Cc: Tzung-Bi Shih Cc: Linux Kernel Mailing List Cc: Linux Next Mailing List Signed-off-by: Bagas Sanjaya Reviewed-by: Muhammad Usama Anjum Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20220518083524.37380-2-bagasdotme@gmail.com [tzungbi: fix the Fixes tag to 12-chars hash.] Signed-off-by: Tzung-Bi Shih commit eb39e37d5cebdf0f63ee2a315fc23b035d81b4b0 Merge: 0be3ff0ccbfac ce6565282b3b1 Author: Linus Torvalds Date: Mon May 23 17:38:01 2022 -0700 Merge tag 'x86_sev_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull AMD SEV-SNP support from Borislav Petkov: "The third AMD confidential computing feature called Secure Nested Paging. Add to confidential guests the necessary memory integrity protection against malicious hypervisor-based attacks like data replay, memory remapping and others, thus achieving a stronger isolation from the hypervisor. At the core of the functionality is a new structure called a reverse map table (RMP) with which the guest has a say in which pages get assigned to it and gets notified when a page which it owns, gets accessed/modified under the covers so that the guest can take an appropriate action. In addition, add support for the whole machinery needed to launch a SNP guest, details of which is properly explained in each patch. And last but not least, the series refactors and improves parts of the previous SEV support so that the new code is accomodated properly and not just bolted on" * tag 'x86_sev_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (60 commits) x86/entry: Fixup objtool/ibt validation x86/sev: Mark the code returning to user space as syscall gap x86/sev: Annotate stack change in the #VC handler x86/sev: Remove duplicated assignment to variable info x86/sev: Fix address space sparse warning x86/sev: Get the AP jump table address from secrets page x86/sev: Add missing __init annotations to SEV init routines virt: sevguest: Rename the sevguest dir and files to sev-guest virt: sevguest: Change driver name to reflect generic SEV support x86/boot: Put globals that are accessed early into the .data section x86/boot: Add an efi.h header for the decompressor virt: sevguest: Fix bool function returning negative value virt: sevguest: Fix return value check in alloc_shared_pages() x86/sev-es: Replace open-coded hlt-loop with sev_es_terminate() virt: sevguest: Add documentation for SEV-SNP CPUID Enforcement virt: sevguest: Add support to get extended report virt: sevguest: Add support to derive key virt: Add SEV-SNP guest driver x86/sev: Register SEV-SNP guest request platform device x86/sev: Provide support for SNP guest request NAEs ... commit 0be3ff0ccbfacb1bcc56e2ec9c1c5d92cf9a64d3 Merge: 03e1ccd45fa70 be80a1ca5119c Author: Linus Torvalds Date: Mon May 23 17:34:20 2022 -0700 Merge tag 'edac_updates_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Switch ghes_edac to use the CPER error reporting routines and simplify the code considerably this way - Rip out the silly edac_align_ptr() contraption which was computing the size of the private structures of each driver and thus allowing for a one-shot memory allocation. This was clearly unnecessary and confusing so switch to simple and boring kmalloc* calls. - Last but not least, the usual garden variety of fixes, cleanups and improvements all over EDAC land * tag 'edac_updates_for_v5.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/xgene: Fix typo processsors -> processors EDAC/i5100: Remove unused inline function i5100_nrecmema_dm_buf_id() EDAC: Use kcalloc() EDAC/ghes: Change ghes_hw from global to static EDAC/armada_xp: Use devm_platform_ioremap_resource() EDAC/synopsys: Add a SPDX identifier EDAC/synopsys: Add driver support for i.MX platforms EDAC/dmc520: Don't print an error for each unconfigured interrupt line EDAC/mc: Get rid of edac_align_ptr() EDAC/device: Sanitize edac_device_alloc_ctl_info() definition EDAC/device: Get rid of the silly one-shot memory allocation in edac_device_alloc_ctl_info() EDAC/pci: Get rid of the silly one-shot memory allocation in edac_pci_alloc_ctl_info() EDAC/mc: Get rid of silly one-shot struct allocation in edac_mc_alloc() efi/cper: Reformat CPER memory error location to more readable EDAC/ghes: Unify CPER memory error location reporting efi/cper: Add a cper_mem_err_status_str() to decode error description powerpc/85xx: Remove fsl,85... bindings commit 03e1ccd45fa70904e43ddceda140854d22b7e871 Merge: 6e01f86fb2025 c25f23459c117 Author: Linus Torvalds Date: Mon May 23 17:18:25 2022 -0700 Merge tag 'x86-irq-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 PCI irq routing updates from Thomas Gleixner: - Cleanup and robustify the PCI interrupt routing table handling including proper range checks - Add support for Intel 82378ZB/82379AB, SiS85C497 PIRQ routers - Fix the ALi M1487 router handling - Handle the IRT routing table format in AMI BIOSes correctly * tag 'x86-irq-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/PCI: Fix coding style in PIRQ table verification x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation x86/PCI: Add $IRT PIRQ routing table support x86/PCI: Handle PIRQ routing tables with no router device given x86/PCI: Add PIRQ routing table range checks x86/PCI: Add support for the SiS85C497 PIRQ router x86/PCI: Disambiguate SiS85C503 PIRQ router code entities x86/PCI: Handle IRQ swizzling with PIRQ routers x86/PCI: Also match function number in $PIR table x86/PCI: Include function number in $PIR table dump x86/PCI: Show the physical address of the $PIR table commit 6e01f86fb2025111c77101254f1442ac137089cd Merge: fcfde8a7cf6d5 317f29c14d0cc Author: Linus Torvalds Date: Mon May 23 17:05:55 2022 -0700 Merge tag 'timers-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer and timekeeping updates from Thomas Gleixner: - Expose CLOCK_TAI to instrumentation to aid with TSN debugging. - Ensure that the clockevent is stopped when there is no timer armed to avoid pointless wakeups. - Make the sched clock frequency handling and rounding consistent. - Provide a better debugobject hint for delayed works. The timer callback is always the same, which makes it difficult to identify the underlying work. Use the work function as a hint instead. - Move the timer specific sysctl code into the timer subsystem. - The usual set of improvements and cleanups * tag 'timers-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers: Provide a better debugobjects hint for delayed works time/sched_clock: Fix formatting of frequency reporting code time/sched_clock: Use Hz as the unit for clock rate reporting below 4kHz time/sched_clock: Round the frequency reported to nearest rather than down timekeeping: Consolidate fast timekeeper timekeeping: Annotate ktime_get_boot_fast_ns() with data_race() timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped timekeeping: Introduce fast accessor to clock tai tracing/timer: Add missing argument documentation of trace points clocksource: Replace cpumask_weight() with cpumask_empty() timers: Move timer sysctl into the timer code clockevents: Use dedicated list iterator variable timers: Simplify calc_index() timers: Initialize base::next_expiry_recalc in timers_prepare_cpu() commit fcfde8a7cf6d5e347ce61d8e5c0aee52926ef8e9 Merge: 28c8f9fe94c4e cdb4913293897 Author: Linus Torvalds Date: Mon May 23 16:58:49 2022 -0700 Merge tag 'irq-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt handling updates from Thomas Gleixner: "Core code: - Make the managed interrupts more robust by shutting them down in the core code when the assigned affinity mask does not contain online CPUs. - Make the irq simulator chip work on RT - A small set of cpumask and power manageent cleanups Drivers: - A set of changes which mark GPIO interrupt chips immutable to prevent the GPIO subsystem from modifying it under the hood. This provides the necessary infrastructure and converts a set of GPIO and pinctrl drivers over. - A set of changes to make the pseudo-NMI handling for GICv3 more robust: a missing barrier and consistent handling of the priority mask. - Another set of GICv3 improvements and fixes, but nothing outstanding - The usual set of improvements and cleanups all over the place - No new irqchip drivers and not even a new device tree binding! 100+ interrupt chips are truly enough" * tag 'irq-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) irqchip: Add Kconfig symbols for sunxi drivers irqchip/gic-v3: Fix priority mask handling irqchip/gic-v3: Refactor ISB + EOIR at ack time irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling genirq/irq_sim: Make the irq_work always run in hard irq context irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip/gic: Improved warning about incorrect type irqchip/csky: Return true/false (not 1/0) from bool functions irqchip/imx-irqsteer: Add runtime PM support irqchip/imx-irqsteer: Constify irq_chip struct irqchip/armada-370-xp: Enable MSI affinity configuration irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/sun6i-r: Use NULL for chip_data irqchip/xtensa-mx: Fix initial IRQ affinity in non-SMP setup irqchip/exiu: Fix acknowledgment of edge triggered interrupts irqchip/gic-v3: Claim iomem resources dt-bindings: interrupt-controller: arm,gic-v3: Make the v2 compat requirements explicit irqchip/gic-v3: Relax polling of GIC{R,D}_CTLR.RWP irqchip/gic-v3: Detect LPI invalidation MMIO registers ... commit 28c8f9fe94c4e0b0c27383d48da3c85b0dc17081 Merge: 985564eb3e3c2 d308077e5e4dc Author: Linus Torvalds Date: Mon May 23 16:55:36 2022 -0700 Merge tag 'smp-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug updates from Thomas Gleixner: - Initialize the per-CPU structures during early boot so that the state is consistent from the very beginning. - Make the virtualization hotplug state handling more robust and let the core bringup CPUs which timed out in an earlier attempt again. - Make the x86/xen CPU state tracking consistent on a failed online attempt, so a consecutive bringup does not fall over the inconsistent state. * tag 'smp-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Initialise all cpuhp_cpu_state structs earlier cpu/hotplug: Allow the CPU in CPU_UP_PREPARE state to be brought up again. x86/xen: Allow to retry if cpu_initialize_context() failed. commit 985564eb3e3c2024af222525e8e052b3336a6775 Merge: 4b57dccc42a79 9e4a51ad8eee1 Author: Linus Torvalds Date: Mon May 23 16:40:12 2022 -0700 Merge tag 'core-debugobjects-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fixlet from Thomas Gleixner: "Trivial licensing cleanup in debugobjects" * tag 'core-debugobjects-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Convert to SPDX license identifier commit 4b57dccc42a790cdf2a8cad110143feb8b35e563 Merge: 140e40e39a29c 75d8cce128c51 Author: Linus Torvalds Date: Mon May 23 16:37:35 2022 -0700 Merge tag 'core-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irqpoll update from Thomas Gleixner: "A single update for irqpoll: Ensure that a raised soft interrupt is handled after pulling the blk_cpu_iopoll backlog from a unplugged CPU. This prevents that the CPU which runs that code reaches idle with soft interrupts pending" * tag 'core-core-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lib/irq_poll: Prevent softirq pending leak in irq_poll_cpu_dead() commit 1ef0736c0711e2633a59b540931406de626f2836 Merge: 9fa87dd232515 608b638ebf368 Author: Jakub Kicinski Date: Mon May 23 16:07:13 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2022-05-23 We've added 113 non-merge commits during the last 26 day(s) which contain a total of 121 files changed, 7425 insertions(+), 1586 deletions(-). The main changes are: 1) Speed up symbol resolution for kprobes multi-link attachments, from Jiri Olsa. 2) Add BPF dynamic pointer infrastructure e.g. to allow for dynamically sized ringbuf reservations without extra memory copies, from Joanne Koong. 3) Big batch of libbpf improvements towards libbpf 1.0 release, from Andrii Nakryiko. 4) Add BPF link iterator to traverse links via seq_file ops, from Dmitrii Dolgov. 5) Add source IP address to BPF tunnel key infrastructure, from Kaixi Fan. 6) Refine unprivileged BPF to disable only object-creating commands, from Alan Maguire. 7) Fix JIT blinding of ld_imm64 when they point to subprogs, from Alexei Starovoitov. 8) Add BPF access to mptcp_sock structures and their meta data, from Geliang Tang. 9) Add new BPF helper for access to remote CPU's BPF map elements, from Feng Zhou. 10) Allow attaching 64-bit cookie to BPF link of fentry/fexit/fmod_ret, from Kui-Feng Lee. 11) Follow-ups to typed pointer support in BPF maps, from Kumar Kartikeya Dwivedi. 12) Add busy-poll test cases to the XSK selftest suite, from Magnus Karlsson. 13) Improvements in BPF selftest test_progs subtest output, from Mykola Lysenko. 14) Fill bpf_prog_pack allocator areas with illegal instructions, from Song Liu. 15) Add generic batch operations for BPF map-in-map cases, from Takshak Chahande. 16) Make bpf_jit_enable more user friendly when permanently on 1, from Tiezhu Yang. 17) Fix an array overflow in bpf_trampoline_get_progs(), from Yuntao Wang. ==================== Link: https://lore.kernel.org/r/20220523223805.27931-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 9fa87dd23251574a29cf948fd16cf39075762f3e Merge: b1e6738a2185f 8f445a3ec3fd3 Author: Jakub Kicinski Date: Mon May 23 15:59:41 2022 -0700 Merge tag 'linux-can-next-for-5.19-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2022-05-23 this is a pull request of 3 patches for net-next/master. The first patch is by Julia Lawall and fixes a typo in the peak_usb driver. Jakub Kicinski contributes a patch for the kvaser_usb driver to silence a GCC 12 -Warray-bounds warning. The last patch is by me, target the ctucanfd platform driver and adds a missing dependency to HAS_IOMEM. * tag 'linux-can-next-for-5.19-20220523' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: ctucanfd: platform: add missing dependency to HAS_IOMEM can: kvaser_usb: silence a GCC 12 -Warray-bounds warning can: peak_usb: fix typo in comment ==================== Link: https://lore.kernel.org/r/20220523201045.1708855-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit d036d915b61f23b9e80d93f8a606eebf3bfab73f Author: Julia Lawall Date: Sat May 21 13:11:09 2022 +0200 of/irq: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220521111145.81697-59-Julia.Lawall@inria.fr commit 140e40e39a29c7dbc188d9b43831c3d5e089c960 Merge: 8a32f81a89cf3 31a644b3c2ae6 Author: Linus Torvalds Date: Mon May 23 14:36:45 2022 -0700 Merge tag 'zonefs-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs updates from Damien Le Moal: "This improves zonefs open sequential file accounting and adds accounting for active sequential files to allow the user to handle the maximum number of active zones of an NVMe ZNS drive. sysfs attributes for both open and active sequential files are also added to facilitate access to this information from applications without resorting to inspecting the block device limits" * tag 'zonefs-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: documentation: zonefs: Document sysfs attributes documentation: zonefs: Cleanup the mount options section zonefs: Add active seq file accounting zonefs: Export open zone resource information through sysfs zonefs: Always do seq file write open accounting zonefs: Rename super block information fields zonefs: Fix management of open zones zonefs: Clear inode information flags on inode creation commit b1e6738a2185fd7626a6187050a3edf9c38c2afe Merge: fe7324b932222 edcb185fa9c4f Author: Jakub Kicinski Date: Mon May 23 14:36:36 2022 -0700 Merge tag 'for-net-next-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: - Add support for Realtek 8761BUV - Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk - Add support for RTL8852C - Add a new PID/VID 0489/e0c8 for MT7921 - Add support for Qualcomm WCN785x * tag 'for-net-next-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (26 commits) Bluetooth: hci_sync: use hci_skb_event() helper Bluetooth: eir: Add helpers for managing service data Bluetooth: hci_sync: Fix attempting to suspend with unfiltered passive scan Bluetooth: MGMT: Add conditions for setting HCI_CONN_FLAG_REMOTE_WAKEUP Bluetooth: btmtksdio: fix the reset takes too long Bluetooth: btmtksdio: fix possible FW initialization failure Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event Bluetooth: btbcm: Add entry for BCM4373A0 UART Bluetooth Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 Bluetooth: btusb: Add 0x0bda:0x8771 Realtek 8761BUV devices Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA Bluetooth: core: Fix missing power_on work cancel on HCI close Bluetooth: btusb: add support for Qualcomm WCN785x Bluetooth: protect le accept and resolv lists with hdev->lock Bluetooth: use hdev lock for accept_list and reject_list in conn req Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring Bluetooth: btrtl: Add support for RTL8852C Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA Bluetooth: Print broken quirks Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk ... ==================== Link: https://lore.kernel.org/r/20220523204151.3327345-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 7fb0269720d7d5359bc8349eef908a1c96866b65 Merge: 8c3b8dc5cc9bf c9f73a2178c12 Author: Jakub Kicinski Date: Mon May 23 14:33:38 2022 -0700 Merge tag 'for-net-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix crash when an LE Connection fails to be established. * tag 'for-net-2022-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_conn: Fix hci_connect_le_sync ==================== Link: https://lore.kernel.org/r/20220523200349.3322806-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 608b638ebf368f18431f47bbbd0d93828cbbdf83 Merge: 1ec5ee8c8a5a6 0cf7052a55128 Author: Andrii Nakryiko Date: Mon May 23 14:30:18 2022 -0700 Merge branch 'Dynamic pointers' Joanne Koong says: ==================== This patchset implements the basics of dynamic pointers in bpf. A dynamic pointer (struct bpf_dynptr) is a pointer that stores extra metadata alongside the address it points to. This abstraction is useful in bpf given that every memory access in a bpf program must be safe. The verifier and bpf helper functions can use the metadata to enforce safety guarantees for things such as dynamically sized strings and kernel heap allocations. From the program side, the bpf_dynptr is an opaque struct and the verifier will enforce that its contents are never written to by the program. It can only be written to through specific bpf helper functions. There are several uses cases for dynamic pointers in bpf programs. Some examples include: dynamically sized ringbuf reservations without extra memcpys, dynamic string parsing and memory comparisons, dynamic memory allocations that can be persisted in maps, and dynamic + ergonomic parsing of sk_buff and xdp_md packet data. At a high-level, the patches are as follows: 1/6 - Adds verifier support for dynptrs 2/6 - Adds bpf_dynptr_from_mem (local dynptr) 3/6 - Adds dynptr support for ring buffers 4/6 - Adds bpf_dynptr_read and bpf_dynptr_write 5/6 - Adds dynptr data slices (ptr to the dynptr data) 6/6 - Tests to check that the verifier rejects invalid cases and passes valid ones This is the first dynptr patchset in a larger series. The next series of patches will add dynptrs that support dynamic memory allocations that can also be persisted in maps, support for parsing packet data through dynptrs, convenience helpers for using dynptrs as iterators, and more helper functions for interacting with strings and memory dynamically. Changelog: ---------- v5 -> v6: v5: https://lore.kernel.org/bpf/20220520044245.3305025-1-joannelkoong@gmail.com/ * enforce PTR_TO_MAP_VALUE for bpf_dynptr_from_mem data in check_helper_call instead of using DYNPTR_TYPE_LOCAL when checking func arg compatiblity * remove MEM_DYNPTR modifier v4 -> v5: v4: https://lore.kernel.org/bpf/20220509224257.3222614-1-joannelkoong@gmail.com/ * Remove malloc dynptr; this will be part of the 2nd patchset while we figure out memory accounting * For data slices, only set the register's ref_obj_id to dynptr_id (Alexei) * Tidying (eg remove "inline", move offset checking to "check_func_arg_reg_off") (David) * Add a few new test cases, remove malloc-only ones. v3 -> v4: v3: https://lore.kernel.org/bpf/20220428211059.4065379-1-joannelkoong@gmail.com/ 1/6 - Change mem ptr + size check to use more concise inequality expression (David + Andrii) 2/6 - Add check for meta->uninit_dynptr_regno not already set (Andrii) Move DYNPTR_TYPE_FLAG_MASK to include/linux/bpf.h (Andrii) 3/6 - Remove four underscores for invoking BPF_CALL (Andrii) Add __BPF_TYPE_FLAG_MAX and use it for __BPF_TYPE_LAST_FLAG (Andrii) 4/6 - Fix capacity to be bpf_dynptr size value in check_off_len (Andrii) Change -EINVAL to -E2BIG if len + offset is out of bounds (Andrii) 5/6 - Add check for only 1 dynptr arg for dynptr data function (Andrii) 6/6 - For ringbuf map, set max_entries from userspace (Andrii) Use err ?: ... for interactring with dynptr APIs (Andrii) Define array_map2 for add_dynptr_to_map2 test where value is a struct with an embedded dynptr Remove ref id from missing_put_callback message, since on different environments, ref id is not always = 1 v2 -> v3: v2: https://lore.kernel.org/bpf/20220416063429.3314021-1-joannelkoong@gmail.com/ * Reorder patches (move ringbuffer patch to be right after the verifier + * malloc dynptr patchset) * Remove local type dynptrs (Andrii + Alexei) * Mark stack slot as STACK_MISC after any writes into a dynptr instead of * explicitly prohibiting writes (Alexei) * Pass number of slots, not memory size to is_spi_bounds_valid (Kumar) * Check reference leaks by adding dynptr id to state->refs instead of checking stack slots (Alexei) v1 -> v2: v1: https://lore.kernel.org/bpf/20220402015826.3941317-1-joannekoong@fb.com/ 1/7 - * Remove ARG_PTR_TO_MAP_VALUE_UNINIT alias and use ARG_PTR_TO_MAP_VALUE | MEM_UNINIT directly (Andrii) * Drop arg_type_is_mem_ptr() wrapper function (Andrii) 2/7 - * Change name from MEM_RELEASE to OBJ_RELEASE (Andrii) * Use meta.release_ref instead of ref_obj_id != 0 to determine whether to release reference (Kumar) * Drop type_is_release_mem() wrapper function (Andrii) 3/7 - * Add checks for nested dynptrs edge-cases, which could lead to corrupt * writes of the dynptr stack variable. * Add u64 flags to bpf_dynptr_from_mem() and bpf_dynptr_alloc() (Andrii) * Rename from bpf_malloc/bpf_free to bpf_dynptr_alloc/bpf_dynptr_put (Alexei) * Support alloc flag __GFP_ZERO (Andrii) * Reserve upper 8 bits in dynptr size and offset fields instead of reserving just the upper 4 bits (Andrii) * Allow dynptr zero-slices (Andrii) * Use the highest bit for is_rdonly instead of the 28th bit (Andrii) * Rename check_* functions to is_* functions for better readability (Andrii) * Add comment for code that checks the spi bounds (Andrii) 4/7 - * Fix doc description for bpf_dynpt_read (Toke) * Move bpf_dynptr_check_off_len() from function patch 1 to here (Andrii) 5/7 - * When finding the id for the dynptr to associate the data slice with, look for dynptr arg instead of assuming it is BPF_REG_1. 6/7 - * Add __force when casting from unsigned long to void * (kernel test * robot) * Expand on docs for ringbuf dynptr APIs (Andrii) 7/7 - * Use table approach for defining test programs and error messages * (Andrii) * Print out full log if there’s an error (Andrii) * Use bpf_object__find_program_by_name() instead of specifying program name as a string (Andrii) * Add 6 extra cases: invalid_nested_dynptrs1, invalid_nested_dynptrs2, invalid_ref_mem1, invalid_ref_mem2, zero_slice_access, and test_alloc_zero_bytes * Add checking for edge cases (eg allocing with invalid flags) ==================== Signed-off-by: Andrii Nakryiko commit 0cf7052a55128f7fd7905f6ae6eb995d6db76b52 Author: Joanne Koong Date: Mon May 23 14:07:12 2022 -0700 selftests/bpf: Dynptr tests This patch adds tests for dynptrs, which include cases that the verifier needs to reject (for example, a bpf_ringbuf_reserve_dynptr without a corresponding bpf_ringbuf_submit/discard_dynptr) as well as cases that should successfully pass. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220523210712.3641569-7-joannelkoong@gmail.com commit 34d4ef5775f776ec4b0d53a02d588bf3195cada6 Author: Joanne Koong Date: Mon May 23 14:07:11 2022 -0700 bpf: Add dynptr data slices This patch adds a new helper function void *bpf_dynptr_data(struct bpf_dynptr *ptr, u32 offset, u32 len); which returns a pointer to the underlying data of a dynptr. *len* must be a statically known value. The bpf program may access the returned data slice as a normal buffer (eg can do direct reads and writes), since the verifier associates the length with the returned pointer, and enforces that no out of bounds accesses occur. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220523210712.3641569-6-joannelkoong@gmail.com commit 13bbbfbea7598ea9f8d9c3d73bf053bb57f9c4b2 Author: Joanne Koong Date: Mon May 23 14:07:10 2022 -0700 bpf: Add bpf_dynptr_read and bpf_dynptr_write This patch adds two helper functions, bpf_dynptr_read and bpf_dynptr_write: long bpf_dynptr_read(void *dst, u32 len, struct bpf_dynptr *src, u32 offset); long bpf_dynptr_write(struct bpf_dynptr *dst, u32 offset, void *src, u32 len); The dynptr passed into these functions must be valid dynptrs that have been initialized. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220523210712.3641569-5-joannelkoong@gmail.com commit bc34dee65a65e9c920c420005b8a43f2a721a458 Author: Joanne Koong Date: Mon May 23 14:07:09 2022 -0700 bpf: Dynptr support for ring buffers Currently, our only way of writing dynamically-sized data into a ring buffer is through bpf_ringbuf_output but this incurs an extra memcpy cost. bpf_ringbuf_reserve + bpf_ringbuf_commit avoids this extra memcpy, but it can only safely support reservation sizes that are statically known since the verifier cannot guarantee that the bpf program won’t access memory outside the reserved space. The bpf_dynptr abstraction allows for dynamically-sized ring buffer reservations without the extra memcpy. There are 3 new APIs: long bpf_ringbuf_reserve_dynptr(void *ringbuf, u32 size, u64 flags, struct bpf_dynptr *ptr); void bpf_ringbuf_submit_dynptr(struct bpf_dynptr *ptr, u64 flags); void bpf_ringbuf_discard_dynptr(struct bpf_dynptr *ptr, u64 flags); These closely follow the functionalities of the original ringbuf APIs. For example, all ringbuffer dynptrs that have been reserved must be either submitted or discarded before the program exits. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Acked-by: David Vernet Link: https://lore.kernel.org/bpf/20220523210712.3641569-4-joannelkoong@gmail.com commit 263ae152e96253f40c2c276faad8629e096b3bad Author: Joanne Koong Date: Mon May 23 14:07:08 2022 -0700 bpf: Add bpf_dynptr_from_mem for local dynptrs This patch adds a new api bpf_dynptr_from_mem: long bpf_dynptr_from_mem(void *data, u32 size, u64 flags, struct bpf_dynptr *ptr); which initializes a dynptr to point to a bpf program's local memory. For now only local memory that is of reg type PTR_TO_MAP_VALUE is supported. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220523210712.3641569-3-joannelkoong@gmail.com commit 97e03f521050c092919591e668107b3d69c5f426 Author: Joanne Koong Date: Mon May 23 14:07:07 2022 -0700 bpf: Add verifier support for dynptrs This patch adds the bulk of the verifier work for supporting dynamic pointers (dynptrs) in bpf. A bpf_dynptr is opaque to the bpf program. It is a 16-byte structure defined internally as: struct bpf_dynptr_kern { void *data; u32 size; u32 offset; } __aligned(8); The upper 8 bits of *size* is reserved (it contains extra metadata about read-only status and dynptr type). Consequently, a dynptr only supports memory less than 16 MB. There are different types of dynptrs (eg malloc, ringbuf, ...). In this patchset, the most basic one, dynptrs to a bpf program's local memory, is added. For now only local memory that is of reg type PTR_TO_MAP_VALUE is supported. In the verifier, dynptr state information will be tracked in stack slots. When the program passes in an uninitialized dynptr (ARG_PTR_TO_DYNPTR | MEM_UNINIT), the stack slots corresponding to the frame pointer where the dynptr resides at are marked STACK_DYNPTR. For helper functions that take in initialized dynptrs (eg bpf_dynptr_read + bpf_dynptr_write which are added later in this patchset), the verifier enforces that the dynptr has been initialized properly by checking that their corresponding stack slots have been marked as STACK_DYNPTR. The 6th patch in this patchset adds test cases that the verifier should successfully reject, such as for example attempting to use a dynptr after doing a direct write into it inside the bpf program. Signed-off-by: Joanne Koong Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Acked-by: David Vernet Link: https://lore.kernel.org/bpf/20220523210712.3641569-2-joannelkoong@gmail.com commit 1ec5ee8c8a5a65ea377f8bea64bf4d5b743f6f79 Author: Kumar Kartikeya Dwivedi Date: Sat May 21 18:56:20 2022 +0530 bpf: Suppress 'passing zero to PTR_ERR' warning Kernel Test Robot complains about passing zero to PTR_ERR for the said line, suppress it by using PTR_ERR_OR_ZERO. Fixes: c0a5a21c25f3 ("bpf: Allow storing referenced kptr in map") Reported-by: kernel test robot Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220521132620.1976921-1-memxor@gmail.com commit 8a32f81a89cf3b0b0e1cc626f7f7777f62adf99d Merge: 5dc921868c507 71abb4df29815 Author: Linus Torvalds Date: Mon May 23 14:14:50 2022 -0700 Merge tag 'ata-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata updates from Damien Le Moal: "For this cycle, the libata.force kernel parameter changes stand out. Beside that, some small cleanups in various drivers. In more detail: - Changes to the pata_mpc52xx driver in preparation for powerpc's asm/prom.h cleanup, from Christophe. - Improved ATA command allocation, from John. - Various small cleanups to the pata_via, pata_sil680, pata_ftide010, sata_gemini, ahci_brcm drivers and to libata-core, from Sergey, Diego, Ruyi, Mighao and Jiabing. - Add support for the RZ/G2H SoC to the rcar-sata driver, from Lad. - AHCI RAID ID cleanup, from Dan. - Improvement to the libata.force kernel parameter to allow most horkage flags to be manually forced for debugging drive issues in the field without needing recompiling a kernel, from me" * tag 'ata-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_ftide010: Remove unneeded ERROR check before clk_disable_unprepare doc: admin-guide: Update libata kernel parameters ata: libata-core: Allow forcing most horkage flags ata: libata-core: Improve link flags forced settings ata: libata-core: Refactor force_tbl definition ata: libata-core: cleanup ata_device_blacklist ata: simplify the return expression of brcm_ahci_remove ata: Make use of the helper function devm_platform_ioremap_resource() ata: libata-core: replace "its" with "it is" ahci: Add a generic 'controller2' RAID id dt-bindings: ata: renesas,rcar-sata: Add r8a774e1 support ata: pata_via: fix sloppy typing in via_do_set_mode() ata: pata_sil680: fix result type of sil680_sel{dev|reg}() ata: libata-core: fix parameter type in ata_xfer_mode2shift() libata: Improve ATA queued command allocation ata: pata_mpc52xx: Prepare cleanup of powerpc's asm/prom.h commit fe736565efb775620dbcf3c459c1cd80d3e868da Author: Song Liu Date: Fri May 20 16:57:53 2022 -0700 bpf: Introduce bpf_arch_text_invalidate for bpf_prog_pack Introduce bpf_arch_text_invalidate and use it to fill unused part of the bpf_prog_pack with illegal instructions when a BPF program is freed. Fixes: 57631054fae6 ("bpf: Introduce bpf_prog_pack allocator") Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]") Reported-by: Linus Torvalds Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220520235758.1858153-4-song@kernel.org commit aadd1b678ebef81cc3ed23663253ae3749cdc673 Author: Song Liu Date: Fri May 20 16:57:52 2022 -0700 x86/alternative: Introduce text_poke_set Introduce a memset like API for text_poke. This will be used to fill the unused RX memory with illegal instructions. Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/bpf/20220520235758.1858153-3-song@kernel.org commit d88bb5eed04ce50cc20e7f9282977841728be798 Author: Song Liu Date: Fri May 20 16:57:51 2022 -0700 bpf: Fill new bpf_prog_pack with illegal instructions bpf_prog_pack enables sharing huge pages among multiple BPF programs. These pages are marked as executable before the JIT engine fill it with BPF programs. To make these pages safe, fill the hole bpf_prog_pack with illegal instructions before making it executable. Fixes: 57631054fae6 ("bpf: Introduce bpf_prog_pack allocator") Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]") Reported-by: Linus Torvalds Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220520235758.1858153-2-song@kernel.org commit 5dc921868c507c1f0835932d3f255cf1b7415618 Merge: 115cd47132d71 537b9f2bf60f4 Author: Linus Torvalds Date: Mon May 23 14:04:14 2022 -0700 Merge tag 'for-5.19/drivers-2022-05-22' of git://git.kernel.dk/linux-block Pull block driver updates from Jens Axboe: "Here are the driver updates queued up for 5.19. This contains: - NVMe pull requests via Christoph: - tighten the PCI presence check (Stefan Roese) - fix a potential NULL pointer dereference in an error path (Kyle Miller Smith) - fix interpretation of the DMRSL field (Tom Yan) - relax the data transfer alignment (Keith Busch) - verbose error logging improvements (Max Gurtovoy, Chaitanya Kulkarni) - misc cleanups (Chaitanya Kulkarni, Christoph) - set non-mdts limits in nvme_scan_work (Chaitanya Kulkarni) - add support for TP4084 - Time-to-Ready Enhancements (Christoph) - MD pull request via Song: - Improve annotation in raid5 code, by Logan Gunthorpe - Support MD_BROKEN flag in raid-1/5/10, by Mariusz Tkaczyk - Other small fixes/cleanups - null_blk series making the configfs side much saner (Damien) - Various minor drbd cleanups and fixes (Haowen, Uladzislau, Jiapeng, Arnd, Cai) - Avoid using the system workqueue (and hence flushing it) in rnbd (Jack) - Avoid using the system workqueue (and hence flushing it) in aoe (Tetsuo) - Series fixing discard_alignment issues in drivers (Christoph) - Small series fixing drivers poking at disk->part0 for openers information (Christoph) - Series fixing deadlocks in loop (Christoph, Tetsuo) - Remove loop.h and add SPDX headers (Christoph) - Various fixes and cleanups (Julia, Xie, Yu)" * tag 'for-5.19/drivers-2022-05-22' of git://git.kernel.dk/linux-block: (72 commits) mtip32xx: fix typo in comment nvme: set non-mdts limits in nvme_scan_work nvme: add support for TP4084 - Time-to-Ready Enhancements nvme: split the enum used for various register constants nbd: Fix hung on disconnect request if socket is closed before nvme-fabrics: add a request timeout helper nvme-pci: harden drive presence detect in nvme_dev_disable() nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags nvme: mark internal passthru request RQF_QUIET nvme: remove unneeded include from constants file nvme: add missing status values to verbose logging nvme: set dma alignment to dword nvme: fix interpretation of DMRSL loop: remove most the top-of-file boilerplate comment from the UAPI header loop: remove most the top-of-file boilerplate comment loop: add a SPDX header loop: remove loop.h block: null_blk: Improve device creation with configfs block: null_blk: Cleanup messages block: null_blk: Cleanup device creation and deletion ... commit 115cd47132d71bd7e4aa1093e15d861a59e73a94 Merge: f6792c877a1ca 2aaf516084184 Author: Linus Torvalds Date: Mon May 23 13:56:39 2022 -0700 Merge tag 'for-5.19/block-2022-05-22' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: "Here are the core block changes for 5.19. This contains: - blk-throttle accounting fix (Laibin) - Series removing redundant assignments (Michal) - Expose bio cache via the bio_set, so that DM can use it (Mike) - Finish off the bio allocation interface cleanups by dealing with the weirdest member of the family. bio_kmalloc combines a kmalloc for the bio and bio_vecs with a hidden bio_init call and magic cleanup semantics (Christoph) - Clean up the block layer API so that APIs consumed by file systems are (almost) only struct block_device based, so that file systems don't have to poke into block layer internals like the request_queue (Christoph) - Clean up the blk_execute_rq* API (Christoph) - Clean up various lose end in the blk-cgroup code to make it easier to follow in preparation of reworking the blkcg assignment for bios (Christoph) - Fix use-after-free issues in BFQ when processes with merged queues get moved to different cgroups (Jan) - BFQ fixes (Jan) - Various fixes and cleanups (Bart, Chengming, Fanjun, Julia, Ming, Wolfgang, me)" * tag 'for-5.19/block-2022-05-22' of git://git.kernel.dk/linux-block: (83 commits) blk-mq: fix typo in comment bfq: Remove bfq_requeue_request_body() bfq: Remove superfluous conversion from RQ_BIC() bfq: Allow current waker to defend against a tentative one bfq: Relax waker detection for shared queues blk-cgroup: delete rcu_read_lock_held() WARN_ON_ONCE() blk-throttle: Set BIO_THROTTLED when bio has been throttled blk-cgroup: Remove unnecessary rcu_read_lock/unlock() blk-cgroup: always terminate io.stat lines block, bfq: make bfq_has_work() more accurate block, bfq: protect 'bfqd->queued' by 'bfqd->lock' block: cleanup the VM accounting in submit_bio block: Fix the bio.bi_opf comment block: reorder the REQ_ flags blk-iocost: combine local_stat and desc_stat to stat block: improve the error message from bio_check_eod block: allow passing a NULL bdev to bio_alloc_clone/bio_init_clone block: remove superfluous calls to blkcg_bio_issue_init kthread: unexport kthread_blkcg blk-cgroup: cleanup blkcg_maybe_throttle_current ... commit f6792c877a1cacc3b3eea7cb5b45857b3c484c51 Merge: df1c5d73d2856 2e10a1d693b9f Author: Linus Torvalds Date: Mon May 23 13:52:14 2022 -0700 Merge tag 'for-5.19/cdrom-2022-05-22' of git://git.kernel.dk/linux-block Pull cdrom updates from Jens Axboe: "Removal of unused code and documentation updates" * tag 'for-5.19/cdrom-2022-05-22' of git://git.kernel.dk/linux-block: cdrom: remove obsolete TODO list block: remove last remaining traces of IDE documentation cdrom: mark CDROMGETSPINDOWN/CDROMSETSPINDOWN obsolete cdrom: remove the unused driver specific disc change ioctl cdrom: make EXPORT_SYMBOL follow exported function commit df1c5d73d2856af0425bdf6f023202e957bd7435 Merge: 9836e93c0a7e0 68f4c6eba70df Author: Linus Torvalds Date: Mon May 23 13:48:23 2022 -0700 Merge tag 'for-5.19/writeback-2022-05-22' of git://git.kernel.dk/linux-block Pull writeback fix from Jens Axboe: "A single writeback fix that didn't belong in any other branch, correcting the number of skipped pages" * tag 'for-5.19/writeback-2022-05-22' of git://git.kernel.dk/linux-block: fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages commit 9836e93c0a7e031ac6a71c56171c229de1eea7cf Merge: e1a8fde7203fa 3fe07bcd800d6 Author: Linus Torvalds Date: Mon May 23 13:06:15 2022 -0700 Merge tag 'for-5.19/io_uring-passthrough-2022-05-22' of git://git.kernel.dk/linux-block Pull io_uring NVMe command passthrough from Jens Axboe: "On top of everything else, this adds support for passthrough for io_uring. The initial feature for this is NVMe passthrough support, which allows non-filesystem based IO commands and admin commands. To support this, io_uring grows support for SQE and CQE members that are twice as big, allowing to pass in a full NVMe command without having to copy data around. And to complete with more than just a single 32-bit value as the output" * tag 'for-5.19/io_uring-passthrough-2022-05-22' of git://git.kernel.dk/linux-block: (22 commits) io_uring: cleanup handling of the two task_work lists nvme: enable uring-passthrough for admin commands nvme: helper for uring-passthrough checks blk-mq: fix passthrough plugging nvme: add vectored-io support for uring-cmd nvme: wire-up uring-cmd support for io-passthru on char-device. nvme: refactor nvme_submit_user_cmd() block: wire-up support for passthrough plugging fs,io_uring: add infrastructure for uring-cmd io_uring: support CQE32 for nop operation io_uring: enable CQE32 io_uring: support CQE32 in /proc info io_uring: add tracing for additional CQE32 fields io_uring: overflow processing for CQE32 io_uring: flush completions for CQE32 io_uring: modify io_get_cqe for CQE32 io_uring: add CQE32 completion processing io_uring: add CQE32 setup processing io_uring: change ring size calculation for CQE32 io_uring: store add. return values for CQE32 ... commit 8f445a3ec3fd36feb90c5b2ef8d21e2492819cdc Author: Marc Kleine-Budde Date: Mon May 23 14:33:44 2022 +0200 can: ctucanfd: platform: add missing dependency to HAS_IOMEM The kernel test robot noticed that the ctucanfd platform driver fails during modpost on platforms that don't support IOMEM. | ERROR: modpost: "devm_ioremap_resource" [drivers/net/can/ctucanfd/ctucanfd_platform.ko] undefined! This patch adds the missing HAS_IOMEM dependency. Link: https://lore.kernel.org/all/20220523123720.1656611-1-mkl@pengutronix.de Fixes: e8f0c23a2415 ("can: ctucanfd: CTU CAN FD open-source IP core - platform/SoC support.") Reported-by: kernel test robot Acked-by: Pavel Pisa Cc: Ondrej Ille Signed-off-by: Marc Kleine-Budde commit 3e88445a3a5afc65929c578fe2ffc03420588993 Author: Jakub Kicinski Date: Fri May 20 12:46:59 2022 -0700 can: kvaser_usb: silence a GCC 12 -Warray-bounds warning This driver does a lot of casting of smaller buffers to struct kvaser_cmd_ext, GCC 12 does not like that: | drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:489:65: warning: array subscript ‘struct kvaser_cmd_ext[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Warray-bounds] | drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:489:23: note: in expansion of macro ‘le16_to_cpu’ | 489 | ret = le16_to_cpu(((struct kvaser_cmd_ext *)cmd)->len); | | ^~~~~~~~~~~ Temporarily silence this warning (move it to W=1 builds). Link: https://lore.kernel.org/all/20220520194659.2356903-1-kuba@kernel.org Signed-off-by: Jakub Kicinski Tested-by: Marc Kleine-Budde Signed-off-by: Marc Kleine-Budde commit a682d18433005f9609be95c46924ddca827122de Author: Julia Lawall Date: Sat May 21 13:10:34 2022 +0200 can: peak_usb: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/all/20220521111145.81697-24-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Marc Kleine-Budde commit f9a3eca4bc0452a7079282d1ad87d65cb3463f0a Author: Colin Ian King Date: Mon May 23 12:56:04 2022 +0100 selftests/bpf: Fix spelling mistake: "unpriviliged" -> "unprivileged" There are spelling mistakes in ASSERT messages. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220523115604.49942-1-colin.i.king@gmail.com commit 4050764cbaa25760aab40857f723393c07898474 Author: Yonghong Song Date: Mon May 23 08:20:44 2022 -0700 selftests/bpf: fix btf_dump/btf_dump due to recent clang change Latest llvm-project upstream had a change of behavior related to qualifiers on function return type ([1]). This caused selftests btf_dump/btf_dump failure. The following example shows what changed. $ cat t.c typedef const char * const (* const (* const fn_ptr_arr2_t[5])())(char * (*)(int)); struct t { int a; fn_ptr_arr2_t l; }; int foo(struct t *arg) { return arg->a; } Compiled with latest upstream llvm15, $ clang -O2 -g -target bpf -S -emit-llvm t.c The related generated debuginfo IR looks like: !16 = !DIDerivedType(tag: DW_TAG_typedef, name: "fn_ptr_arr2_t", file: !1, line: 1, baseType: !17) !17 = !DICompositeType(tag: DW_TAG_array_type, baseType: !18, size: 320, elements: !32) !18 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !19) !19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64) !20 = !DISubroutineType(types: !21) !21 = !{!22, null} !22 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !23, size: 64) !23 = !DISubroutineType(types: !24) !24 = !{!25, !28} !25 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !26, size: 64) !26 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !27) !27 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char) You can see two intermediate const qualifier to pointer are dropped in debuginfo IR. With llvm14, we have following debuginfo IR: !16 = !DIDerivedType(tag: DW_TAG_typedef, name: "fn_ptr_arr2_t", file: !1, line: 1, baseType: !17) !17 = !DICompositeType(tag: DW_TAG_array_type, baseType: !18, size: 320, elements: !34) !18 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !19) !19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64) !20 = !DISubroutineType(types: !21) !21 = !{!22, null} !22 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !23) !23 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !24, size: 64) !24 = !DISubroutineType(types: !25) !25 = !{!26, !30} !26 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !27) !27 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !28, size: 64) !28 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !29) !29 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char) All const qualifiers are preserved. To adapt the selftest to both old and new llvm, this patch removed the intermediate const qualifier in const-to-ptr types, to make the test succeed again. [1] https://reviews.llvm.org/D125919 Reported-by: Mykola Lysenko Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20220523152044.3905809-1-yhs@fb.com Signed-off-by: Alexei Starovoitov commit c9f73a2178c12fb24d2807634209559d6a836e08 Author: Luiz Augusto von Dentz Date: Fri May 20 11:37:13 2022 -0700 Bluetooth: hci_conn: Fix hci_connect_le_sync The handling of connection failures shall be handled by the request completion callback as already done by hci_cs_le_create_conn, also make sure to use hci_conn_failed instead of hci_le_conn_failed as the later don't actually call hci_conn_del to cleanup. Link: https://github.com/bluez/bluez/issues/340 Fixes: 8e8b92ee60de5 ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann commit e1a8fde7203fa8a3e3f35d4f9df47477d23529c1 Merge: 368da430d04db f548a12efd5ab Author: Linus Torvalds Date: Mon May 23 12:51:04 2022 -0700 Merge tag 'for-5.19/io_uring-net-2022-05-22' of git://git.kernel.dk/linux-block Pull io_uring 'more data in socket' support from Jens Axboe: "To be able to fully utilize the 'poll first' support in the core io_uring branch, it's advantageous knowing if the socket was empty after a receive. This adds support for that" * tag 'for-5.19/io_uring-net-2022-05-22' of git://git.kernel.dk/linux-block: io_uring: return hint on whether more data is available after receive tcp: pass back data left in socket after receive commit bca1a1004615efe141fd78f360ecc48c60bc4ad5 Author: Björn Ardö Date: Thu Mar 31 09:01:15 2022 +0200 mailbox: forward the hrtimer if not queued and under a lock This reverts commit c7dacf5b0f32957b24ef29df1207dc2cd8307743, "mailbox: avoid timer start from callback" The previous commit was reverted since it lead to a race that caused the hrtimer to not be started at all. The check for hrtimer_active() in msg_submit() will return true if the callback function txdone_hrtimer() is currently running. This function could return HRTIMER_NORESTART and then the timer will not be restarted, and also msg_submit() will not start the timer. This will lead to a message actually being submitted but no timer will start to check for its compleation. The original fix that added checking hrtimer_active() was added to avoid a warning with hrtimer_forward. Looking in the kernel another solution to avoid this warning is to check hrtimer_is_queued() before calling hrtimer_forward_now() instead. This however requires a lock so the timer is not started by msg_submit() inbetween this check and the hrtimer_forward() call. Fixes: c7dacf5b0f32 ("mailbox: avoid timer start from callback") Signed-off-by: Björn Ardö Signed-off-by: Jassi Brar commit 368da430d04dbe31aded44e5f5c255ff0899ad1d Merge: 09beaff75e4c4 033b87d24f725 Author: Linus Torvalds Date: Mon May 23 12:42:33 2022 -0700 Merge tag 'for-5.19/io_uring-socket-2022-05-22' of git://git.kernel.dk/linux-block Pull io_uring socket() support from Jens Axboe: "This adds support for socket(2) for io_uring. This is handy when using direct / registered file descriptors with io_uring. Outside of those two patches, a small series from Dylan on top that improves the tracing by providing a text representation of the opcode rather than needing to decode this by reading the header file every time. That sits in this branch as it was the last opcode added (until it wasn't...)" * tag 'for-5.19/io_uring-socket-2022-05-22' of git://git.kernel.dk/linux-block: io_uring: use the text representation of ops in trace io_uring: rename op -> opcode io_uring: add io_uring_get_opcode io_uring: add type to op enum io_uring: add socket(2) support net: add __sys_socket_file() commit 09beaff75e4c4cee590b0e547c7587ff6cadb5db Merge: 3a166bdbf3abc 4ffaa94b9c047 Author: Linus Torvalds Date: Mon May 23 12:30:30 2022 -0700 Merge tag 'for-5.19/io_uring-xattr-2022-05-22' of git://git.kernel.dk/linux-block Pull io_uring xattr support from Jens Axboe: "Support for the xattr variants" * tag 'for-5.19/io_uring-xattr-2022-05-22' of git://git.kernel.dk/linux-block: io_uring: cleanup error-handling around io_req_complete io_uring: fix trace for reduced sqe padding io_uring: add fgetxattr and getxattr support io_uring: add fsetxattr and setxattr support fs: split off do_getxattr from getxattr fs: split off setxattr_copy and do_setxattr function from setxattr commit 3a166bdbf3abc8ca2d7ffe7cffc5c7a65f260e62 Merge: 1e57930e9f408 0e7579ca732a3 Author: Linus Torvalds Date: Mon May 23 12:22:49 2022 -0700 Merge tag 'for-5.19/io_uring-2022-05-22' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: "Here are the main io_uring changes for 5.19. This contains: - Fixes for sparse type warnings (Christoph, Vasily) - Support for multi-shot accept (Hao) - Support for io_uring managed fixed files, rather than always needing the applicationt o manage the indices (me) - Fix for a spurious poll wakeup (Dylan) - CQE overflow fixes (Dylan) - Support more types of cancelations (me) - Support for co-operative task_work signaling, rather than always forcing an IPI (me) - Support for doing poll first when appropriate, rather than always attempting a transfer first (me) - Provided buffer cleanups and support for mapped buffers (me) - Improve how io_uring handles inflight SCM files (Pavel) - Speedups for registered files (Pavel, me) - Organize the completion data in a struct in io_kiocb rather than keep it in separate spots (Pavel) - task_work improvements (Pavel) - Cleanup and optimize the submission path, in general and for handling links (Pavel) - Speedups for registered resource handling (Pavel) - Support sparse buffers and file maps (Pavel, me) - Various fixes and cleanups (Almog, Pavel, me)" * tag 'for-5.19/io_uring-2022-05-22' of git://git.kernel.dk/linux-block: (111 commits) io_uring: fix incorrect __kernel_rwf_t cast io_uring: disallow mixed provided buffer group registrations io_uring: initialize io_buffer_list head when shared ring is unregistered io_uring: add fully sparse buffer registration io_uring: use rcu_dereference in io_close io_uring: consistently use the EPOLL* defines io_uring: make apoll_events a __poll_t io_uring: drop a spurious inline on a forward declaration io_uring: don't use ERR_PTR for user pointers io_uring: use a rwf_t for io_rw.flags io_uring: add support for ring mapped supplied buffers io_uring: add io_pin_pages() helper io_uring: add buffer selection support to IORING_OP_NOP io_uring: fix locking state for empty buffer group io_uring: implement multishot mode for accept io_uring: let fast poll support multishot io_uring: add REQ_F_APOLL_MULTISHOT for requests io_uring: add IORING_ACCEPT_MULTISHOT for accept io_uring: only wake when the correct events are set io_uring: avoid io-wq -EAGAIN looping for !IOPOLL ... commit fd5e363eac77ef81542db77ddad0559fa0f9204e Author: Julian Schroeder Date: Mon May 23 18:52:26 2022 +0000 nfsd: destroy percpu stats counters after reply cache shutdown Upon nfsd shutdown any pending DRC cache is freed. DRC cache use is tracked via a percpu counter. In the current code the percpu counter is destroyed before. If any pending cache is still present, percpu_counter_add is called with a percpu counter==NULL. This causes a kernel crash. The solution is to destroy the percpu counter after the cache is freed. Fixes: e567b98ce9a4b (“nfsd: protect concurrent access to nfsd stats counters”) Signed-off-by: Julian Schroeder Signed-off-by: Chuck Lever commit 1e57930e9f4083ad5854ab6eadffe790a8167fb4 Merge: b2f02e9cdaade ce13389053a34 Author: Linus Torvalds Date: Mon May 23 11:46:51 2022 -0700 Merge tag 'rcu.2022.05.19a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU update from Paul McKenney: - Documentation updates - Miscellaneous fixes - Callback-offloading updates, mainly simplifications - RCU-tasks updates, including some -rt fixups, handling of systems with sparse CPU numbering, and a fix for a boot-time race-condition failure - Put SRCU on a memory diet in order to reduce the size of the srcu_struct structure - Torture-test updates fixing some bugs in tests and closing some testing holes - Torture-test updates for the RCU tasks flavors, most notably ensuring that building rcutorture and friends does not change the RCU-tasks-related Kconfig options - Torture-test scripting updates - Expedited grace-period updates, most notably providing milliseconds-scale (not all that) soft real-time response from synchronize_rcu_expedited(). This is also the first time in almost 30 years of RCU that someone other than me has pushed for a reduction in the RCU CPU stall-warning timeout, in this case by more than three orders of magnitude from 21 seconds to 20 milliseconds. This tighter timeout applies only to expedited grace periods * tag 'rcu.2022.05.19a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (80 commits) rcu: Move expedited grace period (GP) work to RT kthread_worker rcu: Introduce CONFIG_RCU_EXP_CPU_STALL_TIMEOUT srcu: Drop needless initialization of sdp in srcu_gp_start() srcu: Prevent expedited GPs and blocking readers from consuming CPU srcu: Add contention check to call_srcu() srcu_data ->lock acquisition srcu: Automatically determine size-transition strategy at boot rcutorture: Make torture.sh allow for --kasan rcutorture: Make torture.sh refscale and rcuscale specify Tasks Trace RCU rcutorture: Make kvm.sh allow more memory for --kasan runs torture: Save "make allmodconfig" .config file scftorture: Remove extraneous "scf" from per_version_boot_params rcutorture: Adjust scenarios' Kconfig options for CONFIG_PREEMPT_DYNAMIC torture: Enable CSD-lock stall reports for scftorture torture: Skip vmlinux check for kvm-again.sh runs scftorture: Adjust for TASKS_RCU Kconfig option being selected rcuscale: Allow rcuscale without RCU Tasks Rude/Trace rcuscale: Allow rcuscale without RCU Tasks refscale: Allow refscale without RCU Tasks Rude/Trace refscale: Allow refscale without RCU Tasks rcutorture: Allow specifying per-scenario stat_interval ... commit b2f02e9cdaade3ce565e6973ac313d2f814447f2 Merge: f814957b018c8 5b759db44195b Author: Linus Torvalds Date: Mon May 23 11:43:44 2022 -0700 Merge tag 'lkmm.2022.05.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull LKMM update from Paul McKenney: "This updates the klitmus7 compatibility table to indicate that herdtools7 7.56.1 or better is required for Linux kernel v5.17 or later" * tag 'lkmm.2022.05.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools/memory-model/README: Update klitmus7 compat table commit f814957b018c867a2397bdd3c1816de7502d2c7f Merge: bf2431021c8cf 11dbdaeff41d9 Author: Linus Torvalds Date: Mon May 23 11:33:25 2022 -0700 Merge tag 'nolibc.2022.05.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc library updates from Paul McKenney: "This adds a number of library functions and splits this library into multiple files" * tag 'nolibc.2022.05.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (61 commits) tools/nolibc/string: Implement `strdup()` and `strndup()` tools/nolibc/string: Implement `strnlen()` tools/nolibc/stdlib: Implement `malloc()`, `calloc()`, `realloc()` and `free()` tools/nolibc/types: Implement `offsetof()` and `container_of()` macro tools/nolibc/sys: Implement `mmap()` and `munmap()` tools/nolibc: i386: Implement syscall with 6 arguments tools/nolibc: Remove .global _start from the entry point code tools/nolibc: Replace `asm` with `__asm__` tools/nolibc: x86-64: Update System V ABI document link tools/nolibc/stdlib: only reference the external environ when inlined tools/nolibc/string: do not use __builtin_strlen() at -O0 tools/nolibc: add the nolibc subdir to the common Makefile tools/nolibc: add a makefile to install headers tools/nolibc/types: add poll() and waitpid() flag definitions tools/nolibc/sys: add syscall definition for getppid() tools/nolibc/string: add strcmp() and strncmp() tools/nolibc/stdio: add support for '%p' to vfprintf() tools/nolibc/stdlib: add a simple getenv() implementation tools/nolibc/stdio: make printf(%s) accept NULL tools/nolibc/stdlib: implement abort() ... commit bbb544f3349197d1e7f4f9b921b75e919cd45f39 Merge: 388292df27810 7acc8a2ac0c0a bd30d075eedce b947769b8f778 Author: Rafael J. Wysocki Date: Mon May 23 20:32:58 2022 +0200 Merge branches 'thermal-int340x', 'thermal-pch' and 'thermal-misc' Merge int340x thermal driver updates, PCH thermal driver updates and miscellaneous thermal control updates for 5.19-rc1: - Clean up _OSC handling in int340x (Davidlohr Bueso). - Improve overheat condition handling during suspend-to-idle in the Intel PCH thermal driver (Zhang Rui). - Use local ops instead of global ops in devfreq_cooling (Kant Fan). - Switch hisi_termal from CONFIG_PM_SLEEP guards to pm_sleep_ptr() (Hesham Almatary) * thermal-int340x: thermal: int340x: Clean up _OSC context init thermal: int340x: Consolidate freeing of acpi_buffer pointer thermal: int340x: Clean up unnecessary acpi_buffer pointer freeing * thermal-pch: thermal: intel: pch: improve the cooling delay log thermal: intel: pch: enhance overheat handling thermal: intel: pch: move cooling delay to suspend_noirq phase PM: wakeup: expose pm_wakeup_pending to modules * thermal-misc: thermal: devfreq_cooling: use local ops instead of global ops thermal: hisi_termal: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr() commit 388292df27810a01c3f459533578255bbba4a4de Merge: 5a66bfb27748d c23b7517fe623 Author: Rafael J. Wysocki Date: Mon May 23 20:31:57 2022 +0200 Merge back earlier thermal control updates for 5.19-rc1. commit bf2431021c8cfe52c866d7bf640ced03a35ebe91 Merge: 4b0986a3613c9 3f68e69520d3d Author: Linus Torvalds Date: Mon May 23 11:27:24 2022 -0700 Merge tag 'efi-next-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Allow runtime services to be re-enabled at boot on RT kernels. - Provide access to secrets injected into the boot image by CoCo hypervisors (COnfidential COmputing) - Use DXE services on x86 to make the boot image executable after relocation, if needed. - Prefer mirrored memory for randomized allocations. - Only randomize the placement of the kernel image on arm64 if the loader has not already done so. - Add support for obtaining the boot hartid from EFI on RISC-V. * tag 'efi-next-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: riscv/efi_stub: Add support for RISCV_EFI_BOOT_PROTOCOL efi: stub: prefer mirrored memory for randomized allocations efi/arm64: libstub: run image in place if randomized by the loader efi: libstub: pass image handle to handle_kernel_image() efi: x86: Set the NX-compatibility flag in the PE header efi: libstub: ensure allocated memory to be executable efi: libstub: declare DXE services table efi: Add missing prototype for efi_capsule_setup_info docs: security: Add secrets/coco documentation efi: Register efi_secret platform device if EFI secret area is declared virt: Add efi_secret module to expose confidential computing secrets efi: Save location of EFI confidential computing area efi: Allow to enable EFI runtime services by default on RT commit ff2095976ca83d01f4297417fec89f6a1549a5a9 Author: Julia Lawall Date: Sat May 21 13:11:34 2022 +0200 s390/bpf: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Andrii Nakryiko Acked-by: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20220521111145.81697-84-Julia.Lawall@inria.fr commit bb412cf1d712656f27b2a08c492ed9d7591485aa Author: Julia Lawall Date: Sat May 21 13:11:21 2022 +0200 libbpf: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Andrii Nakryiko Acked-by: Daniel Müller Link: https://lore.kernel.org/bpf/20220521111145.81697-71-Julia.Lawall@inria.fr commit df7e7f2ba0781528e63f04b108819a4ab9889c72 Merge: 537b9f2bf60f4 42b805af10247 Author: Jens Axboe Date: Mon May 23 12:18:55 2022 -0600 Merge branch 'md-next' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-5.19/drivers Pull MD updates from Song: "- Remove uses of bdevname, by Christoph Hellwig; - Bug fixes by Guoqing Jiang, and Xiao Ni." * 'md-next' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix double free of io_acct_set bioset md: Don't set mddev private to NULL in raid0 pers->free md: remove most calls to bdevname md: protect md_unregister_thread from reentrancy md: don't unregister sync_thread with reconfig_mutex held commit eaff451d4b7c86e3db3c03611426f5ce1d3826fd Author: Michal Orzel Date: Thu Mar 31 19:33:58 2022 +0200 smack: Remove redundant assignments Get rid of redundant assignments which end up in values not being read either because they are overwritten or the function ends. Reported by clang-tidy [deadcode.DeadStores] Signed-off-by: Michal Orzel Signed-off-by: Casey Schaufler commit 0d64482bf29917e659c556aa36cea241b17c33df Merge: cd8198a2c15c5 9765fa25662ae Author: Rafael J. Wysocki Date: Mon May 23 19:59:06 2022 +0200 Merge branch 'pm-tools' Merge power management tools updates for 5.19-rc1: - Update turbostat to version 2022.04.16 including the following changes: * No build warnings with -Wextra (Len Brown). * Tweak --show and --hide capability (Len Brown). * Be more useful as non-root (Len Brown). * Fix ICX DRAM power numbers (Len Brown). * Fix dump for AMD cpus (Dan Merillat). * Add Power Limit4 support (Sumeet Pawnikar). * Print power values upto three decimal (Sumeet Pawnikar). * Allow -e for all names (Zephaniah E. Loss-Cutler-Hull). * Allow printing header every N iterations (Zephaniah E. Loss-Cutler-Hull). * Support thermal throttle count print (Chen Yu). * pm-tools: tools/power turbostat: version 2022.04.16 tools/power turbostat: No build warnings with -Wextra tools/power turbostat: be more useful as non-root tools/power turbostat: fix ICX DRAM power numbers tools/power turbostat: Support thermal throttle count print tools/power turbostat: Allow printing header every N iterations tools/power turbostat: Allow -e for all names. tools/power turbostat: print power values upto three decimal tools/power turbostat: Add Power Limit4 support tools/power turbostat: fix dump for AMD cpus tools/power turbostat: tweak --show and --hide capability commit cd8198a2c15c58d0e526e4106cbea3f8095fbb71 Merge: d988c9134221a b2a92f354c5a9 Author: Rafael J. Wysocki Date: Mon May 23 19:51:31 2022 +0200 Merge branch 'pm-domains' Merge generlic power domains update for 5.19-rc1: - Extend dev_pm_domain_detach() doc (Krzysztof Kozlowski). - Move genpd's time-accounting to ktime_get_mono_fast_ns() (Ulf Hansson). - Improve the way genpd deals with its governors (Ulf Hansson). * pm-domains: PM: domains: Trust domain-idle-states from DT to be correct by genpd PM: domains: Measure power-on/off latencies in genpd based on a governor PM: domains: Allocate governor data dynamically based on a genpd governor PM: domains: Clean up some code in pm_genpd_init() and genpd_remove() PM: domains: Fix initialization of genpd's next_wakeup PM: domains: Fixup QoS latency measurements for IRQ safe devices in genpd PM: domains: Measure suspend/resume latencies in genpd based on governor PM: domains: Move the next_wakeup variable into the struct gpd_timing_data PM: domains: Allocate gpd_timing_data dynamically based on governor PM: domains: Skip another warning in irq_safe_dev_in_sleep_domain() PM: domains: Rename irq_safe_dev_in_no_sleep_domain() in genpd PM: domains: Don't check PM_QOS_FLAG_NO_POWER_OFF in genpd PM: domains: Drop redundant code for genpd always-on governor PM: domains: Add GENPD_FLAG_RPM_ALWAYS_ON for the always-on governor PM: domains: Move genpd's time-accounting to ktime_get_mono_fast_ns() PM: domains: Extend dev_pm_domain_detach() doc commit 803a1f7272797faa15a7879cdc70f9adaf3fdcba Author: Syed Saba kareem Date: Mon May 23 16:59:53 2022 +0530 ASoC: SOF: amd: Fixed Build error Add linux/module.h in acp-pci.c to solve the below dependency All error/warnings (new ones prefixed by >>): >> sound/soc/amd/acp/acp-pci.c:148:1: warning: data definition has no type or storage class 148 | MODULE_DEVICE_TABLE(pci, acp_pci_ids); | ^~~~~~~~~~~~~~~~~~~ >> sound/soc/amd/acp/acp-pci.c:148:1: error: type defaults to 'int' in declaration of 'MODULE_DEVICE_TABLE' [-Werror=implicit-int] ... Reported-by: kernel test robot Signed-off-by: Syed Saba Kareem Link: https://lore.kernel.org/r/20220523112956.3087604-1-ssabakar@amd.com Signed-off-by: Mark Brown commit 759820c92a346dd18daaa8873f5cabe731d8a31c Author: Julia Lawall Date: Sat May 21 13:11:43 2022 +0200 f2fs: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d988c9134221af08908e4e3941952259b4207ce8 Merge: 16a23f394dd92 2d41dc23804d0 Author: Rafael J. Wysocki Date: Mon May 23 19:28:41 2022 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 5.19-rc1: - Fix cpufreq governor clean up code to avoid using kfree() directly to free kobject-based items (Kevin Hao). - Prepare cpufreq for powerpc's asm/prom.h cleanup (Christophe Leroy). - Make intel_pstate notify frequency invariance code when no_turbo is turned on and off (Chen Yu). - Add Sapphire Rapids OOB mode support to intel_pstate (Srinivas Pandruvada). - Make cpufreq avoid unnecessary frequency updates due to mismatch between hardware and the frequency table (Viresh Kumar). - Make remove_cpu_dev_symlink() clear the real_cpus mask to simplify code (Viresh Kumar). - Rearrange cpufreq_offline() and cpufreq_remove_dev() to make the calling convention for some driver callbacks consistent (Rafael Wysocki). - Avoid accessing half-initialized cpufreq policies from the show() and store() sysfs functions (Schspa Shi). - Rearrange cpufreq_offline() to make the calling convention for some driver callbacks consistent (Schspa Shi). - Update CPPC handling in cpufreq (Pierre Gondois): * Add per_cpu efficiency_class to the CPPC driver. * Make the CPPC driver Register EM based on efficiency class information. * Adjust _OSC for flexible address space in the ACPI platform initialization code and always set CPPC _OSC bits if CPPC_LIB is supported. * Assume no transition latency if no PCCT in the CPPC driver. * Add fast_switch and dvfs_possible_from_any_cpu support to the CPPC driver. * pm-cpufreq: cpufreq: CPPC: Enable dvfs_possible_from_any_cpu cpufreq: CPPC: Enable fast_switch ACPI: CPPC: Assume no transition latency if no PCCT ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported ACPI: CPPC: Check _OSC for flexible address space cpufreq: make interface functions and lock holding state clear cpufreq: Abort show()/store() for half-initialized policies cpufreq: Rearrange locking in cpufreq_remove_dev() cpufreq: Split cpufreq_offline() cpufreq: Reorganize checks in cpufreq_offline() cpufreq: Clear real_cpus mask from remove_cpu_dev_symlink() cpufreq: intel_pstate: Support Sapphire Rapids OOB mode Revert "cpufreq: Fix possible race in cpufreq online error path" cpufreq: CPPC: Register EM based on efficiency class information cpufreq: CPPC: Add per_cpu efficiency_class cpufreq: Avoid unnecessary frequency updates due to mismatch cpufreq: Fix possible race in cpufreq online error path cpufreq: intel_pstate: Handle no_turbo in frequency invariance cpufreq: Prepare cleanup of powerpc's asm/prom.h cpufreq: governor: Use kobject release() method to free dbs_data commit 03e053b4f717c0d893881fe8e4ca8d9ae2f035f2 Author: Dmitry Baryshkov Date: Sat May 21 03:53:38 2022 +0300 Revert "clk: qcom: regmap-mux: add pipe clk implementation" Johan Hovold has pointed out that there are several deficiencies and a race condition in the regmap_mux_safe ops that were merged. Pipe clocks has been updated to use newer and simpler clk_regmap_phy_mux_ops. Drop the regmap-mux-safe clock ops now. Signed-off-by: Dmitry Baryshkov Reviewed-by: Johan Hovold Tested-by: Reviewed-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220521005343.1429642-4-dmitry.baryshkov@linaro.org commit 720e14f3281731e3f606f65bbee32f95d2cd3f64 Author: Dmitry Baryshkov Date: Sat May 21 03:53:37 2022 +0300 Revert "clk: qcom: gcc-sc7280: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" Johan Hovold has pointed out that there are several deficiencies and a race condition in the regmap_mux_safe ops that were merged. Revert the commit that switches gcc-sc7280 driver to use regmap_mux_safe. Signed-off-by: Dmitry Baryshkov Reviewed-by: Johan Hovold Tested-by: Reviewed-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220521005343.1429642-3-dmitry.baryshkov@linaro.org commit dd6456e6c4d8e384226a2f6d87801db15eeb24b0 Author: Dmitry Baryshkov Date: Sat May 21 03:53:36 2022 +0300 Revert "clk: qcom: gcc-sm8450: use new clk_regmap_mux_safe_ops for PCIe pipe clocks" Johan Hovold has pointed out that there are several deficiencies and a race condition in the regmap_mux_safe ops that were merged. Revert the commit that switches gcc-sm8450 driver to use regmap_mux_safe. Signed-off-by: Dmitry Baryshkov Reviewed-by: Johan Hovold Tested-by: Reviewed-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220521005343.1429642-2-dmitry.baryshkov@linaro.org commit 16a23f394dd926c35d44ae420a76ac12c9203f96 Merge: 95f2ce548a2d0 c9d8923bfbcb6 a6653fb584b5f Author: Rafael J. Wysocki Date: Mon May 23 19:18:51 2022 +0200 Merge branches 'pm-em' and 'pm-cpuidle' Marge Energy Model support updates and cpuidle updates for 5.19-rc1: - Update the Energy Model support code to allow the Energy Model to be artificial, which means that the power values may not be on a uniform scale with other devices providing power information, and update the cpufreq_cooling and devfreq_cooling thermal drivers to support artificial Energy Models (Lukasz Luba). - Make DTPM check the Energy Model type (Lukasz Luba). - Fix policy counter decrementation in cpufreq if Energy Model is in use (Pierre Gondois). - Add AlderLake processor support to the intel_idle driver (Zhang Rui). - Fix regression leading to no genpd governor in the PSCI cpuidle driver and fix the riscv-sbi cpuidle driver to allow a genpd governor to be used (Ulf Hansson). * pm-em: PM: EM: Decrement policy counter powercap: DTPM: Check for Energy Model type thermal: cooling: Check Energy Model type in cpufreq_cooling and devfreq_cooling Documentation: EM: Add artificial EM registration description PM: EM: Remove old debugfs files and print all 'flags' PM: EM: Change the order of arguments in the .active_power() callback PM: EM: Use the new .get_cost() callback while registering EM PM: EM: Add artificial EM flag PM: EM: Add .get_cost() callback * pm-cpuidle: cpuidle: riscv-sbi: Fix code to allow a genpd governor to be used cpuidle: psci: Fix regression leading to no genpd governor intel_idle: Add AlderLake support commit 95f2ce548a2d0ad7add02394814136f52ba14b06 Merge: 42d2607d91c4e 82586a721595f 171b66e2e2e9d 59cafa728c373 Author: Rafael J. Wysocki Date: Mon May 23 19:06:33 2022 +0200 Merge branches 'pm-core', 'pm-sleep' and 'powercap' Merge PM core changes, updates related to system sleep and power capping updates for 5.19-rc1: - Export dev_pm_ops instead of suspend() and resume() in the IIO chemical scd30 driver (Jonathan Cameron). - Add namespace variants of EXPORT[_GPL]_SIMPLE_DEV_PM_OPS and PM-runtime counterparts (Jonathan Cameron). - Move symbol exports in the IIO chemical scd30 driver into the IIO_SCD30 namespace (Jonathan Cameron). - Avoid device PM-runtime usage count underflows (Rafael Wysocki). - Allow dynamic debug to control printing of PM messages (David Cohen). - Fix some kernel-doc comments in hibernation code (Yang Li, Haowen Bai). - Preserve ACPI-table override during hibernation (Amadeusz Sławiński). - Improve support for suspend-to-RAM for PSCI OSI mode (Ulf Hansson). - Make Intel RAPL power capping driver support the RaptorLake and AlderLake N processors (Zhang Rui, Sumeet Pawnikar). - Remove redundant store to value after multiply in the RAPL power capping driver (Colin Ian King). * pm-core: PM: runtime: Avoid device usage count underflows iio: chemical: scd30: Move symbol exports into IIO_SCD30 namespace PM: core: Add NS varients of EXPORT[_GPL]_SIMPLE_DEV_PM_OPS and runtime pm equiv iio: chemical: scd30: Export dev_pm_ops instead of suspend() and resume() * pm-sleep: cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode PM: runtime: Allow to call __pm_runtime_set_status() from atomic context PM: hibernate: Don't mark comment as kernel-doc x86/ACPI: Preserve ACPI-table override during hibernation PM: hibernate: Fix some kernel-doc comments PM: sleep: enable dynamic debug support within pm_pr_dbg() PM: sleep: Narrow down -DDEBUG on kernel/power/ files * powercap: powercap: intel_rapl: remove redundant store to value after multiply powercap: intel_rapl: add support for ALDERLAKE_N powercap: RAPL: Add Power Limit4 support for RaptorLake powercap: intel_rapl: add support for RaptorLake commit 4e71ed985389ce213003927cfa65c1352e70396c Author: Rob Herring Date: Thu May 19 16:14:11 2022 -0500 dt-bindings: Fix properties without any type Now that the schema tools can extract type information for all properties (in order to decode dtb files), finding properties missing any type definition is fairly trivial though not yet automated. Fix the various property schemas which are missing a type. Most of these tend to be device specific properties which don't have a vendor prefix. A vendor prefix is how we normally ensure a type is defined. Signed-off-by: Rob Herring Acked-by: Sam Ravnborg # for everything in .../bindings/display/ Acked-by: Mark Brown Acked-by: Peter Rosin Acked-by: Bartosz Golaszewski Acked-by: Sebastian Reichel Link: https://lore.kernel.org/r/20220519211411.2200720-1-robh@kernel.org commit c490513c818d1ec61aff1614f5d0e38de680665f Author: Jason Gunthorpe Date: Thu May 19 20:14:01 2022 -0300 vfio/pci: Add driver_managed_dma to the new vfio_pci drivers When the iommu series adding driver_managed_dma was rebased it missed that new VFIO drivers were added and did not update them too. Without this vfio will claim the groups are not viable. Add driver_managed_dma to mlx5 and hisi. Fixes: 70693f470848 ("vfio: Set DMA ownership for VFIO devices") Reported-by: Yishai Hadas Signed-off-by: Jason Gunthorpe Tested-by: Shameer Kolothum Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/0-v1-f9dfa642fab0+2b3-vfio_managed_dma_jgg@nvidia.com Signed-off-by: Alex Williamson commit 5db9ce20951c8163ee3d505b81d458c83155e311 Merge: 4aa8c70cb076f ab59c89396c00 42e5ed0618030 24773e6c7a27b e802ca757b29e Author: Rafael J. Wysocki Date: Mon May 23 18:44:27 2022 +0200 Merge branches 'acpi-apei', 'acpi-dptf', 'acpi-x86' and 'acpi-docs' Merge APEI material, changes related to DPTF, ACPI-related x86 cleanup and documentation improvement for 5.19-rc1: - Fix missing ERST record ID in the APEI code (Liu Xinpeng). - Make APEI error injection to refuse to inject into the zero page (Tony Luck). - Correct description of INT3407 / INT3532 DPTF attributes in sysfs (Sumeet Pawnikar). - Add support for high frequency impedance notification to the DPTF driver (Sumeet Pawnikar). - Make mp_config_acpi_gsi() a void function (Li kunyu). - Unify Package () representation for properties in the ACPI device properties documentation (Andy Shevchenko). * acpi-apei: ACPI, APEI, EINJ: Refuse to inject into the zero page ACPI: APEI: Fix missing ERST record id * acpi-dptf: ACPI: DPTF: Add support for high frequency impedance notification ACPI: DPTF: Correct description of INT3407 / INT3532 attributes * acpi-x86: x86: ACPI: Make mp_config_acpi_gsi() a void function * acpi-docs: ACPI: docs: enumeration: Unify Package () for properties (part 2) commit 4aa8c70cb076f7126d8ad755943361e78ac752fc Merge: ec1ff61ee266c d52848620de00 10fa1b2cdc899 1bbc21785b733 988d7a14408db Author: Rafael J. Wysocki Date: Mon May 23 18:29:20 2022 +0200 Merge branches 'acpi-pm', 'acpi-pci', 'acpi-sysfs' and 'acpi-tables' Merge power management, PCI and sysfs-related material and changes related to handling ACPI tables for 5.19-rc1: - Improve debug messages in the ACPI device PM code (Rafael Wysocki). - Block ASUS B1400CEAE from suspend to idle by default (Mario Limonciello). - Improve handling of PCI devices that are in D3cold during system initialization (Rafael Wysocki). - Fix BERT error region memory mapping (Lorenzo Pieralisi). - Add support for NVIDIA 16550-compatible port subtype to the SPCR parsing code (Jeff Brasen). - Use static for BGRT_SHOW kobj_attribute defines (Tom Rix). - Fix missing prototype warning for acpi_agdi_init() (Ilkka Koskinen). * acpi-pm: ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default ACPI: PM: Always print final debug message in acpi_device_set_power() ACPI: PM: Unify debug messages in acpi_device_set_power() ACPI: PM: Change pr_fmt() in device_pm.c ACPI: PM: Convert debug message in acpi_device_get_power() * acpi-pci: ACPI: bus: Avoid non-ACPI device objects in walks over children PCI: ACPI: PM: Power up devices in D3cold before scanning them ACPI: PM: Introduce acpi_dev_power_up_children_with_adr() ACPI: bus: Introduce acpi_dev_for_each_child() * acpi-sysfs: ACPI: sysfs: Fix BERT error region memory mapping * acpi-tables: ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() ACPI: BGRT: use static for BGRT_SHOW kobj_attribute defines ACPI: SPCR: Add support for NVIDIA 16550-compatible port subtype commit e205a9945cf9dbcec79d8271caba355916ea0943 Author: Jim Quinlan Date: Mon May 23 08:16:39 2022 -0400 MIPS: bmips: Fix compiler warning observed on W=1 build The function arch_sync_dma_for_cpu_all() was used but was missing a prototype declaration. Signed-off-by: Jim Quinlan Reported-by: kernel test robot Acked-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer commit a3da1ab6fbea7d5cbcb796f62c8771d8ebd7282a Author: Jason Gunthorpe Date: Thu May 19 14:03:48 2022 -0300 vfio: Do not manipulate iommu dma_owner for fake iommu groups Since asserting dma ownership now causes the group to have its DMA blocked the iommu layer requires a working iommu. This means the dma_owner APIs cannot be used on the fake groups that VFIO creates. Test for this and avoid calling them. Otherwise asserting dma ownership will fail for VFIO mdev devices as a BLOCKING iommu_domain cannot be allocated due to the NULL iommu ops. Fixes: 0286300e6045 ("iommu: iommu_group_claim_dma_owner() must always assign a domain") Reported-by: Eric Farman Tested-by: Eric Farman Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/0-v1-9cfc47edbcd4+13546-vfio_dma_owner_fix_jgg@nvidia.com Signed-off-by: Alex Williamson commit a56672f2027eb0fcf81300cfdab1037be8cda404 Author: Magnus Karlsson Date: Mon May 23 10:32:54 2022 +0200 MAINTAINERS: Add maintainer to AF_XDP Maciej Fijalkowski has gracefully accepted to become the third maintainer for the AF_XDP code. Thank you Maciej! Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20220523083254.32285-1-magnus.karlsson@gmail.com commit ec1ff61ee266cecb79e754983bbd4570aa108cfd Merge: 06eb8dc097b3f c244dc1bc92e9 Author: Rafael J. Wysocki Date: Mon May 23 18:16:42 2022 +0200 Merge branch 'acpica' Merge ACPICA material for 5.19-rc1: - Add support for the Windows 11 _OSI string (Mario Limonciello) - Add the CFMWS subtable to the CEDT table (Lawrence Hileman). - iASL: NHLT: Treat Terminator as specific_config (Piotr Maziarz). - iASL: NHLT: Fix parsing undocumented bytes at the end of Endpoint Descriptor (Piotr Maziarz). - iASL: NHLT: Rename linux specific strucures to device_info (Piotr Maziarz). - Add new ACPI 6.4 semantics to Load() and LoadTable() (Bob Moore). - Clean up double word in comment (Tom Rix). - Update copyright notices to the year 2022 (Bob Moore). - Remove some tabs and // comments - automated cleanup (Bob Moore). - Replace zero-length array with flexible-array member (Gustavo A. R. Silva). - Interpreter: Add units to time variable names (Paul Menzel). - Add support for ARM Performance Monitoring Unit Table (Besar Wicaksono). - Inform users about ACPI spec violation related to sleep length (Paul Menzel). - iASL/MADT: Add OEM-defined subtable (Bob Moore). - Interpreter: Fix some typo mistakes (Selvarasu Ganesan). - Updates for revision E.d of IORT (Shameer Kolothum). - Use ACPI_FORMAT_UINT64 for 64-bit output (Bob Moore). - Update version to 20220331 (Bob Moore). * acpica: (21 commits) Revert "ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms" ACPICA: Update version to 20220331 ACPICA: exsystem.c: Use ACPI_FORMAT_UINT64 for 64-bit output ACPICA: IORT: Updates for revision E.d ACPICA: executer/exsystem: Fix some typo mistakes ACPICA: iASL/MADT: Add OEM-defined subtable ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms ACPICA: executer/exsystem: Inform users about ACPI spec violation ACPICA: Add support for ARM Performance Monitoring Unit Table. ACPICA: executer/exsystem: Add units to time variable names ACPICA: Headers: Replace zero-length array with flexible-array member ACPICA: Removed some tabs and // comments ACPICA: Update copyright notices to the year 2022 ACPICA: Clean up double word in comment ACPICA: Add new ACPI 6.4 semantics for LoadTable() operator ACPICA: Add new ACPI 6.4 semantics to the Load() operator ACPICA: iASL: NHLT: Rename linux specific strucures to device_info ACPICA: iASL: NHLT: Fix parsing undocumented bytes at the end of Endpoint Descriptor ACPICA: iASL: NHLT: Treat Terminator as specific_config ACPICA: Add the subtable CFMWS to the CEDT table ... commit 028818e374c8424641f42d09a03d3d9c88aa9cab Author: Rob Herring Date: Mon May 23 09:37:55 2022 -0500 Revert "dt-bindings: mailbox: qcom-ipcc: add missing properties into example" This reverts commit b20eee62ee89aba03261a1abac80f29abea5bdf5. The example has just been removed altogether in the mailbox tree. Reported-by: Krzysztof Kozlowski Signed-off-by: Rob Herring commit f292d875d0dc700b3af0bef04c5abc1dc7b3b62c Author: Masahiro Yamada Date: Fri May 13 20:39:21 2022 +0900 modpost: extract symbol versions from *.cmd files Currently, CONFIG_MODVERSIONS needs extra link to embed the symbol versions into ELF objects. Then, modpost extracts the version CRCs from them. The following figures show how it currently works, and how I am trying to change it. Current implementation ====================== |----------| embed CRC -------------------------->| final | $(CC) $(LD) / |---------| | link for | -----> *.o -------> *.o -->| modpost | | vmlinux | / / | |-- *.mod.c -->| or | / genksyms / |---------| | module | *.c ------> *.symversions |----------| Genksyms outputs the calculated CRCs in the form of linker script (*.symversions), which is used by $(LD) to update the object. If CONFIG_LTO_CLANG=y, the build process is much more complex. Embedding the CRCs is postponed until the LLVM bitcode is converted into ELF, creating another intermediate *.prelink.o. However, this complexity is unneeded. There is no reason why we must embed version CRCs in objects so early. There is final link stage for vmlinux (scripts/link-vmlinux.sh) and modules (scripts/Makefile.modfinal). We can link CRCs at the very last moment. New implementation ================== |----------| --------------------------------------->| final | $(CC) / |---------| | link for | -----> *.o ---->| | | vmlinux | / | modpost |--- .vmlinux.export.c -->| or | / genksyms | |--- *.mod.c ------------>| module | *.c ------> *.cmd -->|---------| |----------| Pass the symbol versions to modpost as separate text data, which are available in *.cmd files. This commit changes modpost to extract CRCs from *.cmd files instead of from ELF objects. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Reviewed-by: Sami Tolvanen Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 69c4cc99bbcbf3ef2e1901b569954e9226180840 Author: Masahiro Yamada Date: Thu May 12 01:45:04 2022 +0900 modpost: add sym_find_with_module() helper find_symbol() returns the first symbol found in the hash table. This table is global, so it may return a symbol from an unexpected module. There is a case where we want to search for a symbol with a given name in a specified module. Add sym_find_with_module(), which receives the module pointer as the second argument. It is equivalent to find_module() if NULL is passed as the module pointer. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nathan Chancellor Tested-by: Sedat Dilek # LLVM-14 (x86-64) commit 7f3113e3b9f7207f0bd57b5fdae1a1b9c8215e08 Author: Ahmad Fatoum Date: Fri May 13 16:57:05 2022 +0200 MAINTAINERS: add KEYS-TRUSTED-CAAM Create a maintainer entry for CAAM trusted keys in the Linux keyring. Reviewed-by: Pankaj Gupta Acked-by: Jarkko Sakkinen Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit 5002426e426166f57e1636b936666b275e6b3d2f Author: Ahmad Fatoum Date: Fri May 13 16:57:04 2022 +0200 doc: trusted-encrypted: describe new CAAM trust source Update documentation for trusted key use with the Cryptographic Acceleration and Assurance Module (CAAM), an IP on NXP SoCs. Reviewed-by: Pankaj Gupta Reviewed-by: Jarkko Sakkinen Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit e9c5048c2de1913d0bcd589bc1487810c2e24bc1 Author: Ahmad Fatoum Date: Fri May 13 16:57:03 2022 +0200 KEYS: trusted: Introduce support for NXP CAAM-based trusted keys The Cryptographic Acceleration and Assurance Module (CAAM) is an IP core built into many newer i.MX and QorIQ SoCs by NXP. The CAAM does crypto acceleration, hardware number generation and has a blob mechanism for encapsulation/decapsulation of sensitive material. This blob mechanism depends on a device specific random 256-bit One Time Programmable Master Key that is fused in each SoC at manufacturing time. This key is unreadable and can only be used by the CAAM for AES encryption/decryption of user data. This makes it a suitable backend (source) for kernel trusted keys. Previous commits generalized trusted keys to support multiple backends and added an API to access the CAAM blob mechanism. Based on these, provide the necessary glue to use the CAAM for trusted keys. Reviewed-by: David Gstir Reviewed-by: Pankaj Gupta Reviewed-by: Jarkko Sakkinen Tested-by: Tim Harvey Tested-by: Matthias Schiffer Tested-by: Pankaj Gupta Tested-by: Michael Walle # on ls1028a (non-E and E) Tested-by: John Ernberg # iMX8QXP Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit 007c3ff11f38d83cc95b0f402e432cbf484e3c31 Author: Ahmad Fatoum Date: Fri May 13 16:57:02 2022 +0200 crypto: caam - add in-kernel interface for blob generator The NXP Cryptographic Acceleration and Assurance Module (CAAM) can be used to protect user-defined data across system reboot: - When the system is fused and boots into secure state, the master key is a unique never-disclosed device-specific key - random key is encrypted by key derived from master key - data is encrypted using the random key - encrypted data and its encrypted random key are stored alongside - This blob can now be safely stored in non-volatile memory On next power-on: - blob is loaded into CAAM - CAAM writes decrypted data either into memory or key register Add functions to realize encrypting and decrypting into memory alongside the CAAM driver. They will be used in a later commit as a source for the trusted key seal/unseal mechanism. Reviewed-by: David Gstir Reviewed-by: Pankaj Gupta Tested-by: Tim Harvey Tested-by: Matthias Schiffer Tested-by: Pankaj Gupta Tested-by: Michael Walle # on ls1028a (non-E and E) Tested-by: John Ernberg # iMX8QXP Signed-off-by: Steffen Trumtrar Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit 7a0e7d5265f58eab5983f6560817d4fe9943743b Author: Ahmad Fatoum Date: Fri May 13 16:57:01 2022 +0200 crypto: caam - determine whether CAAM supports blob encap/decap Depending on SoC variant, a CAAM may be available, but with some futures fused out. The LS1028A (non-E) SoC is one such SoC and while it indicates BLOB support, BLOB operations will ultimately fail, because there is no AES support. Add a new blob_present member to reflect whether both BLOB support and the AES support it depends on is available. These will be used in a follow-up commit to allow blob driver initialization to error out on SoCs without the necessary hardware support instead of failing at runtime with a cryptic caam_jr 8020000.jr: 20000b0f: CCB: desc idx 11: : Invalid CHA selected. Co-developed-by: Michael Walle Signed-off-by: Michael Walle Tested-by: Michael Walle # on ls1028a (non-E and E) Signed-off-by: Ahmad Fatoum Reviewed-by: Pankaj Gupta Signed-off-by: Jarkko Sakkinen commit fcd7c26901c83681532c6daac599e53d4df11738 Author: Ahmad Fatoum Date: Fri May 13 16:57:00 2022 +0200 KEYS: trusted: allow use of kernel RNG for key material The two existing trusted key sources don't make use of the kernel RNG, but instead let the hardware doing the sealing/unsealing also generate the random key material. However, both users and future backends may want to place less trust into the quality of the trust source's random number generator and instead reuse the kernel entropy pool, which can be seeded from multiple entropy sources. Make this possible by adding a new trusted.rng parameter, that will force use of the kernel RNG. In its absence, it's up to the trust source to decide, which random numbers to use, maintaining the existing behavior. Suggested-by: Jarkko Sakkinen Acked-by: Sumit Garg Acked-by: Pankaj Gupta Reviewed-by: David Gstir Reviewed-by: Pankaj Gupta Reviewed-by: Jarkko Sakkinen Tested-by: Pankaj Gupta Tested-by: Michael Walle # on ls1028a (non-E and E) Tested-by: John Ernberg # iMX8QXP Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit be07858fbf8115fc74528292c2ee8775fe49116f Author: Ahmad Fatoum Date: Fri May 13 16:56:59 2022 +0200 KEYS: trusted: allow use of TEE as backend without TCG_TPM support With recent rework, trusted keys are no longer limited to TPM as trust source. The Kconfig symbol is unchanged however leading to a few issues: - TCG_TPM is required, even if only TEE is to be used - Enabling TCG_TPM, but excluding it from available trusted sources is not possible - TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently dropped, which is not the best user experience Remedy these issues by introducing two new boolean Kconfig symbols: TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate dependencies. Any new code depending on the TPM trusted key backend in particular or symbols exported by it will now need to explicitly state that it depends on TRUSTED_KEYS && TRUSTED_KEYS_TPM The latter to ensure the dependency is built and the former to ensure it's reachable for module builds. There are no such users yet. Reviewed-by: Sumit Garg Reviewed-by: Jarkko Sakkinen Reviewed-by: Pankaj Gupta Tested-by: Pankaj Gupta Tested-by: Andreas Rammhold Tested-by: Tim Harvey Tested-by: Michael Walle # on ls1028a (non-E and E) Tested-by: John Ernberg # iMX8QXP Signed-off-by: Ahmad Fatoum Signed-off-by: Jarkko Sakkinen commit af402ee3c045b0cbd10b7e66d2431304ac9e69bb Author: Stefan Mahnke-Hartmann Date: Fri May 13 15:41:53 2022 +0200 tpm: Add field upgrade mode support for Infineon TPM2 modules TPM2_GetCapability with a capability that has the property type value of TPM_PT_TOTAL_COMMANDS returns a zero length list, when an Infineon TPM2 is in field upgrade mode. Since an Infineon TPM2.0 in field upgrade mode returns RC_SUCCESS on TPM2_Startup, the field upgrade mode has to be detected by TPM2_GetCapability. Signed-off-by: Stefan Mahnke-Hartmann Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e57b2523bd37e6434f4e64c7a685e3715ad21e9a Author: Stefan Mahnke-Hartmann Date: Fri May 13 15:41:51 2022 +0200 tpm: Fix buffer access in tpm2_get_tpm_pt() Under certain conditions uninitialized memory will be accessed. As described by TCG Trusted Platform Module Library Specification, rev. 1.59 (Part 3: Commands), if a TPM2_GetCapability is received, requesting a capability, the TPM in field upgrade mode may return a zero length list. Check the property count in tpm2_get_tpm_pt(). Fixes: 2ab3241161b3 ("tpm: migrate tpm2_get_tpm_pt() to use struct tpm_buf") Cc: stable@vger.kernel.org Signed-off-by: Stefan Mahnke-Hartmann Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e0687fe958f763f1790f22ed5483025b7624e744 Author: Uwe Kleine-König Date: Tue Apr 26 10:06:02 2022 +0200 char: tpm: cr50_i2c: Suppress duplicated error message in .remove() Returning an error value in an i2c remove callback results in an error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called. As tpm_cr50_i2c_remove() emits an error message already and the additional error message by the i2c core doesn't add any useful information, change the return value to zero to suppress this error message. Note that if i2c_clientdata is NULL, there is something really fishy. Assuming no memory corruption happened (then all bets are lost anyhow), tpm_cr50_i2c_remove() is only called after tpm_cr50_i2c_probe() returned successfully. So there was a tpm chip registered before and after tpm_cr50_i2c_remove() its privdata is freed but the associated character device isn't removed. If after that happened userspace accesses the character device it's likely that the freed memory is accessed. For that reason the warning message is made a bit more frightening. Signed-off-by: Uwe Kleine-König Signed-off-by: Jarkko Sakkinen commit 9c438fdef8906fe9c025e0106cef6fe491728790 Author: Jes B. Klinke Date: Tue Apr 19 16:37:57 2022 -0700 tpm: cr50: Add new device/vendor ID 0x504a6666 Accept one additional numerical value of DID:VID for next generation Google TPM with new firmware, to be used in future Chromebooks. The TPM with the new firmware has the code name TI50, and is going to use the same interfaces. Signed-off-by: Jes B. Klinke Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 6422cbd3c52deb1d53a0e60c271f34d882ca8a9d Author: Johannes Holland Date: Mon Mar 21 10:09:24 2022 +0100 tpm: Remove read16/read32/write32 calls from tpm_tis_phy_ops Only tpm_tis and tpm_tis_synquacer have a dedicated way to access multiple bytes at once, every other driver will just fall back to read_bytes/write_bytes. Therefore, remove the read16/read32/write32 calls and move their logic to read_bytes/write_bytes. Suggested-by: Jarkko Sakkinen Signed-off-by: Johannes Holland Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d0dc1a7100f19121f6e7450f9cdda11926aa3838 Author: Xiu Jianfeng Date: Fri Mar 18 14:02:01 2022 +0800 tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Currently it returns zero when CRQ response timed out, it should return an error code instead. Fixes: d8d74ea3c002 ("tpm: ibmvtpm: Wait for buffer to be set before proceeding") Signed-off-by: Xiu Jianfeng Reviewed-by: Stefan Berger Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 80b8a39777a9161d77608ac702c7eeafce5ddce7 Author: Haowen Bai Date: Fri Mar 18 11:35:25 2022 +0800 tpm/tpm_ftpm_tee: Return true/false (not 1/0) from bool functions Return boolean values ("true" or "false") instead of 1 or 0 from bool functions. Signed-off-by: Haowen Bai Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4d99750106adbaecee587232f2589f65170d5ce4 Author: Mickaël Salaün Date: Tue Mar 22 12:13:23 2022 +0100 certs: Explain the rationale to call panic() The blacklist_init() function calls panic() for memory allocation errors. This change documents the reason why we don't return -ENODEV. Link: https://lore.kernel.org/r/20220322111323.542184-2-mic@digikod.net Link: https://lore.kernel.org/r/YjeW2r6Wv55Du0bJ@iki.fi Suggested-by: Paul Moore Reviewed-by: Paul Moore Reviewed-by: Jarkko Sakkinen Signed-off-by: Mickaël Salaün Signed-off-by: Jarkko Sakkinen commit 6364d106e0417e00eb5f223d8a90287d1c421ce0 Author: Mickaël Salaün Date: Mon Jul 12 19:03:13 2021 +0200 certs: Allow root user to append signed hashes to the blacklist keyring Add a kernel option SYSTEM_BLACKLIST_AUTH_UPDATE to enable the root user to dynamically add new keys to the blacklist keyring. This enables to invalidate new certificates, either from being loaded in a keyring, or from being trusted in a PKCS#7 certificate chain. This also enables to add new file hashes to be denied by the integrity infrastructure. Being able to untrust a certificate which could have normaly been trusted is a sensitive operation. This is why adding new hashes to the blacklist keyring is only allowed when these hashes are signed and vouched by the builtin trusted keyring. A blacklist hash is stored as a key description. The PKCS#7 signature of this description must be provided as the key payload. Marking a certificate as untrusted should be enforced while the system is running. It is then forbiden to remove such blacklist keys. Update blacklist keyring, blacklist key and revoked certificate access rights: * allows the root user to search for a specific blacklisted hash, which make sense because the descriptions are already viewable; * forbids key update (blacklist and asymmetric ones); * restricts kernel rights on the blacklist keyring to align with the root user rights. See help in tools/certs/print-cert-tbs-hash.sh . Cc: David Howells Cc: David Woodhouse Cc: Eric Snowberg Cc: Jarkko Sakkinen Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20210712170313.884724-6-mic@digikod.net Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit addf466389d9d78f255e8b15ac44ab4791029852 Author: Mickaël Salaün Date: Mon Jul 12 19:03:10 2021 +0200 certs: Check that builtin blacklist hashes are valid Add and use a check-blacklist-hashes.awk script to make sure that the builtin blacklist hashes set with CONFIG_SYSTEM_BLACKLIST_HASH_LIST will effectively be taken into account as blacklisted hashes. This is useful to debug invalid hash formats, and it make sure that previous hashes which could have been loaded in the kernel, but silently ignored, are now noticed and deal with by the user at kernel build time. This also prevent stricter blacklist key description checking (provided by following commits) to failed for builtin hashes. Update CONFIG_SYSTEM_BLACKLIST_HASH_LIST help to explain the content of a hash string and how to generate certificate ones. Cc: David Howells Cc: David Woodhouse Cc: Eric Snowberg Cc: Jarkko Sakkinen Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20210712170313.884724-3-mic@digikod.net Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bf21dc591bb5f17ba4b29b84d4866e0adc39f57f Author: Mickaël Salaün Date: Mon Jul 12 19:03:11 2021 +0200 certs: Make blacklist_vet_description() more strict Before exposing this new key type to user space, make sure that only meaningful blacklisted hashes are accepted. This is also checked for builtin blacklisted hashes, but a following commit make sure that the user will notice (at built time) and will fix the configuration if it already included errors. Check that a blacklist key description starts with a valid prefix and then a valid hexadecimal string. Cc: David Howells Cc: David Woodhouse Cc: Eric Snowberg Signed-off-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen Link: https://lore.kernel.org/r/20210712170313.884724-4-mic@digikod.net Signed-off-by: Jarkko Sakkinen commit 141e523914f72575915dd334fce3cef4fb0f1e91 Author: Mickaël Salaün Date: Mon Jul 12 19:03:12 2021 +0200 certs: Factor out the blacklist hash creation Factor out the blacklist hash creation with the get_raw_hash() helper. This also centralize the "tbs" and "bin" prefixes and make them private, which help to manage them consistently. Cc: David Howells Cc: David S. Miller Cc: David Woodhouse Cc: Eric Snowberg Cc: Herbert Xu Cc: Jarkko Sakkinen Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20210712170313.884724-5-mic@digikod.net Signed-off-by: Jarkko Sakkinen commit 58d416351e6df1a41d415958ccdd8eb9c2173fed Author: Mickaël Salaün Date: Mon Jul 12 19:03:09 2021 +0200 tools/certs: Add print-cert-tbs-hash.sh Add a new helper print-cert-tbs-hash.sh to generate a TBSCertificate hash from a given certificate. This is useful to generate a blacklist key description used to forbid loading a specific certificate in a keyring, or to invalidate a certificate provided by a PKCS#7 file. This kind of hash formatting is required to populate the file pointed out by CONFIG_SYSTEM_BLACKLIST_HASH_LIST, but only the kernel code was available to understand how to effectively create such hash. Cc: David Howells Cc: David Woodhouse Cc: Eric Snowberg Signed-off-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen Link: https://lore.kernel.org/r/20210712170313.884724-2-mic@digikod.net Signed-off-by: Jarkko Sakkinen commit 2999e1e387271b3216c44168b0c5cc69f647f155 Author: Julia Lawall Date: Sat May 21 13:10:42 2022 +0200 writeback: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20220521111145.81697-32-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Jan Kara commit edcb185fa9c4f8fa1301f032fb503d2597a92b1e Author: Ahmad Fatoum Date: Sat May 21 22:10:50 2022 +0200 Bluetooth: hci_sync: use hci_skb_event() helper This instance is the only opencoded version of the macro, so have it follow suit. Signed-off-by: Ahmad Fatoum Signed-off-by: Marcel Holtmann commit f93afd8e7567fa9dcf0089ff4ce5a713bfb5dae7 Author: Stephen Boyd Date: Wed May 11 18:39:19 2022 -0700 dt-bindings: cros-ec: Fix a typo in description A 's/pf/of/' on rpmsg-name description. Signed-off-by: Stephen Boyd Acked-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220512013921.164637-2-swboyd@chromium.org commit 6f6f84aa215f7b6665ccbb937db50860f9ec2989 Author: Zhang Xiaoxu Date: Sat May 21 12:08:45 2022 +0800 nfsd: Fix null-ptr-deref in nfsd_fill_super() KASAN report null-ptr-deref as follows: BUG: KASAN: null-ptr-deref in nfsd_fill_super+0xc6/0xe0 [nfsd] Write of size 8 at addr 000000000000005d by task a.out/852 CPU: 7 PID: 852 Comm: a.out Not tainted 5.18.0-rc7-dirty #66 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: dump_stack_lvl+0x34/0x44 kasan_report+0xab/0x120 ? nfsd_mkdir+0x71/0x1c0 [nfsd] ? nfsd_fill_super+0xc6/0xe0 [nfsd] nfsd_fill_super+0xc6/0xe0 [nfsd] ? nfsd_mkdir+0x1c0/0x1c0 [nfsd] get_tree_keyed+0x8e/0x100 vfs_get_tree+0x41/0xf0 __do_sys_fsconfig+0x590/0x670 ? fscontext_read+0x180/0x180 ? anon_inode_getfd+0x4f/0x70 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae This can be reproduce by concurrent operations: 1. fsopen(nfsd)/fsconfig 2. insmod/rmmod nfsd Since the nfsd file system is registered before than nfsd_net allocated, the caller may get the file_system_type and use the nfsd_net before it allocated, then null-ptr-deref occurred. So init_nfsd() should call register_filesystem() last. Fixes: bd5ae9288d64 ("nfsd: register pernet ops last, unregister first") Signed-off-by: Zhang Xiaoxu Signed-off-by: Chuck Lever commit 62fdb65edb6c43306c774939001f3a00974832aa Author: Zhang Xiaoxu Date: Sat May 21 12:08:44 2022 +0800 nfsd: Unregister the cld notifier when laundry_wq create failed If laundry_wq create failed, the cld notifier should be unregistered. Signed-off-by: Zhang Xiaoxu Signed-off-by: Chuck Lever commit 28df0988815f63e2af5e6718193c9f68681ad7ff Author: Chuck Lever Date: Fri Apr 29 10:06:21 2022 -0400 SUNRPC: Use RMW bitops in single-threaded hot paths I noticed CPU pipeline stalls while using perf. Once an svc thread is scheduled and executing an RPC, no other processes will touch svc_rqst::rq_flags. Thus bus-locked atomics are not needed outside the svc thread scheduler. Signed-off-by: Chuck Lever commit bb283ca18d1e67c82d22a329c96c9d6036a74790 Author: Chuck Lever Date: Sun Mar 27 16:43:03 2022 -0400 NFSD: Clean up the show_nf_flags() macro The flags are defined using C macros, so TRACE_DEFINE_ENUM is unnecessary. Signed-off-by: Chuck Lever commit 0122e882119ddbd9efa6edfeeac3f5c704a7aeea Author: Chuck Lever Date: Sun Mar 27 16:42:20 2022 -0400 NFSD: Trace filecache opens Instrument calls to nfsd_open_verified() to get a sense of the filecache hit rate. Signed-off-by: Chuck Lever commit 7e2ce0cc15a509b859199235a2bad9cece00f67a Author: Chuck Lever Date: Wed Mar 23 13:55:37 2022 -0400 NFSD: Move documenting comment for nfsd4_process_open2() Clean up nfsd4_open() by converting a large comment at the only call site for nfsd4_process_open2() to a kerneldoc comment in front of that function. Signed-off-by: Chuck Lever commit 26320d7e317c37404c811603d50d811132aef78c Author: Chuck Lever Date: Mon Mar 21 16:41:32 2022 -0400 NFSD: Fix whitespace Clean up: Pull case arms back one tab stop to conform every other switch statement in fs/nfsd/nfs4proc.c. Signed-off-by: Chuck Lever commit f67a16b147045815b6aaafeef8663e5faeb6d569 Author: Chuck Lever Date: Wed Mar 30 14:28:51 2022 -0400 NFSD: Remove dprintk call sites from tail of nfsd4_open() Clean up: These relics are not likely to benefit server administrators. Signed-off-by: Chuck Lever commit fb70bf124b051d4ded4ce57511dfec6d3ebf2b43 Author: Chuck Lever Date: Wed Mar 30 10:30:54 2022 -0400 NFSD: Instantiate a struct file when creating a regular NFSv4 file There have been reports of races that cause NFSv4 OPEN(CREATE) to return an error even though the requested file was created. NFSv4 does not provide a status code for this case. To mitigate some of these problems, reorganize the NFSv4 OPEN(CREATE) logic to allocate resources before the file is actually created, and open the new file while the parent directory is still locked. Two new APIs are added: + Add an API that works like nfsd_file_acquire() but does not open the underlying file. The OPEN(CREATE) path can use this API when it already has an open file. + Add an API that is kin to dentry_open(). NFSD needs to create a file and grab an open "struct file *" atomically. The alloc_empty_file() has to be done before the inode create. If it fails (for example, because the NFS server has exceeded its max_files limit), we avoid creating the file and can still return an error to the NFS client. BugLink: https://bugzilla.linux-nfs.org/show_bug.cgi?id=382 Signed-off-by: Chuck Lever Tested-by: JianHong Yin commit 21a486c4a9b8cfcb5f11c854287f4b5d3f6af28c Author: Krzysztof Kozlowski Date: Wed May 4 10:43:04 2022 +0200 dt-bindings: mfd: wlf,arizona: Add spi-max-frequency The Wolfson Microelectronics Arizona audio can be connected via SPI bus (e.g. WM5110 on Exynos5433 TM2 board), so allow SPI peripheral properties. Reported-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220504084304.46173-1-krzysztof.kozlowski@linaro.org commit ade0642d7dcaff67fa5794770d5bec484c26cdfc Author: Uwe Kleine-König Date: Mon May 2 21:10:12 2022 +0200 mfd: rt4831: Improve error reporting for problems during .remove() Returning an error value in an i2c remove callback results in a generic error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called. So instead of triggering the generic i2c error message, emit a more helpful message if a problem occurs and return 0 to suppress the generic message. This patch is a preparation for making i2c remove callbacks return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220502191012.53259-1-u.kleine-koenig@pengutronix.de commit 0163717ed5dec4fc3aaf937baa9f66f21ca11c1d Merge: 1693e265e0a5d e5cd20e0d6713 Author: Takashi Iwai Date: Mon May 23 16:03:04 2022 +0200 Merge tag 'asoc-v5.19' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.19 This is quite a big update, partly due to the addition of some larger drivers (more of which is to follow since at least the AVS driver is still a work in progress) and partly due to Charles' work sorting out our handling of endianness. As has been the case recently it's much more about drivers than the core. - Overhaul of endianness specification for data formats, avoiding needless restrictions due to CODECs. - Initial stages of Intel AVS driver merge. - Introduction of v4 IPC mechanism for SOF. - TDM mode support for AK4613. - Support for Analog Devices ADAU1361, Cirrus Logic CS35L45, Maxim MAX98396, MediaTek MT8186, NXP i.MX8 micfil and SAI interfaces, nVidia Tegra186 ASRC, and Texas Instruments TAS2764 and TAS2780 commit e4dd748dc87cf431af7b3954963be0d9f6150217 Author: Shengjiu Wang Date: Mon May 23 13:44:21 2022 +0800 ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition There are multiple xDR and xFR registers, the index is from 0 to 7. FSL_SAI_xDR and FSL_SAI_xFR is abandoned, replace them with FSL_SAI_xDR0 and FSL_SAI_xFR0. Fixes: 4f7a0728b530 ("ASoC: fsl_sai: Add support for SAI new version") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1653284661-18964-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit f4d6aca0c80f09f4c780136a64ee039560a2c39b Author: Pierre-Louis Bossart Date: Fri May 20 16:06:15 2022 -0500 ASoC: soc-pcm: fix BE transition for TRIGGER_START A obvious editing mistake caught with a cppcheck warning sound/soc/soc-pcm.c:2132:8: style: Variable 'ret' is reassigned a value before the old one has been used. [redundantAssignment] ret = soc_pcm_trigger(be_substream, cmd); ^ sound/soc/soc-pcm.c:2126:9: note: ret is assigned ret = soc_pcm_trigger(be_substream, ^ sound/soc/soc-pcm.c:2129:9: note: ret is assigned ret = soc_pcm_trigger(be_substream, ^ Fixes: 374b50e234a3e ('ASoC: soc-pcm: improve BE transition for TRIGGER_START') Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220520210615.607229-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 311242c7703df0da14c206260b7e855f69cb0264 Author: Yang Yingliang Date: Tue Apr 26 11:08:57 2022 +0800 mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. Fixes: b5e29aa880be ("mfd: davinci_voicecodec: Remove pointless #include") Signed-off-by: Yang Yingliang Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220426030857.3539336-1-yangyingliang@huawei.com commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 Author: Robin Murphy Date: Fri May 20 18:10:13 2022 +0100 dma-direct: don't over-decrypt memory The original x86 sev_alloc() only called set_memory_decrypted() on memory returned by alloc_pages_node(), so the page order calculation fell out of that logic. However, the common dma-direct code has several potential allocators, not all of which are guaranteed to round up the underlying allocation to a power-of-two size, so carrying over that calculation for the encryption/decryption size was a mistake. Fix it by rounding to a *number* of pages, rather than an order. Until recently there was an even worse interaction with DMA_DIRECT_REMAP where we could have ended up decrypting part of the next adjacent vmalloc area, only averted by no architecture actually supporting both configs at once. Don't ask how I found that one out... Fixes: c10f07aa27da ("dma/direct: Handle force decryption for DMA coherent buffers in common code") Signed-off-by: Robin Murphy Signed-off-by: Christoph Hellwig Acked-by: David Rientjes commit 5d2b6bc3a6a27ad265d2ec0d53dd7ef33bd314fc Author: Adrian Hunter Date: Tue May 17 16:10:11 2022 +0300 perf intel-pt: Add guest_code support A common case for KVM test programs is that the test program acts as the hypervisor, creating, running and destroying the virtual machine, and providing the guest object code from its own object code. In this case, the VM is not running an OS, but only the functions loaded into it by the hypervisor test program, and conveniently, loaded at the same virtual addresses. To support that, a new option "--guest-code" has been added in previous patches. In this patch, add support also to Intel PT. In particular, ensure guest_code thread is set up before attempting to walk object code or synthesize samples. Example: # perf record --kcore -e intel_pt/cyc/ -- tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.280 MB perf.data ] # perf script --guest-code --itrace=bep --ns -F-period,+addr,+flags [SNIP] tsc_msrs_test 18436 [007] 10897.962087733: branches: call ffffffffc13b2ff5 __vmx_vcpu_run+0x15 (vmlinux) => ffffffffc13b2f50 vmx_update_host_rsp+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962087733: branches: return ffffffffc13b2f5d vmx_update_host_rsp+0xd (vmlinux) => ffffffffc13b2ffa __vmx_vcpu_run+0x1a (vmlinux) tsc_msrs_test 18436 [007] 10897.962087733: branches: call ffffffffc13b303b __vmx_vcpu_run+0x5b (vmlinux) => ffffffffc13b2f80 vmx_vmenter+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962087836: branches: vmentry ffffffffc13b2f82 vmx_vmenter+0x2 (vmlinux) => 0 [unknown] ([unknown]) [guest/18436] 18436 [007] 10897.962087836: branches: vmentry 0 [unknown] ([unknown]) => 402c81 guest_code+0x131 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962087836: branches: call 402c81 guest_code+0x131 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 40dba0 ucall+0x0 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962088248: branches: vmexit 40dba0 ucall+0x0 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 0 [unknown] ([unknown]) tsc_msrs_test 18436 [007] 10897.962088248: branches: vmexit 0 [unknown] ([unknown]) => ffffffffc13b2fa0 vmx_vmexit+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962088248: branches: jmp ffffffffc13b2fa0 vmx_vmexit+0x0 (vmlinux) => ffffffffc13b2fd2 vmx_vmexit+0x32 (vmlinux) tsc_msrs_test 18436 [007] 10897.962088256: branches: return ffffffffc13b2fd2 vmx_vmexit+0x32 (vmlinux) => ffffffffc13b3040 __vmx_vcpu_run+0x60 (vmlinux) tsc_msrs_test 18436 [007] 10897.962088270: branches: return ffffffffc13b30b6 __vmx_vcpu_run+0xd6 (vmlinux) => ffffffffc13b2f2e vmx_vcpu_enter_exit+0x4e (vmlinux) [SNIP] tsc_msrs_test 18436 [007] 10897.962089321: branches: call ffffffffc13b2ff5 __vmx_vcpu_run+0x15 (vmlinux) => ffffffffc13b2f50 vmx_update_host_rsp+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962089321: branches: return ffffffffc13b2f5d vmx_update_host_rsp+0xd (vmlinux) => ffffffffc13b2ffa __vmx_vcpu_run+0x1a (vmlinux) tsc_msrs_test 18436 [007] 10897.962089321: branches: call ffffffffc13b303b __vmx_vcpu_run+0x5b (vmlinux) => ffffffffc13b2f80 vmx_vmenter+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962089424: branches: vmentry ffffffffc13b2f82 vmx_vmenter+0x2 (vmlinux) => 0 [unknown] ([unknown]) [guest/18436] 18436 [007] 10897.962089424: branches: vmentry 0 [unknown] ([unknown]) => 40dba0 ucall+0x0 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962089701: branches: jmp 40dc1b ucall+0x7b (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 40dc39 ucall+0x99 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962089701: branches: jcc 40dc3c ucall+0x9c (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 40dc20 ucall+0x80 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962089701: branches: jcc 40dc3c ucall+0x9c (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 40dc20 ucall+0x80 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962089701: branches: jcc 40dc37 ucall+0x97 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 40dc50 ucall+0xb0 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) [guest/18436] 18436 [007] 10897.962089878: branches: vmexit 40dc55 ucall+0xb5 (/home/ahunter/git/work/tools/testing/selftests/kselftest_install/kvm/tsc_msrs_test) => 0 [unknown] ([unknown]) tsc_msrs_test 18436 [007] 10897.962089878: branches: vmexit 0 [unknown] ([unknown]) => ffffffffc13b2fa0 vmx_vmexit+0x0 (vmlinux) tsc_msrs_test 18436 [007] 10897.962089878: branches: jmp ffffffffc13b2fa0 vmx_vmexit+0x0 (vmlinux) => ffffffffc13b2fd2 vmx_vmexit+0x32 (vmlinux) tsc_msrs_test 18436 [007] 10897.962089887: branches: return ffffffffc13b2fd2 vmx_vmexit+0x32 (vmlinux) => ffffffffc13b3040 __vmx_vcpu_run+0x60 (vmlinux) tsc_msrs_test 18436 [007] 10897.962089901: branches: return ffffffffc13b30b6 __vmx_vcpu_run+0xd6 (vmlinux) => ffffffffc13b2f2e vmx_vcpu_enter_exit+0x4e (vmlinux) [SNIP] # perf kvm --guest-code --guest --host report -i perf.data --stdio | head -20 # To display the perf.data header info, please use --header/--header-only options. # # # Total Lost Samples: 0 # # Samples: 12 of event 'instructions' # Event count (approx.): 2274583 # # Children Self Command Shared Object Symbol # ........ ........ ............. .................... ........................................... # 54.70% 0.00% tsc_msrs_test [kernel.vmlinux] [k] entry_SYSCALL_64_after_hwframe | ---entry_SYSCALL_64_after_hwframe do_syscall_64 | |--29.44%--syscall_exit_to_user_mode | exit_to_user_mode_prepare | task_work_run | __fput For more information about Perf tools support for Intel® Processor Trace refer: https://perf.wiki.kernel.org/index.php/Perf_tools_support_for_Intel%C2%AE_Processor_Trace Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-7-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 512a09fb96563b848e4a089e9a86f21052a2db5b Author: Adrian Hunter Date: Tue May 17 16:10:10 2022 +0300 perf kvm report: Add guest_code support Add an option to indicate that guest code can be found in the hypervisor process. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5b208144602f7557f569a26b907da2283cc9b4ac Author: Adrian Hunter Date: Tue May 17 16:10:09 2022 +0300 perf script: Add guest_code support Add an option to indicate that guest code can be found in the hypervisor process. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 096fc361800db54d8e4cf4bb58c11e31146fcedd Author: Adrian Hunter Date: Tue May 17 16:10:08 2022 +0300 perf tools: Add guest_code support A common case for KVM test programs is that the test program acts as the hypervisor, creating, running and destroying the virtual machine, and providing the guest object code from its own object code. In this case, the VM is not running an OS, but only the functions loaded into it by the hypervisor test program, and conveniently, loaded at the same virtual addresses. Normally to resolve addresses, MMAP events are needed to map addresses back to the object code and debug symbols for that object code. Currently, there is no way to get such mapping information from guests but, in the scenario described above, the guest has the same mappings as the hypervisor, so support for that scenario can be achieved. To support that, copy the host thread's maps to the guest thread's maps. Note, we do not discover the guest until we encounter a guest event, which works well because it is not until then that we know that the host thread's maps have been set up. Typically the main function for the guest object code is called "guest_code", hence the name chosen for this feature. Note, that is just a convention, the function could be named anything, and the tools do not care. This is primarily aimed at supporting Intel PT, or similar, where trace data can be recorded for a guest. Refer to the final patch in this series "perf intel-pt: Add guest_code support" for an example. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c98e064d540cf88ccd7f9d20b0e1c1bbe5f82810 Author: Adrian Hunter Date: Tue May 17 16:10:07 2022 +0300 perf tools: Factor out thread__set_guest_comm() Factor out thread__set_guest_comm() so it can be reused. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a088031c4998297c86a06d925cc0f38508205950 Author: Adrian Hunter Date: Tue May 17 16:10:06 2022 +0300 perf tools: Add machine to machines back pointer When dealing with guest machines, it can be necessary to get a reference to the host machine. Add a machines pointer to struct machine to make that possible. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: kvm@vger.kernel.org Link: https://lore.kernel.org/r/20220517131011.6117-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 67322d13fe3043c81b54b7efa919b800e3d4374a Author: Nick Forrington Date: Tue May 17 14:58:05 2022 +0100 perf vendors events arm64: Update Cortex A57/A72 Categorise and add missing PMU events for Cortex-A57/A72, based on: https://github.com/ARM-software/data/blob/master/pmu/cortex-a57.json https://github.com/ARM-software/data/blob/master/pmu/cortex-a72.json These contain the same events, and are based on the Arm Technical Reference Manuals for Cortex-A57 and Cortex-A72. Reviewed-by: John Garry Signed-off-by: Nick Forrington Acked-by: Florian Fainelli Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220517135805.313184-2-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 2531169eeaae8eb187762f843a3d5c3ae66b83d0 Author: Nick Forrington Date: Fri May 20 19:14:55 2022 +0100 perf vendors events arm64: Arm Neoverse E1 Add PMU events for Arm Neoverse E1 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/neoverse-e1.json which is based on PMU event descriptions from the Arm Neoverse E1 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-14-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 7227fed42533e218d9ac97c3a4daec3e64365fed Author: Nick Forrington Date: Fri May 20 19:14:54 2022 +0100 perf vendors events arm64: Arm Cortex-X2 Add PMU events for Arm Cortex-X2 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-x2.json which is based on PMU event descriptions from the Arm Cortex-X2 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-13-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 30bb078aa0a9559e0b1d024f6f6ed7eaa6431a75 Author: Nick Forrington Date: Fri May 20 19:14:53 2022 +0100 perf vendors events arm64: Arm Cortex-X1 Add PMU events for Arm Cortex-X1 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-x1.json which is based on PMU event descriptions from the Arm Cortex-X1 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-12-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit cceb5f9713a955ea23235133b1cf1f83eb1e9015 Author: Nick Forrington Date: Fri May 20 19:14:52 2022 +0100 perf vendors events arm64: Arm Cortex-A710 Add PMU events for Arm Cortex-A710 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a710.json which is based on PMU event descriptions from the Arm Cortex-A710 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-11-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit cf57baf0078fe327c2b168a8ca63a5984b23e991 Author: Nick Forrington Date: Fri May 20 19:14:51 2022 +0100 perf vendors events arm64: Arm Cortex-A78 Add PMU events for Arm Cortex-A78 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a78.json which is based on PMU event descriptions from the Arm Cortex-A78 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-10-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 45bd52fae0e18ba268ec5995a665edcd95b3118a Author: Nick Forrington Date: Fri May 20 19:14:50 2022 +0100 perf vendors events arm64: Arm Cortex-A77 Add PMU events for Arm Cortex-A77 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a77.json which is based on PMU event descriptions from the Arm Cortex-A77 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-9-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 387b5a8db3e206682838486609c58d2c39f2c7c3 Author: Nick Forrington Date: Fri May 20 19:14:49 2022 +0100 perf vendors events arm64: Arm Cortex-A75 Add PMU events for Arm Cortex-A75 Add corresponding common events Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a75.json which is based on PMU event descriptions from the Arm Cortex-A75 Technical Reference Manual. Common event data based on: https://github.com/ARM-software/data/blob/master/pmu/common_armv9.json which is based on PMU event descriptions found in the Arm Architecture Reference Manual: https://developer.arm.com/documentation/ddi0487/ Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-8-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 64a091c67aa8437cb233bfe67c32ae8c29b0c53a Author: Nick Forrington Date: Fri May 20 19:14:48 2022 +0100 perf vendors events arm64: Arm Cortex-A73 Add PMU events for Arm Cortex-A73 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a73.json which is based on PMU event descriptions from the Arm Cortex-A73 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-7-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 6951dee81215f3238c1df5dd1ce6cb35863b11d5 Author: Nick Forrington Date: Fri May 20 19:14:47 2022 +0100 perf vendors events arm64: Arm Cortex-A65 Add PMU events for Arm Cortex-A65 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a65.json which is based on PMU event descriptions from the Arm Cortex-A65 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-6-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3935c302c2eed16b477f6964e4ca5741242ab844 Author: Nick Forrington Date: Fri May 20 19:14:46 2022 +0100 perf vendors events arm64: Arm Cortex-A510 Add PMU events for Arm Cortex-A510 Add corresponding common events Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a510.json which is based on PMU event descriptions from the Arm Cortex-A510 Technical Reference Manual. Common event data based on: https://github.com/ARM-software/data/blob/master/pmu/common_armv9.json which is based on PMU event descriptions found in the Arm Architecture Reference Manual: https://developer.arm.com/documentation/ddi0487/ Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-5-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit fbb6b31aa80c804729812abb3159dbf729f6596f Author: Nick Forrington Date: Fri May 20 19:14:45 2022 +0100 perf vendors events arm64: Arm Cortex-A55 Add PMU events for Arm Cortex-A55 Add corresponding common events Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a55.json which is based on PMU event descriptions from the Arm Cortex-A55 Technical Reference Manual. Common event data based on: https://github.com/ARM-software/data/blob/master/pmu/common_armv9.json which is based on PMU event descriptions found in the Arm Architecture Reference Manual: https://developer.arm.com/documentation/ddi0487/ Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-4-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit b5d03547f6a49b4053c4fa366e5a0695d2dc3daa Author: Nick Forrington Date: Fri May 20 19:14:44 2022 +0100 perf vendors events arm64: Arm Cortex-A35 Add PMU events for Arm Cortex-A35 Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a35.json which is based on PMU event descriptions from the Arm Cortex-A35 Technical Reference Manual. Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-3-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ee2409510cf41556bd5d108711e08d0c6e9e8c23 Author: Nick Forrington Date: Fri May 20 19:14:43 2022 +0100 perf vendors events arm64: Arm Cortex-A34 Add PMU events for Arm Cortex-A34 Add corresponding common events Update mapfile.csv Event data based on: https://github.com/ARM-software/data/tree/master/pmu/cortex-a34.json which is based on PMU event descriptions from the Arm Cortex-A34 Technical Reference Manual. Common event data based on: https://github.com/ARM-software/data/blob/master/pmu/common_armv9.json which is based on PMU event descriptions found in the Arm Architecture Reference Manual: https://developer.arm.com/documentation/ddi0487/ Mapping data (for mapfile.csv) based on: https://github.com/ARM-software/data/blob/master/cpus.json which is based on Main ID Register (MIDR) information found in the Arm Technical Reference Manuals for individual CPUs. Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220520181455.340344-2-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit d8fc08550929bb845c13cfefcc632a69fcf79b2c Author: Adrian Hunter Date: Fri May 20 16:24:04 2022 +0300 perf inject: Keep a copy of kcore_dir If the input perf.data has a kcore_dir, copy it into the output, since at least the kallsyms in the kcore_dir will be useful to the output. Example: Before: $ ls -lR perf.data-from-desktop perf.data-from-desktop: total 916 -rw------- 1 user user 931756 May 19 09:55 data drwx------ 2 user user 4096 May 19 09:55 kcore_dir perf.data-from-desktop/kcore_dir: total 42952 -r-------- 1 user user 7582467 May 19 09:55 kallsyms -r-------- 1 user user 36388864 May 19 09:55 kcore -r-------- 1 user user 4828 May 19 09:55 modules $ perf inject -i perf.data-from-desktop -o injected-perf.data $ ls -lR injected-perf.data -rw------- 1 user user 931320 May 20 15:08 injected-perf.data After: $ perf inject -i perf.data-from-desktop -o injected-perf.data $ ls -lR injected-perf.data injected-perf.data: total 916 -rw------- 1 user user 931320 May 20 15:21 data drwx------ 2 user user 4096 May 20 15:21 kcore_dir injected-perf.data/kcore_dir: total 42952 -r-------- 1 user user 7582467 May 20 15:21 kallsyms -r-------- 1 user user 36388864 May 20 15:21 kcore -r-------- 1 user user 4828 May 20 15:21 modules Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220520132404.25853-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a4455e0053aacf4ae088530dc045d50f4ea471e3 Author: Adrian Hunter Date: Fri May 20 16:24:03 2022 +0300 perf data: Add has_kcore_dir() Add a helper function has_kcore_dir(), so that perf inject can determine if it needs to keep the kcore_dir. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220520132404.25853-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 180b3d06263ce70dd0622681237cf5c0555d9ca0 Author: Adrian Hunter Date: Fri May 20 16:24:02 2022 +0300 perf inject: Keep some features sections from input file perf inject overwrites feature sections with information from the current machine. It makes more sense to keep original information that describes the machine or software when perf record was run. Example: perf.data from "Desktop" injected on "nuc11" Before: $ perf script --header-only -i perf.data-from-desktop | head -15 # ======== # captured on : Thu May 19 09:55:50 2022 # header version : 1 # data offset : 1208 # data size : 837480 # feat offset : 838688 # hostname : Desktop # os release : 5.13.0-41-generic # perf version : 5.18.rc5.gac837f7ca7ed # arch : x86_64 # nrcpus online : 28 # nrcpus avail : 28 # cpudesc : Intel(R) Core(TM) i9-9940X CPU @ 3.30GHz # cpuid : GenuineIntel,6,85,4 # total memory : 65548656 kB $ perf inject -i perf.data-from-desktop -o injected-perf.data $ perf script --header-only -i injected-perf.data | head -15 # ======== # captured on : Fri May 20 15:06:55 2022 # header version : 1 # data offset : 1208 # data size : 837480 # feat offset : 838688 # hostname : nuc11 # os release : 5.17.5-local # perf version : 5.18.rc5.g0f828fdeb9af # arch : x86_64 # nrcpus online : 8 # nrcpus avail : 8 # cpudesc : 11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz # cpuid : GenuineIntel,6,140,1 # total memory : 16012124 kB After: $ perf inject -i perf.data-from-desktop -o injected-perf.data $ perf script --header-only -i injected-perf.data | head -15 # ======== # captured on : Fri May 20 15:08:54 2022 # header version : 1 # data offset : 1208 # data size : 837480 # feat offset : 838688 # hostname : Desktop # os release : 5.13.0-41-generic # perf version : 5.18.rc5.gac837f7ca7ed # arch : x86_64 # nrcpus online : 28 # nrcpus avail : 28 # cpudesc : Intel(R) Core(TM) i9-9940X CPU @ 3.30GHz # cpuid : GenuineIntel,6,85,4 # total memory : 65548656 kB Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220520132404.25853-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 618ee7838e409513635320ca9c4c8d52c44f2dd0 Author: Adrian Hunter Date: Fri May 20 18:56:04 2022 +0300 libperf: Add preadn() Add preadn() to provide pread() and readn() semantics. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/ab8918a4-7ac8-a37e-2e2c-28438c422d87@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 237c96b8c1584d4c28d3593e5f52508fbec9ff06 Author: Adrian Hunter Date: Fri May 20 16:24:00 2022 +0300 perf header: Add ability to keep feature sections Many feature sections should not be re-written during perf inject. In preparation to support that, add callbacks that a tool can use to copy a feature section from elsewhere. perf inject will use this facility to copy features sections from the input file. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220520132404.25853-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit eeb0a442da2fbf9617e9f934026958f782b1beef Author: Gaggery Tsai Date: Fri May 20 12:35:37 2022 -0700 mfd: intel-lpss: Add support for ADL-P i2c6 and i2c7 Added 8086:51d8 and 8086:51d9 to the intel_lpss_pci driver. They are Intel Alder Lake-P i2c controllers. Signed-off-by: Gaggery Tsai Reviewed-by: Andy Shevchenko Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220520193537.26090-1-gaggery.tsai@intel.com commit 1634b5a1f11cf407255d42fcc1d6bf257d16adab Author: Ian Rogers Date: Wed May 11 14:15:23 2022 -0700 perf jevents: Modify match field The match_field function looks for json values to append to the event string. As the C code processes these in order the output order matches that in the json dictionary. Python json readers read the entire dictionary and lose the ordering. To make the python and C output comparable make the C code first read the extra fields then append them to the event in an order not determined by their order in the file. Modify the pmu-events test so that test expectations match the new order. Reviewed-by: John Garry Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Andi Kleen Cc: Andrew Kilroy Cc: Caleb Biggers Cc: Felix Fietkau Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Like Xu Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Forrington Cc: Paul Clarke Cc: Perry Taylor Cc: Peter Zijlstra Cc: Qi Liu Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220511211526.1021908-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit afba2b08e12392c690b5962dacb73726457a1f6e Author: Ian Rogers Date: Wed May 11 14:15:22 2022 -0700 perf vendor events: Fix Ivytown UNC_M_ACT_COUNT.RD umask The event had two umasks with the umask of 3 being correct. Note: this change wasn't automatically generated as there is no CSV for Ivytown uncore events at: https://github.com/intel/event-converter-for-linux-perf Reviewed-by: John Garry Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Andi Kleen Cc: Andrew Kilroy Cc: Caleb Biggers Cc: Felix Fietkau Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Like Xu Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Forrington Cc: Paul Clarke Cc: Perry Taylor Cc: Peter Zijlstra Cc: Qi Liu Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220511211526.1021908-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a583bf18784a854cffaa3dc7ee23d286b04b1cd3 Author: Ian Rogers Date: Wed May 11 14:15:21 2022 -0700 perf vendor events: Fix Alderlake metric groups Remove unnecessary empty groups. Reviewed-by: John Garry Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Andi Kleen Cc: Andrew Kilroy Cc: Caleb Biggers Cc: Felix Fietkau Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Like Xu Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Forrington Cc: Paul Clarke Cc: Perry Taylor Cc: Peter Zijlstra Cc: Qi Liu Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220511211526.1021908-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit fcb120d50c944fc2a02103d6a1f093a5b665a924 Author: Ian Rogers Date: Wed May 11 14:15:20 2022 -0700 perf jevents: Append PMU description later Append the PMU information from "Unit" to the description later. This avoids a problem when "Unit" appears early in a json event and the information prepends the description rather than being the expected suffix. Update the pmu-events test so that expectations now match the improved output. Reviewed-by: John Garry Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Andi Kleen Cc: Andrew Kilroy Cc: Caleb Biggers Cc: Felix Fietkau Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Like Xu Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Nick Forrington Cc: Paul Clarke Cc: Perry Taylor Cc: Peter Zijlstra Cc: Qi Liu Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220511211526.1021908-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2cf88f4614c996e563adad75c501802d86c29324 Author: Ian Rogers Date: Tue May 17 21:20:27 2022 -0700 perf test: Use skip in PERF_RECORD_* Check if the error code is EACCES and make the test a skip with a "permissions" skip reason if so. Committer testing: Before: $ perf test PERF_RECORD 8: PERF_RECORD_* events & perf_sample fields : FAILED! $ After: $ perf test PERF_RECORD 8: PERF_RECORD_* events & perf_sample fields : Skip (permissions) $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7741e03e808a85acdcc12dcfb79d9df519439c83 Author: Ian Rogers Date: Tue May 17 21:20:26 2022 -0700 perf test: Parse events break apart tests Break multiple tests in the main test into individual test cases. Make better use of skip and add reasons. Skip also for parse event permission issues (detected by searching the error string). Rather than break out of tests on the first failure, keep going and logging to pr_debug. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8252e7917ea21d60ae1bbd919d65c4ca98085831 Author: Ian Rogers Date: Tue May 17 21:20:25 2022 -0700 perf test: Parse events tidy evlist_test Remove two unused variables. Make structs const. Also fix the array index (aka id) for the event software/r0x1a/. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b58eca408c15f2945e60232bc76d600426a8ad4c Author: Ian Rogers Date: Tue May 17 21:20:24 2022 -0700 perf test: Parse events tidy terms_test Remove an unused variables. Make structs const. Fix checkpatch issue wrt unsigned not being with an int. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7312c36ce6cdd307e10a8f223a1e05447e39cfc5 Author: Ian Rogers Date: Tue May 17 21:20:23 2022 -0700 perf test: Basic mmap use skip If opening the event fails for basic mmap with EACCES it is more likely permission related that a true error. Mark the test as skip in this case and add a skip reason. Committer testing: Before: $ perf test "mmap interface" 4: Read samples using the mmap interface : FAILED! $ After: $ perf test "mmap interface" 4: Read samples using the mmap interface : Skip (permissions) $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f9b10c82faf5859262de10ea30261391e117b9bd Author: Ian Rogers Date: Tue May 17 21:20:22 2022 -0700 perf test: Use skip in openat syscall Failures to open the tracepoint cause this test to fail, however, typically such failures are permission related. Lower the failure to just skipping the test in those cases and add a skip reason. Committer testing: Before: $ perf test "openat syscall" 2: Detect openat syscall event : FAILED! 3: Detect openat syscall event on all cpus : FAILED! $ After: $ perf test "openat syscall" 2: Detect openat syscall event : Skip (permissions) 3: Detect openat syscall event on all cpus : Skip (permissions) $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 740f8a82410bf36650d9efa179cc84d6c8a5c89a Author: Ian Rogers Date: Tue May 17 21:20:21 2022 -0700 perf test: Use skip in vmlinux kallsyms Currently failures in reading vmlinux or kallsyms result in a test failure. However, the failure is typically permission related. Prefer to flag these failures as skip. Committer testing: Before: $ perf test vmlinux 1: vmlinux symtab matches kallsyms : FAILED! $ After: $ perf test vmlinux 1: vmlinux symtab matches kallsyms : Skip $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit cfa5013a41fa1a07f22a8c300453cf2f0037bc81 Author: Ian Rogers Date: Tue May 17 21:20:20 2022 -0700 perf test: Skip reason for suites with 1 test When a suite has just 1 subtest, the subtest number is given as -1 to avoid indented printing. When this subtest number is seen for the skip reason, use the reason of the first test. Reviewed-by: John Garry Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Carsten Haitzler Cc: Ingo Molnar Cc: Jiri Olsa Cc: Marco Elver Cc: Mark Rutland Cc: Michael Petlan Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Sohaib Mohamed Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220518042027.836799-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0b9462d0ac10627368cf47cd4125714004d99b7f Author: Ian Rogers Date: Wed May 18 20:20:05 2022 -0700 perf stat: Make use of index clearer with perf_counts Try to disambiguate further when perf_counts is being accessed it is with a cpu map index rather than a CPU. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Dave Marchevsky Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Kan Liang Cc: Lv Ruyi Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stephane Eranian Cc: Xing Zhengjun Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220519032005.1273691-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 54668a4ea03e317049b801c419c78e3ec4f366e6 Author: Ian Rogers Date: Wed May 18 20:20:04 2022 -0700 perf bpf_counter: Tidy use of CPU map index BPF counters are typically running across all CPUs and so the CPU map index and CPU number are the same. There may be cases with offline CPUs where this isn't the case and so ensure the cpu map index for perf_counts is going to be a valid index by explicitly iterating over the CPU map. This also makes it clearer that users of perf_counts are using an index. Collapse some multiple uses of perf_counts into single uses. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Dave Marchevsky Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Kan Liang Cc: Lv Ruyi Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stephane Eranian Cc: Xing Zhengjun Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220519032005.1273691-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e696f6dbbf9d5c88922a4e2c9ee2ed9b495285ca Author: Ian Rogers Date: Wed May 18 20:20:03 2022 -0700 perf cpumap: Add perf_cpu_map__for_each_idx() A variant of perf_cpu_map__for_each_cpu() that just iterates index values without the corresponding load of the CPU. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Dave Marchevsky Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Kan Liang Cc: Lv Ruyi Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stephane Eranian Cc: Xing Zhengjun Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220519032005.1273691-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0dd9769f0cb0da5a7a3987942b479398f343ef30 Author: Ian Rogers Date: Wed May 18 20:20:02 2022 -0700 perf stat: Add stat record+report test This would have caught: "Subject: Re: perf stat report segfaults" https://lore.kernel.org/linux-perf-users/CAP-5=fWQR=sCuiSMktvUtcbOLidEpUJLCybVF6=BRvORcDOq+g@mail.gmail.com/ Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Dave Marchevsky Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Kan Liang Cc: Lv Ruyi Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stephane Eranian Cc: Xing Zhengjun Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220519032005.1273691-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7c3bcbdf449fe591c9b68521b45869669ec76010 Author: Namhyung Kim Date: Fri May 20 18:08:11 2022 -0700 perf lock: Add -t/--thread option for report The -t option is to show per-thread lock stat like below: $ perf lock report -t -F acquired,contended,avg_wait Name acquired contended avg wait (ns) perf 240569 9 5784 swapper 106610 19 543 :15789 17370 2 14538 ContainerMgr 8981 6 874 sleep 5275 1 11281 ContainerThread 4416 4 944 RootPressureThr 3215 5 1215 rcu_preempt 2954 0 0 ContainerMgr 2560 0 0 unnamed 1873 0 0 EventManager_De 1845 1 636 futex-default-S 1609 0 0 ... Committer notes: Add that option to the 'perf lock report' man page. Signed-off-by: Namhyung Kim Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220521010811.932703-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 79d9333b85910a73e39233d6190e60f903d120b6 Author: Namhyung Kim Date: Fri May 20 18:08:10 2022 -0700 perf lock: Do not discard broken lock stats Currently it discards a lock_stat for a lock instance when there's a broken lock_seq_stat in a single task for the lock. But it also means that the existing (and later) valid lock stat info for that lock will be discarded as well. This is not ideal since we can lose many valuable info because of a single failure. Actually those failures are indepent to the existing stat. So we can only discard the broken lock_seq_stat but keep the valid lock_stat. The discarded lock_seq_stat will be reallocated in a subsequent event with SEQ_STATE_UNINITIALIZED which will be ignored until it see the start of the next sequence. So it should be ok just free it. Before: $ perf lock report -F acquired,contended,avg_wait Warning: Processed 1401603 events and lost 18 chunks! Check IO/CPU overload! Name acquired contended avg wait (ns) rcu_read_lock 251225 0 0 &(ei->i_block_re... 8731 0 0 &sb->s_type->i_l... 8731 0 0 hrtimer_bases.lock 5261 0 0 hrtimer_bases.lock 2626 0 0 hrtimer_bases.lock 1953 0 0 hrtimer_bases.lock 1382 0 0 cpu_hotplug_lock 1350 0 0 hrtimer_bases.lock 1273 0 0 hrtimer_bases.lock 1269 0 0 hrtimer_bases.lock 1198 0 0 ... New: Name acquired contended avg wait (ns) rcu_read_lock 251225 0 0 tk_core.seq.seqc... 54074 0 0 &xa->xa_lock 17470 0 0 &ei->i_es_lock 17464 0 0 &ei->i_raw_lock 9391 0 0 &mapping->privat... 8734 0 0 &ei->i_data_sem 8731 0 0 &(ei->i_block_re... 8731 0 0 &sb->s_type->i_l... 8731 0 0 jiffies_seq.seqc... 6953 0 0 &mm->mmap_lock 6889 0 0 balancing 5768 0 0 hrtimer_bases.lock 5261 0 0 ... Signed-off-by: Namhyung Kim Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220521010811.932703-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 12aeaaba087d6d922423e88b0de7d145bc5d8de7 Author: Leo Yan Date: Wed May 18 13:57:21 2022 +0800 perf c2c: Update documentation for store metric 'N/A' The 'N/A' metric is added for store operations, update documentation to reflect changes in the report table. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adam Li Cc: Alexander Shishkin Cc: Ali Saidi Cc: Alyssa Ross Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Joe Mario Cc: Kajol Jain Cc: Kan Liang Cc: Li Huafei Cc: Like Xu Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220518055729.1869566-4-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 550b4d6f9a7e5ddc99d7d13652ba9e859d0e5361 Author: Leo Yan Date: Wed May 18 13:57:20 2022 +0800 perf c2c: Add dimensions for 'N/A' metrics of store operation Since now we have the statistics 'st_na' for store operations, add dimensions for the 'N/A' (no available memory level) metrics and the associated percentage calculation for the single cache line view. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adam Li Cc: Alexander Shishkin Cc: Ali Saidi Cc: Alyssa Ross Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Joe Mario Cc: Kajol Jain Cc: Kan Liang Cc: Li Huafei Cc: Like Xu Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220518055729.1869566-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 98450637107254242dc71675b0ce98d582d5fcb9 Author: Leo Yan Date: Wed May 18 13:57:19 2022 +0800 perf mem: Add stats for store operation with no available memory level Sometimes we don't know memory store operations happen on exactly which memory (or cache) level, the memory level flag is set to PERF_MEM_LVL_NA in this case; a practical example is Arm SPE AUX trace sets this flag for all store operations due to absent info for cache level. This patch is to add a new item "st_na" in structure c2c_stats to add statistics for store operations with no available cache level. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adam Li Cc: Alexander Shishkin Cc: Ali Saidi Cc: Alyssa Ross Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Joe Mario Cc: Kajol Jain Cc: Kan Liang Cc: Li Huafei Cc: Like Xu Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220518055729.1869566-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 508c9fbce0d30da3cdfe699ae5530aed82a09399 Author: Ian Rogers Date: Fri May 20 14:18:26 2022 -0700 perf build: Error for BPF skeletons without LIBBPF LIBBPF requires LIBELF so doing "make BUILD_BPF_SKEL=1 NO_LIBELF=1" fails with compiler errors about missing declarations. Similar could happen if libbpf feature detection fails. Prefer to error when BUILD_BPF_SKEL is enabled but LIBBPF isn't. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: Mark Rutland Cc: Martin KaFai Lau Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220520211826.1828180-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 0869331fbaa2c11c9e94e45305d17ce447189a0a Merge: e0e14cdff31d3 4b0986a3613c9 Author: Arnaldo Carvalho de Melo Date: Mon May 23 09:32:49 2022 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To get the rest of 5.18. Signed-off-by: Arnaldo Carvalho de Melo commit 5d05426e2d5fd7df8afc866b78c36b37b00188b7 Author: Ming Lei Date: Sun May 22 20:23:50 2022 +0800 blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns. So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset. Cc: "yukuai (C)" Cc: Jan Kara Fixes: b6e68ee82585 ("blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues") Signed-off-by: Ming Lei Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220522122350.743103-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c1770918492414e8dc103d996f3f3860ee0bfd6c Author: Helge Deller Date: Tue May 17 17:14:03 2022 +0200 parisc: Optimize tmpalias function calls Instead of converting the physical address of the tmpalias mapping to the tlb insert format inside all the various tmpalias functions, move this conversion over to the DTLB miss handler. The physical address is already in %r26 (or will be calculated into %r23), so there are no additional steps needed in the functions themselves. Additionally use the dep_safe() and depi_safe() macros to avoid differentiating between 32- and 64-bit builds and as such make the code much more readable. The check if "ldil L%(TMPALIAS_MAP_START)" will sign extend into the upper 32 bits can be dropped, because we added a compile time check in an earlier patch. Signed-off-by: Helge Deller commit cdd00fe6aa52870b54797e1386aac6202d916763 Author: Helge Deller Date: Tue May 17 17:03:01 2022 +0200 parisc: Add dep_safe() macro to deposit a register in 32- and 64-kernels Signed-off-by: Helge Deller commit be6aee1392c46cd6f537aea75b1ce7ec427d36f4 Author: Helge Deller Date: Tue May 17 17:01:12 2022 +0200 parisc: Fix wrong comment for shr macro The comment that the source and target register can not be the same is wrong. Instead on PA2.0 usage of extru can clobber upper 32-bits. This patch fixes the comment. Signed-off-by: Helge Deller commit 44eeb9b56774c6f87155132a92252410e4610384 Author: Helge Deller Date: Tue May 17 16:57:06 2022 +0200 parisc: Prevent ldil() to sign-extend into upper 32 bits Add some build time checks to prevent that the various usages of "ldil L%(TMPALIAS_MAP_START), %reg" sign-extends into the upper 32 bits when building a 64-bit kernel. Signed-off-by: Helge Deller commit c64c782e58ac5bb3601aa77b860ca4e93a489b7a Author: John David Anglin Date: Sun May 15 22:47:04 2022 +0000 parisc: Don't hardcode assembler bit definitions in tmpalias code Remove the hardcoded bit definitions in the tmpalias assembly code. This makes it easy to change the size of the tmpalias region. The alignment of the tmpalias region is reduced from 16 MB to 8 MB. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 1fc7db2401d62df5a0b19250ddf3bb89d430dd86 Author: John David Anglin Date: Wed Mar 30 14:42:30 2022 +0000 parisc: Don't enforce DMA completion order in cache flushes The only place we need to ensure all outstanding cache coherence operations are complete is in invalidate_kernel_vmap_range. All parisc drivers synchronize DMA operations internally and do not call invalidate_kernel_vmap_range. We only need this for non-coherent I/O operations. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 41dc0b53bcb1be3840bd616aea67f5b73400c169 Author: Helge Deller Date: Tue Apr 5 12:16:15 2022 +0200 parisc: video: fbdev: stifb: Add sti_dump_font() to dump STI font Add a function to dump the STI ROM fonts. Signed-off-by: Helge Deller commit 5e469829baa1b1320e843adf3631edef1d6d2cf2 Author: Mickaël Salaün Date: Fri May 13 13:27:43 2022 +0200 landlock: Explain how to support Landlock Let's help users by documenting how to enable and check for Landlock in the kernel and the running system. The userspace-api section may not be the best place for this but it still makes sense to put all the user documentation at the same place. Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220513112743.156414-1-mic@digikod.net Reviewed-by: Paul Moore commit 9e0c76b9f1faac0a8ea4b42e2f844ea26106f140 Author: Mickaël Salaün Date: Fri May 6 18:11:02 2022 +0200 landlock: Add design choices documentation for filesystem access rights Summarize the rationale of filesystem access rights according to the file type. Update the document date. Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-13-mic@digikod.net commit 09340cf4135f942d56742b36aaa3c37738aba000 Author: Mickaël Salaün Date: Fri May 6 18:11:01 2022 +0200 landlock: Document good practices about filesystem policies Explain how to set access rights per hierarchy in an efficient and safe way, especially with the LANDLOCK_ACCESS_FS_REFER side effect (i.e. partial ordering and constraints for access rights per hierarchy). Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-12-mic@digikod.net commit 6f59abfae35fbbe688ff790ff9638576956d760c Author: Mickaël Salaün Date: Fri May 6 18:11:00 2022 +0200 landlock: Document LANDLOCK_ACCESS_FS_REFER and ABI versioning Add LANDLOCK_ACCESS_FS_REFER in the example and properly check to only use it if the current kernel support it thanks to the Landlock ABI version. Move the file renaming and linking limitation to a new "Previous limitations" section. Improve documentation about the backward and forward compatibility, including the rational for ruleset's handled_access_fs. Update the document date. Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-11-mic@digikod.net commit 76b902f874ff4de9c1078489d4c7678a64105ea6 Author: Mickaël Salaün Date: Fri May 6 18:10:59 2022 +0200 samples/landlock: Add support for file reparenting Add LANDLOCK_ACCESS_FS_REFER to the "roughly write" access rights and leverage the Landlock ABI version to only try to enforce it if it is supported by the running kernel. Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-10-mic@digikod.net commit f4056b9266b571c63f30cda70c2d89f7b7e8bb7b Author: Mickaël Salaün Date: Fri May 6 18:10:58 2022 +0200 selftests/landlock: Add 11 new test suites dedicated to file reparenting These test suites try to check all edge cases for directory and file renaming or linking involving a new parent directory, with and without LANDLOCK_ACCESS_FS_REFER and other access rights. layout1: * reparent_refer: Tests simple FS_REFER usage. * reparent_link: Tests a mix of FS_MAKE_REG and FS_REFER with links. * reparent_rename: Tests a mix of FS_MAKE_REG and FS_REFER with renames and RENAME_EXCHANGE. * reparent_exdev_layers_rename1/2: Tests renames with two layers. * reparent_exdev_layers_exchange1/2/3: Tests exchanges with two layers. * reparent_remove: Tests file and directory removal with rename. * reparent_dom_superset: Tests access partial ordering. layout1_bind: * reparent_cross_mount: Tests FS_REFER propagation across mount points. Test coverage for security/landlock is 95.4% of 604 lines according to gcc/gcov-11. Cc: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-9-mic@digikod.net commit b91c3e4ea756b12b7d992529226edce1cfd854d7 Author: Mickaël Salaün Date: Fri May 6 18:10:57 2022 +0200 landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER Add a new LANDLOCK_ACCESS_FS_REFER access right to enable policy writers to allow sandboxed processes to link and rename files from and to a specific set of file hierarchies. This access right should be composed with LANDLOCK_ACCESS_FS_MAKE_* for the destination of a link or rename, and with LANDLOCK_ACCESS_FS_REMOVE_* for a source of a rename. This lift a Landlock limitation that always denied changing the parent of an inode. Renaming or linking to the same directory is still always allowed, whatever LANDLOCK_ACCESS_FS_REFER is used or not, because it is not considered a threat to user data. However, creating multiple links or renaming to a different parent directory may lead to privilege escalations if not handled properly. Indeed, we must be sure that the source doesn't gain more privileges by being accessible from the destination. This is handled by making sure that the source hierarchy (including the referenced file or directory itself) restricts at least as much the destination hierarchy. If it is not the case, an EXDEV error is returned, making it potentially possible for user space to copy the file hierarchy instead of moving or linking it. Instead of creating different access rights for the source and the destination, we choose to make it simple and consistent for users. Indeed, considering the previous constraint, it would be weird to require such destination access right to be also granted to the source (to make it a superset). Moreover, RENAME_EXCHANGE would also add to the confusion because of paths being both a source and a destination. See the provided documentation for additional details. New tests are provided with a following commit. Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-8-mic@digikod.net commit 100f59d964050020285f0c8264ce520f0c406c13 Author: Mickaël Salaün Date: Fri May 6 18:10:56 2022 +0200 LSM: Remove double path_rename hook calls for RENAME_EXCHANGE In order to be able to identify a file exchange with renameat2(2) and RENAME_EXCHANGE, which will be useful for Landlock [1], propagate the rename flags to LSMs. This may also improve performance because of the switch from two set of LSM hook calls to only one, and because LSMs using this hook may optimize the double check (e.g. only one lock, reduce the number of path walks). AppArmor, Landlock and Tomoyo are updated to leverage this change. This should not change the current behavior (same check order), except (different level of) speed boosts. [1] https://lore.kernel.org/r/20220221212522.320243-1-mic@digikod.net Cc: James Morris Cc: Kentaro Takeda Cc: Serge E. Hallyn Acked-by: John Johansen Acked-by: Tetsuo Handa Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-7-mic@digikod.net commit 9da82b20fde95814af721a2a7b1796a5b4a3d78e Author: Mickaël Salaün Date: Fri May 6 18:10:55 2022 +0200 landlock: Move filesystem helpers and add a new one Move the SB_NOUSER and IS_PRIVATE dentry check to a standalone is_nouser_or_private() helper. This will be useful for a following commit. Move get_mode_access() and maybe_remove() to make them usable by new code provided by a following commit. Reviewed-by: Paul Moore Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506161102.525323-6-mic@digikod.net commit 8ba0005ff418ec356e176b26eaa04a6ac755d05b Author: Mickaël Salaün Date: Fri May 6 18:10:54 2022 +0200 landlock: Fix same-layer rule unions The original behavior was to check if the full set of requested accesses was allowed by at least a rule of every relevant layer. This didn't take into account requests for multiple accesses and same-layer rules allowing the union of these accesses in a complementary way. As a result, multiple accesses requested on a file hierarchy matching rules that, together, allowed these accesses, but without a unique rule allowing all of them, was illegitimately denied. This case should be rare in practice and it can only be triggered by the path_rename or file_open hook implementations. For instance, if, for the same layer, a rule allows execution beneath /a/b and another rule allows read beneath /a, requesting access to read and execute at the same time for /a/b should be allowed for this layer. This was an inconsistency because the union of same-layer rule accesses was already allowed if requested once at a time anyway. This fix changes the way allowed accesses are gathered over a path walk. To take into account all these rule accesses, we store in a matrix all layer granting the set of requested accesses, according to the handled accesses. To avoid heap allocation, we use an array on the stack which is 2*13 bytes. A following commit bringing the LANDLOCK_ACCESS_FS_REFER access right will increase this size to reach 112 bytes (2*14*4) in case of link or rename actions. Add a new layout1.layer_rule_unions test to check that accesses from different rules pertaining to the same layer are ORed in a file hierarchy. Also test that it is not the case for rules from different layers. Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20220506161102.525323-5-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 2cd7cd6eed88b8383cfddce589afe9c0ae1d19b4 Author: Mickaël Salaün Date: Fri May 6 18:10:53 2022 +0200 landlock: Create find_rule() from unmask_layers() This refactoring will be useful in a following commit. Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20220506161102.525323-4-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 75c542d6c6cc48720376862d5496d51509160dfd Author: Mickaël Salaün Date: Fri May 6 18:10:52 2022 +0200 landlock: Reduce the maximum number of layers to 16 The maximum number of nested Landlock domains is currently 64. Because of the following fix and to help reduce the stack size, let's reduce it to 16. This seems large enough for a lot of use cases (e.g. sandboxed init service, spawning a sandboxed SSH service, in nested sandboxed containers). Reducing the number of nested domains may also help to discover misuse of Landlock (e.g. creating a domain per rule). Add and use a dedicated layer_mask_t typedef to fit with the number of layers. This might be useful when changing it and to keep it consistent with the maximum number of layers. Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20220506161102.525323-3-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 5f2ff33e10843ef51275c8611bdb7b49537aba5d Author: Mickaël Salaün Date: Fri May 6 18:10:51 2022 +0200 landlock: Define access_mask_t to enforce a consistent access mask size Create and use the access_mask_t typedef to enforce a consistent access mask size and uniformly use a 16-bits type. This will helps transition to a 32-bits value one day. Add a build check to make sure all (filesystem) access rights fit in. This will be extended with a following commit. Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20220506161102.525323-2-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 6533d0c3a86ee1cc74ff37ac92ca597deb87015c Author: Mickaël Salaün Date: Fri May 6 18:08:20 2022 +0200 selftests/landlock: Test landlock_create_ruleset(2) argument check ordering Add inval_create_ruleset_arguments, extension of inval_create_ruleset_flags, to also check error ordering for landlock_create_ruleset(2). This is similar to the previous commit checking landlock_add_rule(2). Test coverage for security/landlock is 94.4% of 504 lines accorging to gcc/gcov-11. Link: https://lore.kernel.org/r/20220506160820.524344-11-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit fe7324b932222574a0721b80e72c6c5fe57960d1 Author: Luiz Angelo Daros de Luca Date: Sun May 22 22:32:34 2022 -0300 net: dsa: OF-ware slave_mii_bus If found, register the DSA internally allocated slave_mii_bus with an OF "mdio" child object. It can save some drivers from creating their custom internal MDIO bus. Signed-off-by: Luiz Angelo Daros de Luca Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit eba39ca4b155c54adf471a69e91799cc1727873f Author: Mickaël Salaün Date: Fri May 6 18:08:19 2022 +0200 landlock: Change landlock_restrict_self(2) check ordering According to the Landlock goal to be a security feature available to unprivileges processes, it makes more sense to first check for no_new_privs before checking anything else (i.e. syscall arguments). Merge inval_fd_enforce and unpriv_enforce_without_no_new_privs tests into the new restrict_self_checks_ordering. This is similar to the previous commit checking other syscalls. Link: https://lore.kernel.org/r/20220506160820.524344-10-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 589172e5636c4d16c40b90e87543d43defe2d968 Author: Mickaël Salaün Date: Fri May 6 18:08:18 2022 +0200 landlock: Change landlock_add_rule(2) argument check ordering This makes more sense to first check the ruleset FD and then the rule attribute. It will be useful to factor out code for other rule types. Add inval_add_rule_arguments tests, extension of empty_path_beneath_attr tests, to also check error ordering for landlock_add_rule(2). Link: https://lore.kernel.org/r/20220506160820.524344-9-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit d1788ad990874734341b05ab8ccb6448c09c6422 Author: Mickaël Salaün Date: Fri May 6 18:08:17 2022 +0200 selftests/landlock: Add tests for O_PATH The O_PATH flag is currently not handled by Landlock. Let's make sure this behavior will remain consistent with the same ruleset over time. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-8-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 6a1bdd4a0bfc30fa4fa2b3a979e6525f28996db9 Author: Mickaël Salaün Date: Fri May 6 18:08:16 2022 +0200 selftests/landlock: Fully test file rename with "remove" access These tests were missing to check the check_access_path() call with all combinations of maybe_remove(old_dentry) and maybe_remove(new_dentry). Extend layout1.link with a new complementary test and check that REMOVE_FILE is not required to link a file. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-7-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit d18955d094d09a220cf8f533f5e896a2fe31575a Author: Mickaël Salaün Date: Fri May 6 18:08:15 2022 +0200 selftests/landlock: Extend access right tests to directories Make sure that all filesystem access rights can be tied to directories. Rename layout1.file_access_rights to layout1.file_and_dir_access_rights to reflect this change. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-6-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit c56b3bf566da5a0dd3b58ad97a614b0928b06ebf Author: Mickaël Salaün Date: Fri May 6 18:08:14 2022 +0200 selftests/landlock: Add tests for unknown access rights Make sure that trying to use unknown access rights returns an error. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-5-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 291865bd7e8bb4b4033d341fa02dafa728e6378c Author: Mickaël Salaün Date: Fri May 6 18:08:13 2022 +0200 selftests/landlock: Extend tests for minimal valid attribute size This might be useful when the struct landlock_ruleset_attr will get more fields. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-4-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 87129ef13603ae46c82bcd09eed948acf0506dbb Author: Mickaël Salaün Date: Fri May 6 18:08:12 2022 +0200 selftests/landlock: Make tests build with old libc Replace SYS_ with __NR_. Using the __NR_ notation, provided by UAPI, is useful to build tests on systems without the SYS_ definitions. Replace SYS_pivot_root with __NR_pivot_root, and SYS_move_mount with __NR_move_mount. Define renameat2() and RENAME_EXCHANGE if they are unknown to old build systems. Cc: Shuah Khan Link: https://lore.kernel.org/r/20220506160820.524344-3-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit a13e248ff90e81e9322406c0e618cf2168702f4e Author: Mickaël Salaün Date: Fri May 6 18:08:11 2022 +0200 landlock: Fix landlock_add_rule(2) documentation It is not mandatory to pass a file descriptor obtained with the O_PATH flag. Also, replace rule's accesses with ruleset's accesses. Link: https://lore.kernel.org/r/20220506160820.524344-2-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 81709f3dccacf4104a4bc2daa80bdd767a9c4c54 Author: Mickaël Salaün Date: Fri May 6 18:05:13 2022 +0200 samples/landlock: Format with clang-format Let's follow a consistent and documented coding style. Everything may not be to our liking but it is better than tacit knowledge. Moreover, this will help maintain style consistency between different developers. This contains only whitespace changes. Automatically formatted with: clang-format-14 -i samples/landlock/*.[ch] Link: https://lore.kernel.org/r/20220506160513.523257-8-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 9805a722db071e1772b80e6e0ff33f35355639ac Author: Mickaël Salaün Date: Fri May 6 18:05:12 2022 +0200 samples/landlock: Add clang-format exceptions In preparation to a following commit, add clang-format on and clang-format off stanzas around constant definitions. This enables to keep aligned values, which is much more readable than packed definitions. Link: https://lore.kernel.org/r/20220506160513.523257-7-mic@digikod.net Cc: stable@vger.kernel.org Signed-off-by: Mickaël Salaün commit 371183fa578a4cf56b3ae12e54b7f01a4249add1 Author: Mickaël Salaün Date: Fri May 6 18:05:11 2022 +0200 selftests/landlock: Format with clang-format Let's follow a consistent and documented coding style. Everything may not be to our liking but it is better than tacit knowledge. Moreover, this will help maintain style consistency between different developers. This contains only whitespace changes. Automatically formatted with: clang-format-14 -i tools/testing/selftests/landlock/*.[ch] Link: https://lore.kernel.org/r/20220506160513.523257-6-mic@digikod.net Cc: stable@vger.kernel.org [mic: Update style according to https://lore.kernel.org/r/02494cb8-2aa5-1769-f28d-d7206f284e5a@digikod.net] Signed-off-by: Mickaël Salaün commit 32c53420d2a0c2c3a691edb895d90d9d028ca3e0 Author: Jakub Kicinski Date: Wed May 18 20:13:45 2022 -0700 eth: de4x5: remove support for Generic DECchip & DIGITAL EtherWORKS PCI/EISA Looks like almost all changes to this driver had been tree-wide refactoring since git era begun. There is one commit from Al 15 years ago which could potentially be fixing a real bug. The driver is using virt_to_bus() and is a real magnet for pointless cleanups. It seems unlikely to have real users. Let's try to shed this maintenance burden. Signed-off-by: Jakub Kicinski Acked-by: Michael Ellerman (powerpc) Acked-by: Arnd Bergmann Signed-off-by: David S. Miller commit 0097e86c8ec5a68f20bc1ae19f5c21fb0e751f83 Author: Dan Carpenter Date: Thu May 19 17:08:00 2022 +0300 net: ethernet: mtk_eth_soc: fix error code in mtk_flow_offload_replace() Preserve the error code from mtk_foe_entry_commit(). Do not return success. Fixes: c4f033d9e03e ("net: ethernet: mtk_eth_soc: rework hardware flow table management") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit dccd855771b37820b6d976a99729c88259549f85 Author: Vasily Averin Date: Sun May 22 15:08:02 2022 +0300 fanotify: fix incorrect fmode_t casts Fixes sparce warnings: fs/notify/fanotify/fanotify_user.c:267:63: sparse: warning: restricted fmode_t degrades to integer fs/notify/fanotify/fanotify_user.c:1351:28: sparse: warning: restricted fmode_t degrades to integer FMODE_NONTIFY have bitwise fmode_t type and requires __force attribute for any casts. Signed-off-by: Vasily Averin Reviewed-by: Christian Brauner (Microsoft) Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/9adfd6ac-1b89-791e-796b-49ada3293985@openvz.org commit 682a8c633fc32933a73fd0379c62d37d1346055d Merge: 1e39b27bd9d12 a4e044dc4c5b1 Author: David S. Miller Date: Mon May 23 10:40:10 2022 +0100 Merge branch 'dsa-multi-cpu-port-part-two' Vladimir Oltean says: ==================== DSA changes for multiple CPU ports (part 2) As explained in part 1: https://patchwork.kernel.org/project/netdevbpf/cover/20220511095020.562461-1-vladimir.oltean@nxp.com/ I am trying to enable the second internal port pair from the NXP LS1028A Felix switch for DSA-tagged traffic via "ocelot-8021q". This series represents part 2 (of an unknown number) of that effort. This series deals only with a minor bug fix (first patch) and with code reorganization in the Felix DSA driver and in the Ocelot switch library. Hopefully this will lay the ground for a clean introduction of new UAPI for changing the DSA master of a user port in part 3. ==================== Signed-off-by: David S. Miller commit a4e044dc4c5b1e03f4195224c47108dc44122917 Author: Vladimir Oltean Date: Sun May 22 00:37:43 2022 +0300 net: dsa: felix: tag_8021q preparation for multiple CPU ports Update the VCAP filters to support multiple tag_8021q CPU ports. TX works using a filter for VLAN ID on the ingress of the CPU port, with a redirect and a VLAN pop action. This can be updated trivially by amending the ingress port mask of this rule to match on all tag_8021q CPU ports. RX works using a filter for ingress port on the egress of the CPU port, with a VLAN push action. Here we need to replicate these filters for each tag_8021q CPU port, and let them all have the same action. This means that the OCELOT_VCAP_ES0_TAG_8021Q_RXVLAN() cookie needs to encode a unique value for every {user port, CPU port} pair it's given. Do this by encoding the CPU port in the upper 16 bits of the cookie, and the user port in the lower 16 bits. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit c295f9831f1db12330d6a28a1cb2bd2562535e37 Author: Vladimir Oltean Date: Sun May 22 00:37:42 2022 +0300 net: mscc: ocelot: switch from {,un}set to {,un}assign for tag_8021q CPU ports There is a desire for the felix driver to gain support for multiple tag_8021q CPU ports, but the current model prevents it. This is because ocelot_apply_bridge_fwd_mask() only takes into consideration whether a port is a tag_8021q CPU port, but not whose CPU port it is. We need a model where we can have a direct affinity between an ocelot port and a tag_8021q CPU port. This serves as the basis for multiple CPU ports. Declare a "dsa_8021q_cpu" backpointer in struct ocelot_port which encodes that affinity. Repurpose the "ocelot_set_dsa_8021q_cpu" API to "ocelot_assign_dsa_8021q_cpu" to express the change of paradigm. Note that this change makes the first practical use of the new ocelot_port->index field in ocelot_port_unassign_dsa_8021q_cpu(), where we need to remove the old tag_8021q CPU port from the reserved VLAN range. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 8c166acb60f8284470db673b6dccd43e6fedfae2 Author: Vladimir Oltean Date: Sun May 22 00:37:41 2022 +0300 net: dsa: felix: directly call ocelot_port_{set,unset}_dsa_8021q_cpu Absorb the final details of calling ocelot_port_{,un}set_dsa_8021q_cpu(), i.e. the need to lock &ocelot->fwd_domain_lock, into the callee, to simplify the caller and permit easier code reuse later. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit a72e23dd679c632bcf6ab47a3a1a58c1e777713a Author: Vladimir Oltean Date: Sun May 22 00:37:40 2022 +0300 net: dsa: felix: update bridge fwd mask from ocelot lib when changing tag_8021q CPU Add more logic to ocelot_port_{,un}set_dsa_8021q_cpu() from the ocelot switch lib by encapsulating the ocelot_apply_bridge_fwd_mask() call that felix used to have. This is necessary because the CPU port change procedure will also need to do this, and it's good to reduce code duplication by having an entry point in the ocelot switch lib that does all that is needed. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 61be79ba2d90162b0b213384f35eb8db7eb183b8 Author: Vladimir Oltean Date: Sun May 22 00:37:39 2022 +0300 net: dsa: felix: move the updating of PGID_CPU to the ocelot lib PGID_CPU must be updated every time a port is configured or unconfigured as a tag_8021q CPU port. The ocelot switch lib already has a hook for that operation, so move the updating of PGID_CPU to those hooks. These bits are pretty specific to DSA, so normally I would keep them out of the common switch lib, but when tag_8021q is in use, this has implications upon the forwarding mask determined by ocelot_apply_bridge_fwd_mask() and called extensively by the switch lib. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 129b7532a0edc3f381a6c5f3bb1a155e743d141b Author: Vladimir Oltean Date: Sun May 22 00:37:38 2022 +0300 net: dsa: fix missing adjustment of host broadcast flooding PGID_BC is configured statically by ocelot_init() to flood towards the CPU port module, and dynamically by ocelot_port_set_bcast_flood() towards all user ports. When the tagging protocol changes, the intention is to turn off flooding towards the old pipe towards the host, and to turn it on towards the new pipe. Due to a recent change which removed the adjustment of PGID_BC from felix_set_host_flood(), 3 things happen. - when we change from NPI to tag_8021q mode: in this mode, the CPU port module is accessed via registers, and used to read PTP packets with timestamps. We fail to disable broadcast flooding towards the CPU port module, and to enable broadcast flooding towards the physical port that serves as a DSA tag_8021q CPU port. - from tag_8021q to NPI mode: in this mode, the CPU port module is redirected to a physical port. We fail to disable broadcast flooding towards the physical tag_8021q CPU port, and to enable it towards the CPU port module at ocelot->num_phys_ports. - when the ports are put in promiscuous mode, we also fail to update PGID_BC towards the host pipe of the current protocol. First issue means that felix_check_xtr_pkt() has to do extra work, because it will not see only PTP packets, but also broadcasts. It needs to dequeue these packets just to drop them. Third issue is inconsequential, since PGID_BC is allocated from the nonreserved multicast PGID space, and these PGIDs are conveniently initialized to 0x7f (i.e. flood towards all ports except the CPU port module). Broadcasts reach the NPI port via ocelot_init(), and reach the tag_8021q CPU port via the hardware defaults. Second issue is also inconsequential, because we fail both at disabling and at enabling broadcast flooding on a port, so the defaults mentioned above are preserved, and they are fine except for the performance impact. Fixes: 7a29d220f4c0 ("net: dsa: felix: reimplement tagging protocol change with function pointers") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 84aa85108b1b8af0d1d310e76975f421c5975e66 Author: Maciej W. Rozycki Date: Sun May 22 21:48:14 2022 +0100 MIPS: Rewrite `csum_tcpudp_nofold' in plain C Recent commit 198688edbf77 ("MIPS: Fix inline asm input/output type mismatch in checksum.h used with Clang") introduced a code size and performance regression with 64-bit code emitted for `csum_tcpudp_nofold' by GCC, caused by a redundant truncation operation produced due to a data type change made to the variable associated with the inline assembly's output operand. The intent previously expressed here with operands and constraints for optimal code was to have the output operand share a register with one inputs, both of a different integer type each. This is perfectly valid with the MIPS psABI where a register can hold integer data of different types and the assembly code used here makes data stored in the output register match the data type used with the output operand, however it has turned out impossible to express this arrangement in source code such as to satisfy LLVM, apparently due to the compiler's internal limitations. There is nothing peculiar about the inline assembly `csum_tcpudp_nofold' includes however, though it does choose assembly instructions carefully. Rewrite this piece of assembly in plain C then, using corresponding C language operations, making GCC produce the same assembly instructions, possibly shuffled, in the general case and sometimes actually fewer of them where an input is constant, because the compiler does not have to reload it to a register (operand constraints could be adjusted for that, but the plain C approach is cleaner anyway). Example code size changes are as follows, for a 32-bit configuration: text data bss total filename 5920480 1347236 126592 7394308 vmlinux-old 5920480 1347236 126592 7394308 vmlinux-now 5919728 1347236 126592 7393556 vmlinux-c and for a 64-bit configuration: text data bss total filename 6024112 1790828 225728 8040668 vmlinux-old 6024128 1790828 225728 8040684 vmlinux-now 6023760 1790828 225728 8040316 vmlinux-c respectively, where "old" is with the commit referred reverted, "now" is with no change, and "c" is with this change applied. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit 88ca100c885f967c37f3d60d5225a639ed6bd6f1 Author: 陈学兵 Date: Sun May 22 15:46:18 2022 +0800 mips: setup: use strscpy to replace strlcpy The strlcpy should not be used because it doesn't limit the source length. Preferred is strscpy. Signed-off-by: XueBing Chen Signed-off-by: Thomas Bogendoerfer commit e001897da62eb543ef79bf173f145c2c9677f66c Merge: f8d9f46e87e51 9f04b55f003cc 23587f7c5daa9 Author: Vlastimil Babka Date: Mon May 23 11:14:32 2022 +0200 Merge branches 'slab/for-5.19/stackdepot' and 'slab/for-5.19/refactor' into slab/for-linus commit 07bdec3cdc92a1f8ede0b904d54f440f69c26704 Author: Stijn Tintel Date: Wed May 18 19:48:10 2022 +0300 MIPS: Octeon: add SNIC10E board The CN6640-SNIC10E-G and CN6640-SNIC10E-1.1-G PCIe NICs are based on this board. Signed-off-by: Stijn Tintel Signed-off-by: Thomas Bogendoerfer commit f74b057352a063317ecd8cf44c42d86304632eec Author: 周琰杰 (Zhou Yanjie) Date: Fri May 13 03:33:41 2022 +0800 MIPS: Ingenic: Refresh defconfig for CU1000-Neo and CU1830-Neo. Refresh the defconfig files of CU1000-Neo board and CU1830-Neo board, remove the selection of SPI-GPIO, and add the selection of SSI. Signed-off-by: 周琰杰 (Zhou Yanjie) Signed-off-by: Thomas Bogendoerfer commit 562dc4c9c2c1662bcfedf7026860ff306c969d70 Author: 周琰杰 (Zhou Yanjie) Date: Fri May 13 03:33:40 2022 +0800 MIPS: Ingenic: Refresh device tree for Ingenic SoCs and boards. 1.Add SSI nodes for X1000 SoC and X1830 SoC from Ingenic. 2.Refresh SSI related nodes in CU1000-Neo and CU1830-Neo. 3.The X1830 SoC used by the CU1830-Neo and the X1000 SoC used by the CU1000-Neo are both single-core processors, therefore the "OST_CLK_PERCPU_TIMER" ABI should not be used in the OST nodes of the CU1830-Neo and CU1000-Neo, it is just a coincidence that there is no problem now. So replace the misused "OST_CLK_PERCPU_TIMER" ABI with the correct "OST_CLK_EVENT_TIMER" ABI. Signed-off-by: 周琰杰 (Zhou Yanjie) Signed-off-by: Thomas Bogendoerfer commit b2a5df71345c0aad3b06600722edb5364220ee65 Author: 周琰杰 (Zhou Yanjie) Date: Fri May 13 03:33:39 2022 +0800 MIPS: Ingenic: Add PWM nodes for X1830. Add PWM node for X1830 SoC from Ingenic. Signed-off-by: 周琰杰 (Zhou Yanjie) Signed-off-by: Thomas Bogendoerfer commit 0ea917819d12fed41ea4662cc26ffa0060a5c354 Author: Jani Nikula Date: Fri May 20 12:46:00 2022 +0300 drm/i915/dsi: fix VBT send packet port selection for ICL+ The VBT send packet port selection was never updated for ICL+ where the 2nd link is on port B instead of port C as in VLV+ DSI. First, single link DSI needs to use the configured port instead of relying on the VBT sequence block port. Remove the hard-coded port C check here and make it generic. For reference, see commit f915084edc5a ("drm/i915: Changes related to the sequence port no for") for the original VLV specific fix. Second, the sequence block port number is either 0 or 1, where 1 indicates the 2nd link. Remove the hard-coded port C here for 2nd link. (This could be a "find second set bit" on DSI ports, but just check the two possible options.) Third, sanity check the result with a warning to avoid a NULL pointer dereference. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5984 Cc: stable@vger.kernel.org # v4.19+ Cc: Ville Syrjala Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220520094600.2066945-1-jani.nikula@intel.com (cherry picked from commit 08c59dde71b73a0ac94e3ed2d431345b01f20485) commit f998c204a19a3d49a49adfd7172fb15c3f0484ea Author: Julia Lawall Date: Sat May 21 13:11:15 2022 +0200 MIPS: Octeon: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Thomas Bogendoerfer commit 6ad5ec543211805d4a32370e06cafee44104484c Author: Juerg Haefliger Date: Fri May 20 13:51:13 2022 +0200 MIPS: loongson32: Kconfig: Remove extra space Remove extra space between 'prompt' keyword and string. Signed-off-by: Juerg Haefliger Signed-off-by: Thomas Bogendoerfer commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d Author: liuyacan Date: Mon May 23 13:50:56 2022 +0800 net/smc: fix listen processing for SMC-Rv2 In the process of checking whether RDMAv2 is available, the current implementation first sets ini->smcrv2.ib_dev_v2, and then allocates smc buf desc, but the latter may fail. Unfortunately, the caller will only check the former. In this case, a NULL pointer reference will occur in smc_clc_send_confirm_accept() when accessing conn->rmb_desc. This patch does two things: 1. Use the return code to determine whether V2 is available. 2. If the return code is NODEV, continue to check whether V1 is available. Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2") Signed-off-by: liuyacan Signed-off-by: David S. Miller commit 75c1edf23b95a9c66923d9269d8e86e4dbde151f Author: liuyacan Date: Mon May 23 12:57:07 2022 +0800 net/smc: postpone sk_refcnt increment in connect() Same trigger condition as commit 86434744. When setsockopt runs in parallel to a connect(), and switch the socket into fallback mode. Then the sk_refcnt is incremented in smc_connect(), but its state stay in SMC_INIT (NOT SMC_ACTIVE). This cause the corresponding sk_refcnt decrement in __smc_release() will not be performed. Fixes: 86434744fedf ("net/smc: add fallback check to connect()") Signed-off-by: liuyacan Signed-off-by: David S. Miller commit 1c6fd59943a630f087b4b3089aefdcb0bf43cca0 Merge: a5c7a39f508ae 701850dc0c31b Author: Petr Mladek Date: Mon May 23 10:55:39 2022 +0200 Merge branch 'rework/kthreads' into for-linus commit be80a1ca5119c5d31b6019d5e6dc6d9123bda959 Merge: 2aeb1f5fbbacb 13088b65d93a1 Author: Borislav Petkov Date: Mon May 23 10:19:30 2022 +0200 Merge branches 'edac-misc' and 'edac-alloc-cleanup' into edac-updates-for-v5.19 Combine all collected EDAC changes for submission into v5.19: * edac-misc: EDAC/xgene: Fix typo processsors -> processors EDAC/i5100: Remove unused inline function i5100_nrecmema_dm_buf_id() EDAC/ghes: Change ghes_hw from global to static EDAC/armada_xp: Use devm_platform_ioremap_resource() EDAC/synopsys: Add a SPDX identifier EDAC/synopsys: Add driver support for i.MX platforms EDAC/dmc520: Don't print an error for each unconfigured interrupt line efi/cper: Reformat CPER memory error location to more readable EDAC/ghes: Unify CPER memory error location reporting efi/cper: Add a cper_mem_err_status_str() to decode error description powerpc/85xx: Remove fsl,85... bindings * edac-alloc-cleanup: EDAC: Use kcalloc() EDAC/mc: Get rid of edac_align_ptr() EDAC/device: Sanitize edac_device_alloc_ctl_info() definition EDAC/device: Get rid of the silly one-shot memory allocation in edac_device_alloc_ctl_info() EDAC/pci: Get rid of the silly one-shot memory allocation in edac_pci_alloc_ctl_info() EDAC/mc: Get rid of silly one-shot struct allocation in edac_mc_alloc() Signed-off-by: Borislav Petkov commit 83da38d82b2f7ac207646e55be94e8bd642e2c39 Author: Stafford Horne Date: Sat May 21 10:39:30 2022 +0900 openrisc: Allow power off handler overriding The OpenRISC platform always defines a default pm_power_off hanlder which is only useful for simulators. Having this set also means power management drivers like syscon-power are not able to wire in their own pm_power_off handlers. Fix this by not setting the pm_power_off handler by default and fallback to the simulator power off handler if no handler is set. This has been tested with a new OpenRISC virt platform I am working on for QEMU. https://github.com/stffrdhrn/qemu/commits/or1k-virt Cc: Jason A. Donenfeld Signed-off-by: Stafford Horne commit ed3a88d7dbbb924312a707d5f295b7a31e2f8d2d Author: Stafford Horne Date: Thu May 12 06:11:21 2022 +0900 openrisc: Remove unused IMMU tlb workardound This looks to be some historical code that was used to convert TLB misses on branches from l.bf, l.jal, l.j etc all to a trampoline using l.jr (jump register). I don't see this being used and I don't know the history of it so remove it. Signed-off-by: Stafford Horne commit d8fee3f6fa5a49b338d9149cf498d58e024e27f9 Author: Stafford Horne Date: Sun Feb 6 07:55:12 2022 +0900 openrisc/fault: Fix symbol scope warnings Sparse reported the following warning: arch/openrisc/mm/fault.c:27:15: warning: symbol 'pte_misses' was not declared. Should it be static? arch/openrisc/mm/fault.c:28:15: warning: symbol 'pte_errors' was not declared. Should it be static? arch/openrisc/mm/fault.c:33:16: warning: symbol 'current_pgd' was not declared. Should it be static? This patch fixes these by: - Remove unused pte_misses and pte_errors counters which are no longer used. - Add asm/mmu_context.h include to provide the current_pgd declaration. Signed-off-by: Stafford Horne commit 2f51d67e42a2b6e69d66a1b71cf06fac976177b5 Author: Stafford Horne Date: Sun Feb 6 07:52:24 2022 +0900 openrisc/delay: Add include to fix symbol not declared warning Add asm/timex.h include for read_current_timer prototype. Sparse reporting the following warning: arch/openrisc/lib/delay.c:23:5: warning: symbol 'read_current_timer' was not declared. Should it be static? Signed-off-by: Stafford Horne commit 5a344bbe88bf435bf40e22543b4595d6e6cb6556 Author: Stafford Horne Date: Sun Feb 6 07:45:59 2022 +0900 openrisc/time: Fix symbol scope warnings Spare reported the following warnings: arch/openrisc/kernel/time.c:64:1: warning: symbol 'clockevent_openrisc_timer' was not declared. Should it be static? arch/openrisc/kernel/time.c:66:6: warning: symbol 'openrisc_clockevent_init' was not declared. Should it be static? This patch fixes by: - Add static declaration to clockevent_openrisc_timer as it's used only in this file. - Add include for asm/time.h for openrisc_clockevent_init declaration. Signed-off-by: Stafford Horne commit 024b58f3d92de2d19e2222f841c103127ee54684 Author: Stafford Horne Date: Sat Feb 5 22:44:28 2022 +0900 openrisc/traps: Declare unhandled_exception for asmlinkage Noticed this when workin on warnings. As unhandled_exception is used in entry.S we should attribute it with asmlinkage. Signed-off-by: Stafford Horne commit de901d12df896ffab7f08b26a5abcbc5e720b455 Author: Stafford Horne Date: Sat Feb 5 22:41:41 2022 +0900 openrisc/traps: Remove die_if_kernel function This was noticed when I saw this warning: arch/openrisc/kernel/traps.c:234:6: warning: no previous prototype for 'die_if_kernel' [-Wmissing-prototypes] 234 | void die_if_kernel(const char *str, struct pt_regs *regs, long err) | ^~~~~~~~~~~~~ The die_if_kernel function is not used in the OpenRISC port so remove it. Signed-off-by: Stafford Horne commit f4b26b1a7b3e10b6e26078d80d035574b0975185 Author: Stafford Horne Date: Sat Feb 5 22:37:49 2022 +0900 openrisc/traps: Declare file scope symbols as static Sparse was reporting the following warnings: arch/openrisc/kernel/traps.c:37:5: warning: symbol 'kstack_depth_to_print' was not declared. Should it be static? arch/openrisc/kernel/traps.c:39:22: warning: symbol 'lwa_addr' was not declared. Should it be static? arch/openrisc/kernel/traps.c:41:6: warning: symbol 'print_trace' was not declared. Should it be static? The function print_trace and local variables kstack_depth_to_print and lwa_addr are not used outside of this file. This patch marks them as static. Signed-off-by: Stafford Horne commit fe47623a798b34ee38d02bfe4dbc529cccc78ad7 Author: Stafford Horne Date: Sat Feb 5 19:00:33 2022 +0900 openrisc: Update litex defconfig to support glibc userland I have been using a litex SoC for glibc verification. Update the default litex config to support required userspace API's needed for the full glibc testsuite to pass. This includes enabling the litex mmc driver and filesystems used in a typical litex environment. Signed-off-by: Stafford Horne commit 7d2ae3decda0bb7a9ce0fe4f728630d617c04dd9 Author: Stafford Horne Date: Sat Feb 5 17:54:13 2022 +0900 openrisc: Pretty print show_registers memory dumps Currently show registers, print memory dumps character by character and there is no address information, so its a bit difficult to use. For example before a stack dump looks as follows. [ 13.650000] Stack: [ 13.650000] Call trace [ 13.690000] [<(ptrval)>] ? put_timespec64+0x44/0x60 [ 13.690000] [<(ptrval)>] ? _data_page_fault_handler+0x104/0x10c [ 13.700000] [ 13.700000] Code: [ 13.700000] 13 [ 13.700000] ff [ 13.700000] ff [ 13.700000] f9 [ 13.710000] 84 [ 13.710000] 82 [ 13.710000] ff [ 13.710000] bc [ 13.710000] 07 [ 13.710000] fd [ 13.720000] 4e [ 13.720000] 67 [ 13.720000] 84 [ 13.720000] 62 [ 13.720000] ff ... This change updates this to print the address and data a word at time. [ 0.830000] Stack: [ 0.830000] Call trace: [ 0.830000] [<(ptrval)>] load_elf_binary+0x744/0xf5c [ 0.830000] [<(ptrval)>] ? __kernel_read+0x144/0x184 [ 0.830000] [<(ptrval)>] bprm_execve+0x27c/0x3e4 [ 0.830000] [<(ptrval)>] kernel_execve+0x16c/0x1a0 [ 0.830000] [<(ptrval)>] run_init_process+0xa0/0xec [ 0.830000] [<(ptrval)>] ? kernel_init+0x0/0x14c [ 0.830000] [<(ptrval)>] kernel_init+0x7c/0x14c [ 0.830000] [<(ptrval)>] ? calculate_sigpending+0x30/0x40 [ 0.830000] [<(ptrval)>] ret_from_fork+0x1c/0x84 [ 0.830000] [ 0.830000] c1033dbc: c1033dec [ 0.830000] c1033dc0: c015258c [ 0.830000] c1033dc4: c129da00 [ 0.830000] c1033dc8: 00000002 [ 0.830000] c1033dcc: 00000000 [ 0.830000] c1033dd0: c129da00 [ 0.830000] c1033dd4: 00000000 [ 0.830000] c1033dd8: 00000000 [ 0.830000] (c1033ddc:) 00001e04 [ 0.830000] c1033de0: 001501fc [ 0.830000] c1033de4: c1033e68 [ 0.830000] c1033de8: c0152e60 [ 0.830000] c1033dec: c129da5c [ 0.830000] c1033df0: c0674a20 [ 0.830000] c1033df4: c1033e50 [ 0.830000] c1033df8: c00e3d6c [ 0.830000] c1033dfc: c129da5c [ 0.830000] c1033e00: 00000003 [ 0.830000] c1033e04: 00150000 [ 0.830000] c1033e08: 00002034 [ 0.830000] c1033e0c: 001501fc [ 0.830000] c1033e10: 00000000 [ 0.830000] c1033e14: 00150000 [ 0.830000] c1033e18: 0014ebbc [ 0.830000] c1033e1c: 00002000 [ 0.830000] c1033e20: 00000003 [ 0.830000] c1033e24: c12a07e0 [ 0.830000] c1033e28: 00000000 [ 0.830000] c1033e2c: 00000000 [ 0.830000] c1033e30: 00000000 [ 0.830000] c1033e34: 40040000 [ 0.830000] c1033e38: 00000000 [ 0.830000] [ 0.830000] Code: [ 0.830000] c00047a4: 9c21fff8 [ 0.830000] c00047a8: d4012000 [ 0.830000] c00047ac: d4011804 [ 0.830000] c00047b0: e4040000 [ 0.830000] c00047b4: 10000005 [ 0.830000] c00047b8: 9c84ffff [ 0.830000] (c00047bc:) d8030000 [ 0.830000] c00047c0: 03fffffc [ 0.830000] c00047c4: 9c630001 [ 0.830000] c00047c8: 9d640001 [ 0.830000] c00047cc: 84810000 [ 0.830000] c00047d0: 84610004 Now we are also printing a bit of the stack as well as the code. The stack is output to help with debugging. There may be concern about exposing sensitive information on the stack, but we are already dumping all register content which would have similar sensitive information. So I am going ahead as this proves useful in investigation. Signed-off-by: Stafford Horne commit a0a94bc9a68ffad0cecae6dbff53e5486cdb8eb0 Author: Stafford Horne Date: Sun Jan 30 17:38:51 2022 +0900 openrisc: Add syscall details to emergency syscall debugging When bringing linux on the or1k Marocchino we ran into issues starting init. This patch adds the syscall number and return address to assist tracing syscalls even before strace is able to be used. By default this is all disabled but a developer could adjust the ifdef to enable debugging. Cc: Andrey Bacherov Signed-off-by: Stafford Horne commit 29bbb2a90fcdd46d9f12746deac4718082df325a Author: Stafford Horne Date: Sun May 15 13:33:14 2022 +0900 openrisc: Add support for liteuart emergency printing This patch adds support for sending emergency print output, such as unhandled exception details, to a liteuart serial device. This is the default device available on litex platforms. If a developer want to use this they should update UART_BASE_ADD to the address of liteuart. Signed-off-by: Stafford Horne commit e449759c246e1594307760f7203debf6038a42ea Author: Stafford Horne Date: Sun May 15 13:21:31 2022 +0900 openrisc: Cleanup emergency print handling The emergency print support only works for 8250 compatible serial ports. Now that OpenRISC platforms may be configured with different serial port hardware we don't want emergency print to try to print to non-existent hardware which will cause lockups. This patch contains several fixes to get emergency print working again: - Update symbol loading to not assume the location of symbols - Split the putc print operation out to its own function to allow for different future implementations. - Update _emergency_print_nr and _emergency_print to use the putc function. - Guard serial 8250 specific sequences by CONFIG_SERIAL_8250 - Update string line feed from lf,cr to cr,lf. Signed-off-by: Stafford Horne commit 87e387acd8eba5021a8e5d6b54e0c5ef5c28ada2 Author: Stafford Horne Date: Sat Jan 22 13:32:38 2022 +0900 openrisc: Add gcc machine instruction flag configuration OpenRISC GCC supports flags to enable the backend to output instructions if they are supported by a target processor. This patch adds configuration flags to enable configuring these flags to tune the kernel for a particular CPU configuration. In the future we could also enable all of these flags by default and provide instruction emulation in the kernel to make these choices easier for users but this is what we provide for now. Signed-off-by: Stafford Horne commit 635267b7a8f1746d72d6b23030863f8779618584 Author: Jason A. Donenfeld Date: Thu Apr 28 13:11:39 2022 +0200 openrisc: define nop command for simulator reboot The simulator defines `l.nop 1` for shutdown, but doesn't have anything for reboot. Use 13 for this, which is currently unused, dubbed `NOP_REBOOT`. Cc: Stafford Horne Cc: Peter Maydell Link: https://lore.kernel.org/all/YmnaDUpVI5ihgvg6@zx2c4.com/ Signed-off-by: Jason A. Donenfeld Signed-off-by: Stafford Horne commit 1693e265e0a5dbe11fba21b48272dd15dbb71ec0 Author: Julia Lawall Date: Sat May 21 13:10:54 2022 +0200 ALSA: ctxfi: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-44-Julia.Lawall@inria.fr Signed-off-by: Takashi Iwai commit e9ff88c327359d6819aa8a61c5ac552722e92379 Author: Julia Lawall Date: Sat May 21 13:10:11 2022 +0200 ALSA: cs5535audio: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-1-Julia.Lawall@inria.fr Signed-off-by: Takashi Iwai commit 1b073ebb174d0c7109b438e0a5eb4495137803ec Author: Edward Matijevic Date: Fri May 20 23:45:15 2022 -0500 ALSA: ctxfi: Add SB046x PCI ID Adds the PCI ID for X-Fi cards sold under the Platnum and XtremeMusic names Before: snd_ctxfi 0000:05:05.0: chip 20K1 model Unknown (1102:0021) is found After: snd_ctxfi 0000:05:05.0: chip 20K1 model SB046x (1102:0021) is found [ This is only about defining the model name string, and the rest is handled just like before, as a default unknown device. Edward confirmed that the stuff has been working fine -- tiwai ] Signed-off-by: Edward Matijevic Cc: Link: https://lore.kernel.org/r/cae7d1a4-8bd9-7dfe-7427-db7e766f7272@gmail.com Signed-off-by: Takashi Iwai commit dc60001e1a305ad8bba1ddaf09484e0e150aba60 Author: Yang Li Date: Thu May 19 07:09:53 2022 +0800 xtensa: Return true/false (not 1/0) from bool function Return boolean values ("true" or "false") instead of 1 or 0 from bool function. This fixes the following warnings from coccicheck: ./arch/xtensa/kernel/traps.c:304:10-11: WARNING: return of 0/1 in function 'check_div0' with return type bool Reported-by: Abaci Robot Signed-off-by: Yang Li Message-Id: <20220518230953.112266-1-yang.lee@linux.alibaba.com> Signed-off-by: Max Filippov commit 42b805af102471f53e3c7867b8c2b502ea4eef7e Author: Xiao Ni Date: Thu May 12 17:21:09 2022 +0800 md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop. Fixes: 0c031fd37f69 (md: Move alloc/free acct bioset in to personality) Signed-off-by: Xiao Ni Signed-off-by: Song Liu commit 0f2571ad7a30ff6b33cde142439f9378669f8b4f Author: Xiao Ni Date: Thu May 12 17:21:08 2022 +0800 md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free(); mddev->private=NULL) | md_free (free mddev) __md_stop sets mddev->private to NULL after pers->free. The raid device will be stopped and mddev memory is free. But in reshape, it doesn't free the mddev and mddev will still be used in new raid. In reshape, it first sets mddev->private to new_pers and then runs old_pers->free(). Now raid0 sets mddev->private to NULL in raid0_free. The new raid can't work anymore. It will panic when dereference mddev->private because of NULL pointer dereference. It can panic like this: [63010.814972] kernel BUG at drivers/md/raid10.c:928! [63010.819778] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [63010.825011] CPU: 3 PID: 44437 Comm: md0_resync Kdump: loaded Not tainted 5.14.0-86.el9.x86_64 #1 [63010.833789] Hardware name: Dell Inc. PowerEdge R6415/07YXFK, BIOS 1.15.0 09/11/2020 [63010.841440] RIP: 0010:raise_barrier+0x161/0x170 [raid10] [63010.865508] RSP: 0018:ffffc312408bbc10 EFLAGS: 00010246 [63010.870734] RAX: 0000000000000000 RBX: ffffa00bf7d39800 RCX: 0000000000000000 [63010.877866] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffa00bf7d39800 [63010.884999] RBP: 0000000000000000 R08: fffffa4945e74400 R09: 0000000000000000 [63010.892132] R10: ffffa00eed02f798 R11: 0000000000000000 R12: ffffa00bbc435200 [63010.899266] R13: ffffa00bf7d39800 R14: 0000000000000400 R15: 0000000000000003 [63010.906399] FS: 0000000000000000(0000) GS:ffffa00eed000000(0000) knlGS:0000000000000000 [63010.914485] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [63010.920229] CR2: 00007f5cfbe99828 CR3: 0000000105efe000 CR4: 00000000003506e0 [63010.927363] Call Trace: [63010.929822] ? bio_reset+0xe/0x40 [63010.933144] ? raid10_alloc_init_r10buf+0x60/0xa0 [raid10] [63010.938629] raid10_sync_request+0x756/0x1610 [raid10] [63010.943770] md_do_sync.cold+0x3e4/0x94c [63010.947698] md_thread+0xab/0x160 [63010.951024] ? md_write_inc+0x50/0x50 [63010.954688] kthread+0x149/0x170 [63010.957923] ? set_kthread_struct+0x40/0x40 [63010.962107] ret_from_fork+0x22/0x30 Removing the code that sets mddev->private to NULL in raid0 can fix problem. Fixes: 0c031fd37f69 (md: Move alloc/free acct bioset in to personality) Reported-by: Fine Fan Signed-off-by: Xiao Ni Signed-off-by: Song Liu commit 913cce5a1e588e3470ea064fe4ea336037d3a454 Author: Christoph Hellwig Date: Thu May 12 08:19:13 2022 +0200 md: remove most calls to bdevname Use the %pg format specifier to save on stack consumption and code size. Signed-off-by: Christoph Hellwig Signed-off-by: Song Liu commit 1e267742283a4b5a8ca65755c44166be27e9aa0f Author: Guoqing Jiang Date: Fri Apr 29 16:49:09 2022 +0800 md: protect md_unregister_thread from reentrancy Generally, the md_unregister_thread is called with reconfig_mutex, but raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread, so md_unregister_thread can be called simulitaneously from two call sites in theory. Then after previous commit which remove the protection of reconfig_mutex for md_unregister_thread completely, the potential issue could be worse than before. Let's take pers_lock at the beginning of function to ensure reentrancy. Reported-by: Donald Buczek Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit 8b48ec23cc51a4e7c8dbaef5f34ebe67e1a80934 Author: Guoqing Jiang Date: Sat Feb 13 01:49:59 2021 +0100 md: don't unregister sync_thread with reconfig_mutex held Unregister sync_thread doesn't need to hold reconfig_mutex since it doesn't reconfigure array. And it could cause deadlock problem for raid5 as follows: 1. process A tried to reap sync thread with reconfig_mutex held after echo idle to sync_action. 2. raid5 sync thread was blocked if there were too many active stripes. 3. SB_CHANGE_PENDING was set (because of write IO comes from upper layer) which causes the number of active stripes can't be decreased. 4. SB_CHANGE_PENDING can't be cleared since md_check_recovery was not able to hold reconfig_mutex. More details in the link: https://lore.kernel.org/linux-raid/5ed54ffc-ce82-bf66-4eff-390cb23bc1ac@molgen.mpg.de/T/#t And add one parameter to md_reap_sync_thread since it could be called by dm-raid which doesn't hold reconfig_mutex. Reported-and-tested-by: Donald Buczek Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit 1212fa1b482ea09c19aed29001465799e85ea6c3 Merge: 03a8b0df757f1 7b0efea4baf02 Author: Takashi Iwai Date: Mon May 23 07:48:16 2022 +0200 Merge branch 'for-linus' into for-next Merge for 5.18-rc1 Signed-off-by: Takashi Iwai commit 64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d Author: Tadeusz Struk Date: Tue May 17 08:13:08 2022 +0900 exfat: check if cluster num is valid Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace: BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3c0 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 notify_change+0xb76/0xe10 fs/attr.c:336 do_truncate+0x1ea/0x2d0 fs/open.c:65 Move the is_valid_cluster() helper from fatent.c to a common header to make it reusable in other *.c files. And add is_valid_cluster() to validate if cluster number is within valid range in exfat_clear_bitmap() and exfat_set_bitmap(). Link: https://syzkaller.appspot.com/bug?id=50381fc73821ecae743b8cf24b4c9a04776f767c Reported-by: syzbot+a4087e40b9c13aad7892@syzkaller.appspotmail.com Fixes: 1e49a94cf707 ("exfat: add bitmap operations") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Tadeusz Struk Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 1b6138385499507147e8f654840f4c39afe6adbf Author: Yuezhang Mo Date: Tue Apr 12 12:26:47 2022 +0900 exfat: reduce block requests when zeroing a cluster If 'dirsync' is enabled, when zeroing a cluster, submitting sector by sector will generate many block requests, will cause the block device to not fully perform its performance. This commit makes the sectors in a cluster to be submitted in once, it will reduce the number of block requests. This will make the block device to give full play to its performance. Test create 1000 directories on SD card with: $ time (for ((i=0;i<1000;i++)); do mkdir dir${i}; done) Performance has been improved by more than 73% on imx6q-sabrelite. Cluster size Before After Improvement 64 KBytes 3m34.036s 0m56.052s 73.8% 128 KBytes 6m2.644s 1m13.354s 79.8% 256 KBytes 11m22.202s 1m39.451s 85.4% imx6q-sabrelite: - CPU: 792 MHz x4 - Memory: 1GB DDR3 - SD Card: SanDisk 8GB Class 4 Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Christoph Hellwig Acked-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 97d6fb1b48f5e6f6d58028593defe8a23641b0b4 Author: Yuezhang Mo Date: Tue Apr 12 12:23:10 2022 +0900 block: add sync_blockdev_range() sync_blockdev_range() is to support syncing multiple sectors with as few block device requests as possible, it is helpful to make the block device to give full play to its performance. Signed-off-by: Yuezhang Mo Suggested-by: Christoph Hellwig Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Christoph Hellwig Reviewed-by: Jens Axboe Acked-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 9b002894b4c252169abc26720452bf3746114b20 Author: Chung-Chiang Cheng Date: Wed Apr 6 17:55:52 2022 +0800 exfat: introduce mount option 'sys_tz' EXFAT_TZ_VALID bit in {create,modify,access}_tz is corresponding to OffsetValid field in exfat specification [1]. When this bit isn't set, timestamps should be treated as having the same UTC offset as the current local time. Currently, there is an option 'time_offset' for users to specify the UTC offset for this issue. This patch introduces a new mount option 'sys_tz' to use system timezone as time offset. Link: [1] https://docs.microsoft.com/en-us/windows/win32/fileio/exfat-specification#74102-offsetvalid-field Signed-off-by: Chung-Chiang Cheng Acked-by: Sungjong Seo Signed-off-by: Namjae Jeon commit d8dad2588addd1d861ce19e7df3b702330f0c7e3 Author: Yuezhang Mo Date: Mon Apr 4 11:58:06 2022 +0900 exfat: fix referencing wrong parent directory information after renaming During renaming, the parent directory information maybe updated. But the file/directory still references to the old parent directory information. This bug will cause 2 problems. (1) The renamed file can not be written. [10768.175172] exFAT-fs (sda1): error, failed to bmap (inode : 7afd50e4 iblock : 0, err : -5) [10768.184285] exFAT-fs (sda1): Filesystem has been set read-only ash: write error: Input/output error (2) Some dentries of the renamed file/directory are not set to deleted after removing the file/directory. exfat_update_parent_info() is a workaround for the wrong parent directory information being used after renaming. Now that bug is fixed, this is no longer needed, so remove it. Fixes: 5f2aa075070c ("exfat: add inode operations") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Daniel Palmer Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 1e39b27bd9d12d615973c3aacefb936466512cae Merge: 17155d5db7eec 1318252617367 Author: Jakub Kicinski Date: Sun May 22 17:23:15 2022 -0700 Merge branch 'fix-silence-gcc-12-warnings-in-drivers-net-wireless' Jakub Kicinski says: ==================== Fix/silence GCC 12 warnings in drivers/net/wireless/ as mentioned off list we'd like to get GCC 12 warnings quashed. This set takes care of the warnings we have in drivers/net/wireless/ mostly by relegating them to W=1/W=2 builds. ==================== Link: https://lore.kernel.org/r/20220520194320.2356236-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 13182526173679c3be794c8149226fc258fdfdbe Author: Jakub Kicinski Date: Fri May 20 12:43:20 2022 -0700 wifi: carl9170: silence a GCC 12 -Warray-bounds warning carl9170 has a big union (struct carl9170_cmd) with all the command types in it. But it allocates buffers only large enough for a given command. This upsets GCC 12: drivers/net/wireless/ath/carl9170/cmd.c:125:30: warning: array subscript ‘struct carl9170_cmd[0]’ is partly outside array bounds of ‘unsigned char[8]’ [-Warray-bounds] 125 | tmp->hdr.cmd = cmd; | ~~~~~~~~~~~~~^~~~~ Punt the warning to W=1 for now. Hopefully GCC will learn to recognize which fields are in-bounds. Acked-by: Christian Lamparter Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit 84f23fb192ef62cef438fdae932ce9d96d131b0c Author: Jakub Kicinski Date: Fri May 20 12:43:18 2022 -0700 wifi: brcmfmac: work around a GCC 12 -Warray-bounds warning GCC 12 really doesn't like partial struct allocations: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2202:32: warning: array subscript ‘struct brcmf_ext_join_params_le[0]’ is partly outside array bounds of ‘void[70]’ [-Warray-bounds] 2202 | ext_join_params->scan_le.passive_time = | ^~ brcmfmac is trying to save 2 bytes at the end by either allocating or not allocating a channel member. Let's keep @join_params_size the "right" size but kmalloc() the full structure. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit af3cdfd30c631dd6bb56933d67a0f0df2980b7d1 Author: Jakub Kicinski Date: Fri May 20 12:43:17 2022 -0700 wifi: iwlwifi: use unsigned to silence a GCC 12 warning GCC 12 says: drivers/net/wireless/intel/iwlwifi/mvm/sta.c:1076:37: warning: array subscript -1 is below array bounds of ‘struct iwl_mvm_tid_data[9]’ [-Warray-bounds] 1076 | if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) | ~~~~~~~~~~~~~~~~^~~~~ Whatever, tid is a bit from for_each_set_bit(), it's clearly unsigned. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit bd1d129daa3ede265a880e2c6a7f91eab0f4dc62 Author: Jakub Kicinski Date: Fri May 20 12:43:16 2022 -0700 wifi: ath6k: silence false positive -Wno-dangling-pointer warning on GCC 12 For some reason GCC 12 decided to complain about the common pattern of queuing an object onto a list on the stack in ath6k: inlined from ‘ath6kl_htc_mbox_tx’ at drivers/net/wireless/ath/ath6kl/htc_mbox.c:1142:3: include/linux/list.h:74:19: warning: storing the address of local variable ‘queue’ in ‘*&packet_15(D)->list.prev’ [-Wdangling-pointer=] 74 | new->prev = prev; | ~~~~~~~~~~^~~~~~ Move the warning to W=1, hopefully it goes away with a compiler update. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit ee3db469dd317e82f57b13aa3bc61be5cb60c2b4 Author: Jakub Kicinski Date: Fri May 20 12:43:15 2022 -0700 wifi: rtlwifi: remove always-true condition pointed out by GCC 12 The .value is a two-dim array, not a pointer. struct iqk_matrix_regs { bool iqk_done; long value[1][IQK_MATRIX_REG_NUM]; }; Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit e95032988053c17baf6c7e27024f5103a19a5f4a Author: Jakub Kicinski Date: Fri May 20 12:43:14 2022 -0700 wifi: ath9k: silence array-bounds warning on GCC 12 GCC 12 says: drivers/net/wireless/ath/ath9k/mac.c: In function ‘ath9k_hw_resettxqueue’: drivers/net/wireless/ath/ath9k/mac.c:373:22: warning: array subscript 32 is above array bounds of ‘struct ath9k_tx_queue_info[10]’ [-Warray-bounds] 373 | qi = &ah->txq[q]; | ~~~~~~~^~~ I don't know where it got the 32 from, relegate the warning to W=1+. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit 0c7ab953d1f2358cce5bcddf96877b16966bbabc Author: Jakub Kicinski Date: Fri May 20 12:43:13 2022 -0700 wifi: plfxlc: remove redundant NULL-check for GCC 12 GCC is upset that we check the return value of plfxlc_usb_dev() even tho it can't be NULL: drivers/net/wireless/purelifi/plfxlc/usb.c: In function ‘resume’: drivers/net/wireless/purelifi/plfxlc/usb.c:840:20: warning: the comparison will always evaluate as ‘true’ for the address of ‘dev’ will never be NULL [-Waddress] 840 | if (!pl || !plfxlc_usb_dev(pl)) | ^ plfxlc_usb_dev() returns an address of one of the members of pl, so it's safe to drop these checks. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski commit ab6a8d3f1a2a85dea5b300fd63b7033cb1040a95 Merge: 4183e4f27f402 73c348d4ab5c3 Author: Dave Chinner Date: Mon May 23 08:55:09 2022 +1000 Merge branch 'guilt/xfs-5.19-misc-3' into xfs-5.19-for-next commit 4183e4f27f402d712bccab30588a6fe7575963c0 Author: Darrick J. Wong Date: Mon May 23 08:43:46 2022 +1000 xfs: share xattr name and value buffers when logging xattr updates While running xfs/297 and generic/642, I noticed a crash in xfs_attri_item_relog when it tries to copy the attr name to the new xattri log item. I think what happened here was that we called ->iop_commit on the old attri item (which nulls out the pointers) as part of a log force at the same time that a chained attr operation was ongoing. The system was busy enough that at some later point, the defer ops operation decided it was necessary to relog the attri log item, but as we've detached the name buffer from the old attri log item, we can't copy it to the new one, and kaboom. I think there's a broader refcounting problem with LARP mode -- the setxattr code can return to userspace before the CIL actually formats and commits the log item, which results in a UAF bug. Therefore, the xattr log item needs to be able to retain a reference to the name and value buffers until the log items have completely cleared the log. Furthermore, each time we create an intent log item, we allocate new memory and (re)copy the contents; sharing here would be very useful. Solve the UAF and the unnecessary memory allocations by having the log code create a single refcounted buffer to contain the name and value contents. This buffer can be passed from old to new during a relog operation, and the logging code can (optionally) attach it to the xfs_attr_item for reuse when LARP mode is enabled. This also fixes a problem where the xfs_attri_log_item objects weren't being freed back to the same cache where they came from. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 22a68ba724232ba675166c307ddef3749ae4c37c Author: Darrick J. Wong Date: Mon May 23 08:41:03 2022 +1000 xfs: do not use logged xattr updates on V4 filesystems V4 superblocks do not contain the log_incompat feature bit, which means that we cannot protect xattr log items against kernels that are too old to know how to recover them. Turn off the log items for such filesystems and adjust the "delayed" name to reflect what it's really controlling. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 17155d5db7eecf512404b894266b77797ac127ce Author: Nobuhiro Iwamatsu Date: Fri May 20 17:48:23 2022 +0900 dt-bindings: net: toshiba,visconti-dwmac: Update the common clock properties The clock for this driver switched to the common clock controller driver. Therefore, update common clock properties for ethernet device in the binding document. Signed-off-by: Nobuhiro Iwamatsu Acked-by: Rob Herring Signed-off-by: David S. Miller commit 0a3ad7d323686fbaae8688326cc5ea0d185c6fca Author: Randy Dunlap Date: Thu May 19 22:15:23 2022 -0700 net: dsa: restrict SMSC_LAN9303_I2C kconfig Since kconfig 'select' does not follow dependency chains, if symbol KSA selects KSB, then KSA should also depend on the same symbols that KSB depends on, in order to prevent Kconfig warnings and possible build errors. Change NET_DSA_SMSC_LAN9303_I2C and NET_DSA_SMSC_LAN9303_MDIO so that they are limited to VLAN_8021Q if the latter is enabled. This prevents the Kconfig warning: WARNING: unmet direct dependencies detected for NET_DSA_SMSC_LAN9303 Depends on [m]: NETDEVICES [=y] && NET_DSA [=y] && (VLAN_8021Q [=m] || VLAN_8021Q [=m]=n) Selected by [y]: - NET_DSA_SMSC_LAN9303_I2C [=y] && NETDEVICES [=y] && NET_DSA [=y] && I2C [=y] Fixes: 430065e26719 ("net: dsa: lan9303: add VLAN IDs to master device") Signed-off-by: Randy Dunlap Cc: Andrew Lunn Cc: Vivien Didelot Cc: Florian Fainelli Cc: Vladimir Oltean Cc: Juergen Borleis Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Mans Rullgard Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 2a11fb1d1b8501c430472c66ea5390cb719bbd8f Author: Tom Rix Date: Sun May 22 09:36:27 2022 -0400 net: fddi: skfp: smt: Remove extra parameters to vararg macro cppcheck reports [drivers/net/fddi/skfp/smt.c:750]: (warning) printf format string requires 0 parameters but 2 are given. DB_SBAN is a vararg macro, like DB_ESSN. Remove the extra args and the nl. Signed-off-by: Tom Rix Signed-off-by: David S. Miller commit 265f58f60a29c2e9d471a928556622e2a4aa8b89 Merge: cf0005d2b07b6 197c9e9b17b11 Author: David S. Miller Date: Sun May 22 22:24:33 2022 +0100 Merge branch 'mt7986-support' Jakub Kicinski says: ==================== introduce mt7986 ethernet support Add support for mt7986-eth driver available on mt7986 soc. Changes since v2: - rely on GFP_KERNEL whenever possible - define mtk_reg_map struct to introduce soc register map and avoid macros - improve comments Changes since v1: - drop SRAM option - convert ring->dma to void - convert scratch_ring to void - enable port4 - fix irq dts bindings - drop gmac1 support from mt7986a-rfb dts for the moment ==================== Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 197c9e9b17b115e04c30d9e185ced582b1fee2a8 Author: Lorenzo Bianconi Date: Fri May 20 20:11:39 2022 +0200 net: ethernet: mtk_eth_soc: introduce support for mt7986 chipset Add support for mt7986-eth driver available on mt7986 soc. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 4d6426904f13bdb5ab20a2dddfb3427dc518f1f8 Author: Lorenzo Bianconi Date: Fri May 20 20:11:38 2022 +0200 net: ethernet: mtk_eth_soc: convert scratch_ring pointer to void Simplify the code converting scratch_ring pointer to void Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 7173eca8eeb7d58f885f7506f808f17851f934ce Author: Lorenzo Bianconi Date: Fri May 20 20:11:37 2022 +0200 net: ethernet: mtk_eth_soc: convert ring dma pointer to void Simplify the code converting {tx,rx} ring dma pointer to void Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 160d3a9b192985b1cea7f394ab745de762d89165 Author: Lorenzo Bianconi Date: Fri May 20 20:11:36 2022 +0200 net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support Introduce MTK_NETSYS_V2 support. MTK_NETSYS_V2 defines 32B TX/RX DMA descriptors. This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 8cb42714cdc1fc1d91f0a67aa710b794280b7af0 Author: Lorenzo Bianconi Date: Fri May 20 20:11:35 2022 +0200 net: ethernet: mtk_eth_soc: introduce device register map Introduce reg_map structure to add the capability to support different register definitions. Move register definitions in mtk_regmap structure. This is a preliminary patch to introduce mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 72e27d3718ba24e75bef7a17d1acd8fbfe37c623 Author: Lorenzo Bianconi Date: Fri May 20 20:11:34 2022 +0200 net: ethernet: mtk_eth_soc: rely on rxd_size field in mtk_rx_alloc/mtk_rx_clean Remove mtk_rx_dma structure layout dependency in mtk_rx_alloc/mtk_rx_clean. Initialize to 0 rxd3 and rxd4 in mtk_rx_alloc. This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 649a752775c26bb9f9d163aa1102ab9cc5941496 Author: Lorenzo Bianconi Date: Fri May 20 20:11:33 2022 +0200 net: ethernet: mtk_eth_soc: rely on txd_size field in mtk_poll_tx/mtk_poll_rx This is a preliminary to ad mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 670ff7dabbb0f317305fa8ccdc87ac88d0c87809 Author: Lorenzo Bianconi Date: Fri May 20 20:11:32 2022 +0200 net: ethernet: mtk_eth_soc: add rxd_size to mtk_soc_data Similar to tx counterpart, introduce rxd_size in mtk_soc_data data structure. This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit e70a5634c1f58a352aea3dbf2a50e98a0cadd68c Author: Lorenzo Bianconi Date: Fri May 20 20:11:31 2022 +0200 net: ethernet: mtk_eth_soc: rely on txd_size in txd_to_idx This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit c4fd06c2bb82c8167e69ca655ea2ed217ec3ca89 Author: Lorenzo Bianconi Date: Fri May 20 20:11:30 2022 +0200 net: ethernet: mtk_eth_soc: rely on txd_size in mtk_desc_to_tx_buf This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 0e05744beda4ae2d65100ed217e4bd50130b4078 Author: Lorenzo Bianconi Date: Fri May 20 20:11:29 2022 +0200 net: ethernet: mtk_eth_soc: rely on txd_size in mtk_tx_alloc/mtk_tx_clean This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit eb067347aa87eaf8a42d945d3e877b1e8333f5ea Author: Lorenzo Bianconi Date: Fri May 20 20:11:28 2022 +0200 net: ethernet: mtk_eth_soc: add txd_size to mtk_soc_data In order to remove mtk_tx_dma size dependency, introduce txd_size in mtk_soc_data data structure. Rely on txd_size in mtk_init_fq_dma() and mtk_dma_free() routines. This is a preliminary patch to add mt7986 ethernet support. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 731f3fd6bc879fcf11e99a2576747a33d3958cef Author: Lorenzo Bianconi Date: Fri May 20 20:11:27 2022 +0200 net: ethernet: mtk_eth_soc: move tx dma desc configuration in mtk_tx_set_dma_desc Move tx dma descriptor configuration in mtk_tx_set_dma_desc routine. This is a preliminary patch to introduce mt7986 ethernet support since it relies on a different tx dma descriptor layout. Tested-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 62dfb4cc444649b3f841ddb4f472a12ed6422714 Author: Lorenzo Bianconi Date: Fri May 20 20:11:26 2022 +0200 net: ethernet: mtk_eth_soc: rely on GFP_KERNEL for dma_alloc_coherent whenever possible Rely on GFP_KERNEL for dma descriptors mappings in mtk_tx_alloc(), mtk_rx_alloc() and mtk_init_fq_dma() since they are run in non-irq context. Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 4b139b75cc9590136ab5eb015ebfd84568543e8c Author: Lorenzo Bianconi Date: Fri May 20 20:11:25 2022 +0200 dt-bindings: net: mediatek,net: add mt7986-eth binding Introduce dts bindings for mt7986 soc in mediatek,net.yaml. Reviewed-by: Rob Herring Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 082ff36bd5c010f77227d881a199c7548f0a6aaf Author: Lorenzo Bianconi Date: Fri May 20 20:11:24 2022 +0200 arm64: dts: mediatek: mt7986: introduce ethernet nodes Introduce ethernet nodes in mt7986 bindings in order to enable mt7986a/mt7986b ethernet support. Co-developed-by: Sam Shih Signed-off-by: Sam Shih Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit cf0005d2b07b6eccc8d4f3f3c4faee59e7409a95 Merge: 4149af28318a1 9dec850fd7c21 Author: David S. Miller Date: Sun May 22 22:21:11 2022 +0100 Merge branch 'net-gcc12-warnings' Jakub Kicinski says: ==================== eth: silence the GCC 12 array-bounds warnings Silence the array-bounds warnings in Ethernet drivers. v2 uses -Wno-array-bounds directly. ==================== Signed-off-by: David S. Miller commit 9dec850fd7c210a04b4707df8e6c95bfafdd6a4b Author: Jakub Kicinski Date: Fri May 20 12:56:05 2022 -0700 eth: tg3: silence the GCC 12 array-bounds warning GCC 12 currently generates a rather inconsistent warning: drivers/net/ethernet/broadcom/tg3.c:17795:51: warning: array subscript 5 is above array bounds of ‘struct tg3_napi[5]’ [-Warray-bounds] 17795 | struct tg3_napi *tnapi = &tp->napi[i]; | ~~~~~~~~^~~ i is guaranteed < tp->irq_max which in turn is either 1 or 5. There are more loops like this one in the driver, but strangely GCC 12 dislikes only this single one. Silence this silliness for now. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 385bc51b41ea74a91545600cb3d731754372f75e Author: Jakub Kicinski Date: Fri May 20 12:56:04 2022 -0700 eth: ice: silence the GCC 12 array-bounds warning GCC 12 gets upset because driver allocates partial struct ice_aqc_sw_rules_elem buffers. The writes are within bounds. Silence these warnings for now, our build bot runs GCC 12 so we won't allow any new instances. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 06da3e8f390aba135ae8808e9424e8a68e53d261 Author: Jakub Kicinski Date: Fri May 20 12:56:03 2022 -0700 eth: mtk_eth_soc: silence the GCC 12 array-bounds warning GCC 12 gets upset because in mtk_foe_entry_commit_subflow() this driver allocates a partial structure. The writes are within bounds. Silence these warnings for now, our build bot runs GCC 12 so we won't allow any new instances. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 7e4d1c23759257ea62c418c8fb25ddbde1059547 Merge: 15d221d0c345b 0a09c5b8cb8f7 Author: David S. Miller Date: Sun May 22 22:18:05 2022 +0100 Merge branch 'dpaa2-swtso-fixes' Ioana Ciornei says: ==================== dpaa2-eth: software TSO fixes This patch fixes the software TSO feature in dpaa2-eth. There are multiple errors that I made in the initial submission of the code, which I didn't caught since I was always running with passthough IOMMU. The bug report came in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215886 The bugs are in the Tx confirmation path, where I was trying to retrieve a virtual address after DMA unmapping the area. Besides that, another dma_unmap call was made with the wrong size. ==================== Signed-off-by: David S. Miller commit 0a09c5b8cb8f75344da7d90c771b84f7cdeaea04 Author: Ioana Ciornei Date: Sun May 22 15:52:51 2022 +0300 dpaa2-eth: unmap the SGT buffer before accessing its contents DMA unmap the Scatter/Gather table before going through the array to unmap and free each of the header and data chunks. This is so we do not touch the data between the dma_map and dma_unmap calls. Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit d5f4e19a85670b4e5697654f4a4e086e064f8a47 Author: Ioana Ciornei Date: Sun May 22 15:52:50 2022 +0300 dpaa2-eth: use the correct software annotation field The incorrect software annotation field was being used, swa->sg.sgt_size instead of swa->tso.sgt_size, which meant that the SGT buffer was unmapped with a wrong size. This is also confirmed by the DMA API debug prints which showed the following: [ 38.962434] DMA-API: fsl_dpaa2_eth dpni.2: device driver frees DMA memory with different size [device address=0x0000fffffafba740] [map size=224 bytes] [unmap size=0 bytes] [ 38.980496] WARNING: CPU: 11 PID: 1131 at kernel/dma/debug.c:973 check_unmap+0x58c/0x9b0 [ 38.988586] Modules linked in: [ 38.991631] CPU: 11 PID: 1131 Comm: iperf3 Not tainted 5.18.0-rc7-00117-g59130eeb2b8f #1972 [ 38.999970] Hardware name: NXP Layerscape LX2160ARDB (DT) Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit 06d129946a71f3159b3b40ee95549183edf2c79d Author: Ioana Ciornei Date: Sun May 22 15:52:49 2022 +0300 dpaa2-eth: retrieve the virtual address before dma_unmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then trying to search for it to help in retrieving the virtual address. This lead to a invalid virtual address being used in the kfree call. Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call. [ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008 (...) [ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT) [ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 487.366485] pc : kfree+0xac/0x304 [ 487.369799] lr : kfree+0x204/0x304 [ 487.373191] sp : ffff80000c4eb120 [ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001 [ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24: ffff66224af78000 [ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec [ 487.397874] x20: ffff6601c0000000 x19: fffffd9807000000 x18: 0000000000000000 [ 487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: 0000000000004000 [ 487.412126] x14: 0000000000000008 x13: 000000000000ffff x12: 0000000000000000 [ 487.419252] x11: 0000000000000004 x10: 0000000000000001 x9 : ffffad184d7d927c [ 487.426379] x8 : 0000000000000000 x7 : 0000000ffffffd1d x6 : ffff662240a94900 [ 487.433505] x5 : 0000000000000003 x4 : 0000000000000009 x3 : ffffad184f4ce008 [ 487.440632] x2 : ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 [ 487.447758] Call trace: [ 487.450194] kfree+0xac/0x304 [ 487.453151] dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth] [ 487.459507] dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth] [ 487.464989] dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth] Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215886 Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit 4149af28318a1335f844a778d67d1fd27d05a505 Author: Vladimir Oltean Date: Sun May 22 12:27:01 2022 +0300 net: mscc: ocelot: offload tc action "ok" using an empty action vector The "ok" tc action is useful when placed in front of a more generic filter to exclude some more specific rules from matching it. The ocelot switches can offload this tc action by creating an empty action vector (no _ENA fields set to 1). This makes sense for all of VCAP IS1, IS2 and ES0 (but not for PSFP). Add support for this action. Note that this makes the gact_drop_and_ok_test() selftest pass, where "action ok" is used in front of an "action drop" rule, both offloaded to VCAP IS2. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit cb7f2d05da8ff973444d7e44b9c48e7c90d63915 Merge: c304eddcecfe2 4ea1396a8bd5b Author: David S. Miller Date: Sun May 22 22:14:13 2022 +0100 Merge branch 'ocelot-selftests' Vladimir Oltean says: ==================== Streamline Ocelot tc-chains selftest This series changes the output and the argument format of the Ocelot switch selftest so that it is more similar to what can be found in tools/testing/selftests/net/forwarding/. ==================== Signed-off-by: David S. Miller commit 4ea1396a8bd5b7af4df15c52396c640a92b05b30 Author: Vladimir Oltean Date: Sun May 22 12:50:40 2022 +0300 selftests: ocelot: tc_flower_chains: reorder interfaces Use the standard interface order h1, swp1, swp2, h2 that is used by the forwarding selftest framework. The previous order was confusing even with the ASCII drawing. That isn't needed anymore. This also drops the fixed MAC addresses and uses STABLE_MAC_ADDRS, which ensures the MAC addresses are unique. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 93196ef911bac57f43034317c50e9ca42acf55c4 Author: Vladimir Oltean Date: Sun May 22 12:50:39 2022 +0300 selftests: ocelot: tc_flower_chains: use conventional interface names This is a robotic rename as follows: eth0 -> swp1 eth1 -> swp2 eth2 -> h2 eth3 -> h1 This brings the selftest more in line with the other forwarding selftests, where h1 is connected to swp1, and h2 to swp2. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 980e74cac800881b30d8984a43ead421487eb3a3 Author: Vladimir Oltean Date: Sun May 22 12:50:38 2022 +0300 selftests: ocelot: tc_flower_chains: streamline test output Bring this driver-specific selftest output in line with the other selftests. Before: Testing VLAN pop.. OK Testing VLAN push.. OK Testing ingress VLAN modification.. OK Testing egress VLAN modification.. OK Testing frame prioritization.. OK After: TEST: VLAN pop [ OK ] TEST: VLAN push [ OK ] TEST: Ingress VLAN modification [ OK ] TEST: Egress VLAN modification [ OK ] TEST: Frame prioritization [ OK ] Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit da50aad6d86716aa48a2b8463c85caea77c0355f Merge: d96a89407e5f6 010ddb813f355 Author: Sebastian Reichel Date: Sun May 22 23:03:29 2022 +0200 Merge power-supply 'fixes' branch Merge power-supply fixes, that missed the v5.18 merge window into power-supply's for-next branch. Signed-off-by: Sebastian Reichel commit 374e72d721d1b0c545d98d8767a346b9007278ef Merge: 80a504669c93b 7b923e67a4a76 Author: Linus Walleij Date: Sun May 22 22:54:23 2022 +0200 Merge tag 'intel-pinctrl-v5.19-2' of gitolite.kernel.org:pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v5.19-2 * Fix immutable IRQ chip examples in the GPIO documentation * Make use of immutable IRQ chip in Intel pin control drivers * Add module alias for Intel Apollo Lake The following is an automated git shortlog grouped by driver: baytrail: - make irq_chip immutable broxton: - Add module alias for Intel Apollo Lake cherryview: - Use GPIO chip pointer in chv_gpio_irq_mask_unmask() - make irq_chip immutable Documentation: - gpio: Advertise irqd_to_hwirq() helper in the examples - gpio: Fix IRQ mask and unmask examples intel: - Fix kernel doc format, i.e. add return sections - Drop unused irqchip member in struct intel_pinctrl - make irq_chip immutable lynxpoint: - make irq_chip immutable commit c304eddcecfe2513ff98ce3ae97d1c196d82ba08 Author: Jakub Kicinski Date: Thu May 19 13:20:54 2022 -0700 net: wrap the wireless pointers in struct net_device in an ifdef Most protocol-specific pointers in struct net_device are under a respective ifdef. Wireless is the notable exception. Since there's a sizable number of custom-built kernels for datacenter workloads which don't build wireless it seems reasonable to ifdefy those pointers as well. While at it move IPv4 and IPv6 pointers up, those are special for obvious reasons. Acked-by: Johannes Berg Acked-by: Stefan Schmidt # ieee802154 Acked-by: Sven Eckelmann Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 5ff851b7be752a6d607c289b489c40f96f9dc489 Author: Uwe Kleine-König Date: Fri May 20 08:26:50 2022 +0200 net: fec: Do proper error checking for enet_out clk An error code returned by devm_clk_get() might have other meanings than "This clock doesn't exist". So use devm_clk_get_optional() and handle all remaining errors as fatal. Signed-off-by: Uwe Kleine-König Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 15d221d0c345b76947911a3ac91897ffe2f1cc4e Author: Christophe JAILLET Date: Sat May 21 08:33:01 2022 +0200 hinic: Avoid some over memory allocation 'prod_idx' (atomic_t) is larger than 'shadow_idx' (u16), so some memory is over-allocated. Fixes: b15a9f37be2b ("net-next/hinic: Add wq") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 43252ed15f46658cec64edecfe610e40f6a12d85 Author: Uwe Kleine-König Date: Sat May 21 10:34:25 2022 +0200 net: fec: Do proper error checking for optional clks An error code returned by devm_clk_get() might have other meanings than "This clock doesn't exist". So use devm_clk_get_optional() and handle all remaining errors as fatal. Signed-off-by: Uwe Kleine-König Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 621427fbdada788f18f77238e1c36f463c2cb9d1 Author: Tommaso Merciai Date: Sat May 21 01:58:46 2022 +0200 net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii RGMII mode can be enable from dp83822 straps, and also writing bit 9 of register 0x17 - RMII and Status Register (RCSR). When phy_interface_is_rgmii rgmii mode must be enabled, same for contrary, this prevents malconfigurations of hw straps References: - https://www.ti.com/lit/gpn/dp83822i p66 Signed-off-by: Tommaso Merciai Co-developed-by: Michael Trimarchi Suggested-by: Alberto Bianchi Tested-by: Tommaso Merciai Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 80a504669c93b3c25e8f705d876bf9fd92ddab47 Author: zhaoxiao Date: Fri May 20 13:20:21 2022 +0800 pinctrl: berlin: bg4ct: Use devm_platform_*ioremap_resource() APIs Use devm_platform_get_and_ioremap_resource() and devm_platform_ioremap_resource() APIs instead of their open coded analogues. Signed-off-by: zhaoxiao Link: https://lore.kernel.org/r/20220520052021.25631-1-zhaoxiao@uniontech.com Signed-off-by: Linus Walleij commit a3f7404c0befe336108094b3141169abd1fb1561 Author: Muhammad Usama Anjum Date: Sat May 21 14:37:06 2022 +0500 net: selftests: Add stress_reuseport_listen to .gitignore Add newly added stress_reuseport_listen object to .gitignore file. Fixes: ec8cb4f617a2 ("net: selftests: Stress reuseport listen") Signed-off-by: Muhammad Usama Anjum Signed-off-by: David S. Miller commit 1ce6c8d68f8ac587f54d0a271ac594d3d51f3efb Author: Jason A. Donenfeld Date: Sun May 22 22:25:41 2022 +0200 random: check for signals after page of pool writes get_random_bytes_user() checks for signals after producing a PAGE_SIZE worth of output, just like /dev/zero does. write_pool() is doing basically the same work (actually, slightly more expensive), and so should stop to check for signals in the same way. Let's also name it write_pool_user() to match get_random_bytes_user(), so this won't be misused in the future. Before this patch, massive writes to /dev/urandom would tie up the process for an extremely long time and make it unterminatable. After, it can be successfully interrupted. The following test program can be used to see this works as intended: #include #include #include #include static unsigned char x[~0U]; static void handle(int) { } int main(int argc, char *argv[]) { pid_t pid = getpid(), child; int fd; signal(SIGUSR1, handle); if (!(child = fork())) { for (;;) kill(pid, SIGUSR1); } fd = open("/dev/urandom", O_WRONLY); pause(); printf("interrupted after writing %zd bytes\n", write(fd, x, sizeof(x))); close(fd); kill(child, SIGTERM); return 0; } Result before: "interrupted after writing 2147479552 bytes" Result after: "interrupted after writing 4096 bytes" Cc: Dominik Brodowski Signed-off-by: Jason A. Donenfeld commit c12b95885ab2d318fdad9b395acd53df42fd7b0e Merge: eb4c078896473 9a3dedcf18096 Author: David S. Miller Date: Sun May 22 21:30:53 2022 +0100 Merge branch 'rxrpc-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for AF_RXRPC: (1) Fix listen() allowing preallocation to overrun the prealloc buffer. (2) Prevent resending the request if we've seen the reply starting to arrive. (3) Fix accidental sharing of ACK state between transmission and reception. (4) Ignore ACKs in which ack.previousPacket regresses. This indicates the highest DATA number so far seen, so should not be seen to go backwards. (5) Fix the determination of when to generate an IDLE-type ACK, simplifying it so that we generate one if we have more than two DATA packets that aren't hard-acked (consumed) or soft-acked (in the rx buffer, but could be discarded and re-requested). ==================== Signed-off-by: David S. Miller commit 9a3dedcf18096e8f7f22b8777d78c4acfdea1651 Author: David Howells Date: Sat May 21 09:03:31 2022 +0100 rxrpc: Fix decision on when to generate an IDLE ACK Fix the decision on when to generate an IDLE ACK by keeping a count of the number of packets we've received, but not yet soft-ACK'd, and the number of packets we've processed, but not yet hard-ACK'd, rather than trying to keep track of which DATA sequence numbers correspond to those points. We then generate an ACK when either counter exceeds 2. The counters are both cleared when we transcribe the information into any sort of ACK packet for transmission. IDLE and DELAY ACKs are skipped if both counters are 0 (ie. no change). Fixes: 805b21b929e2 ("rxrpc: Send an ACK after every few DATA packets we receive") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 81524b6312535897707f2942695da1d359a5e56b Author: David Howells Date: Sat May 21 09:03:24 2022 +0100 rxrpc: Don't let ack.previousPacket regress The previousPacket field in the rx ACK packet should never go backwards - it's now the highest DATA sequence number received, not the last on received (it used to be used for out of sequence detection). Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 8940ba3cfe4841928777fd45eaa92051522c7f0c Author: David Howells Date: Sat May 21 09:03:18 2022 +0100 rxrpc: Fix overlapping ACK accounting Fix accidental overlapping of Rx-phase ACK accounting with Tx-phase ACK accounting through variables shared between the two. call->acks_* members refer to ACKs received in the Tx phase and call->ackr_* members to ACKs sent/to be sent during the Rx phase. Fixes: 1a2391c30c0b ("rxrpc: Fix detection of out of order acks") Signed-off-by: David Howells cc: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 114af61f88fbe34d641b13922d098ffec4c1be1b Author: David Howells Date: Sat May 21 09:03:11 2022 +0100 rxrpc: Don't try to resend the request if we're receiving the reply rxrpc has a timer to trigger resending of unacked data packets in a call. This is not cancelled when a client call switches to the receive phase on the basis that most calls don't last long enough for it to ever expire. However, if it *does* expire after we've started to receive the reply, we shouldn't then go into trying to retransmit or pinging the server to find out if an ack got lost. Fix this by skipping the resend code if we're into receiving the reply to a client call. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 88e22159750b0d55793302eeed8ee603f5c1a95c Author: David Howells Date: Sat May 21 09:03:04 2022 +0100 rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Link: https://lists.infradead.org/pipermail/linux-afs/2022-March/005079.html Signed-off-by: David S. Miller commit c680c6a814a2269427fad9ac417ab16756bceae9 Author: Christophe JAILLET Date: Fri May 20 21:21:56 2022 +0200 gpio: sim: Use correct order for the parameters of devm_kcalloc() We should have 'n', then 'size', not the opposite. This is harmless because the 2 values are just multiplied, but having the correct order silence a (unpublished yet) smatch warning. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Christophe JAILLET Signed-off-by: Bartosz Golaszewski commit baea40de321b35c7eefb6afbe34ac49caece76cf Merge: 0598cec957abb adc9613ff66c2 Author: David S. Miller Date: Sun May 22 21:03:02 2022 +0100 Merge branch 'rxrpc-misc' David Howells says: ==================== rxrpc: Miscellaneous changes Here are some miscellaneous changes for AF_RXRPC: (1) Allow the list of local endpoints to be viewed through /proc. (2) Switch to using refcount_t for refcounting. (3) Fix a locking issue found by lockdep. (4) Autogenerate tracing symbol enums from symbol->string maps to make it easier to keep them in sync. (5) Return an error to sendmsg() if a call it tried to set up failed. Because it failed at this point, no notification will be generated for recvmsg to pick up - but userspace still needs to know about the failure. (6) Fix the selection of abort codes generated by internal events. In particular, rxrpc and kafs shouldn't be generating RX_USER_ABORT unless it's because userspace did something to cancel a call. (7) Adjust the interpretation and handling of certain ACK types to try and detect NAT changes causing a call to seem to start mid-flow from a different peer. ==================== Signed-off-by: David S. Miller commit adc9613ff66c26ebaff9814973181ac178beb90b Author: David Howells Date: Sat May 21 08:45:55 2022 +0100 afs: Adjust ACK interpretation to try and cope with NAT If a client's address changes, say if it is NAT'd, this can disrupt an in progress operation. For most operations, this is not much of a problem, but StoreData can be different as some servers modify the target file as the data comes in, so if a store request is disrupted, the file can get corrupted on the server. The problem is that the server doesn't recognise packets that come after the change of address as belonging to the original client and will bounce them, either by sending an OUT_OF_SEQUENCE ACK to the apparent new call if the packet number falls within the initial sequence number window of a call or by sending an EXCEEDS_WINDOW ACK if it falls outside and then aborting it. In both cases, firstPacket will be 1 and previousPacket will be 0 in the ACK information. Fix this by the following means: (1) If a client call receives an EXCEEDS_WINDOW ACK with firstPacket as 1 and previousPacket as 0, assume this indicates that the server saw the incoming packets from a different peer and thus as a different call. Fail the call with error -ENETRESET. (2) Also fail the call if a similar OUT_OF_SEQUENCE ACK occurs if the first packet has been hard-ACK'd. If it hasn't been hard-ACK'd, the ACK packet will cause it to get retransmitted, so the call will just be repeated. (3) Make afs_select_fileserver() treat -ENETRESET as a straight fail of the operation. (4) Prioritise the error code over things like -ECONNRESET as the server did actually respond. (5) Make writeback treat -ENETRESET as a retryable error and make it redirty all the pages involved in a write so that the VM will retry. Note that there is still a circumstance that I can't easily deal with: if the operation is fully received and processed by the server, but the reply is lost due to address change. There's no way to know if the op happened. We can examine the server, but a conflicting change could have been made by a third party - and we can't tell the difference. In such a case, a message like: kAFS: vnode modified {100058:146266} b7->b8 YFS.StoreData64 (op=2646a) will be logged to dmesg on the next op to touch the file and the client will reset the inode state, including invalidating clean parts of the pagecache. Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2021-December/004811.html # v1 Signed-off-by: David S. Miller commit de696c4784f0706884458893c5a6c39b3a3ff65c Author: David Howells Date: Sat May 21 08:45:48 2022 +0100 rxrpc, afs: Fix selection of abort codes The RX_USER_ABORT code should really only be used to indicate that the user of the rxrpc service (ie. userspace) implicitly caused a call to be aborted - for instance if the AF_RXRPC socket is closed whilst the call was in progress. (The user may also explicitly abort a call and specify the abort code to use). Change some of the points of generation to use other abort codes instead: (1) Abort the call with RXGEN_SS_UNMARSHAL or RXGEN_CC_UNMARSHAL if we see ENOMEM and EFAULT during received data delivery and abort with RX_CALL_DEAD in the default case. (2) Abort with RXGEN_SS_MARSHAL if we get ENOMEM whilst trying to send a reply. (3) Abort with RX_CALL_DEAD if we stop hearing from the peer if we had heard from the peer and abort with RX_CALL_TIMEOUT if we hadn't. (4) Abort with RX_CALL_DEAD if we try to disconnect a call that's not completed successfully or been aborted. Reported-by: Jeffrey Altman Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 4ba68c5192554876bd8c3afd904e3064d2915341 Author: David Howells Date: Sat May 21 08:45:41 2022 +0100 rxrpc: Return an error to sendmsg if call failed If at the end of rxrpc sendmsg() or rxrpc_kernel_send_data() the call that was being given data was aborted remotely or otherwise failed, return an error rather than returning the amount of data buffered for transmission. The call (presumably) did not complete, so there's not much point continuing with it. AF_RXRPC considers it "complete" and so will be unwilling to do anything else with it - and won't send a notification for it, deeming the return from sendmsg sufficient. Not returning an error causes afs to incorrectly handle a StoreData operation that gets interrupted by a change of address due to NAT reconfiguration. This doesn't normally affect most operations since their request parameters tend to fit into a single UDP packet and afs_make_call() returns before the server responds; StoreData is different as it involves transmission of a lot of data. This can be triggered on a client by doing something like: dd if=/dev/zero of=/afs/example.com/foo bs=1M count=512 at one prompt, and then changing the network address at another prompt, e.g.: ifconfig enp6s0 inet 192.168.6.2 && route add 192.168.6.1 dev enp6s0 Tracing packets on an Auristor fileserver looks something like: 192.168.6.1 -> 192.168.6.3 RX 107 ACK Idle Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.3 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(64538) (64538) 192.168.6.3 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(64538) (64538) 192.168.6.1 -> 192.168.6.3 RX 107 ACK Idle Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.2 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(0) (0) 192.168.6.2 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(0) (0) 192.168.6.1 -> 192.168.6.2 RX 107 ACK Exceeds Window Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.1 -> 192.168.6.2 RX 74 ABORT Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.1 -> 192.168.6.2 RX 74 ABORT Seq: 29321 Call: 4 Source Port: 7000 Destination Port: 7001 The Auristor fileserver logs code -453 (RXGEN_SS_UNMARSHAL), but the abort code received by kafs is -5 (RX_PROTOCOL_ERROR) as the rx layer sees the condition and generates an abort first and the unmarshal error is a consequence of that at the application layer. Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2021-December/004810.html # v1 Signed-off-by: David S. Miller commit dc9fd093b2ebabc25a5d7d0dd5bdfdd6c878e0bf Author: David Howells Date: Sat May 21 08:45:35 2022 +0100 rxrpc: Automatically generate trace tag enums Automatically generate trace tag enums from the symbol -> string mapping tables rather than having the enums as well, thereby reducing duplicated data. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit ad25f5cb39872ca14bcbe00816ae65c22fe04b89 Author: David Howells Date: Sat May 21 08:45:28 2022 +0100 rxrpc: Fix locking issue There's a locking issue with the per-netns list of calls in rxrpc. The pieces of code that add and remove a call from the list use write_lock() and the calls procfile uses read_lock() to access it. However, the timer callback function may trigger a removal by trying to queue a call for processing and finding that it's already queued - at which point it has a spare refcount that it has to do something with. Unfortunately, if it puts the call and this reduces the refcount to 0, the call will be removed from the list. Unfortunately, since the _bh variants of the locking functions aren't used, this can deadlock. ================================ WARNING: inconsistent lock state 5.18.0-rc3-build4+ #10 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/2/25 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888107ac4038 (&rxnet->call_lock){+.?.}-{2:2}, at: rxrpc_put_call+0x103/0x14b {SOFTIRQ-ON-W} state was registered at: ... Possible unsafe locking scenario: CPU0 ---- lock(&rxnet->call_lock); lock(&rxnet->call_lock); *** DEADLOCK *** 1 lock held by ksoftirqd/2/25: #0: ffff8881008ffdb0 ((&call->timer)){+.-.}-{0:0}, at: call_timer_fn+0x5/0x23d Changes ======= ver #2) - Changed to using list_next_rcu() rather than rcu_dereference() directly. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit a05754295e01f006a651eec759c5dbe682ef6cef Author: David Howells Date: Sat May 21 08:45:22 2022 +0100 rxrpc: Use refcount_t rather than atomic_t Move to using refcount_t rather than atomic_t for refcounts in rxrpc. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 33912c2639ad76660988c8ca97e4d18fca89b668 Author: David Howells Date: Sat May 21 08:45:15 2022 +0100 rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc Allow the list of in-use local UDP endpoints in the current network namespace to be viewed in /proc. To aid with this, the endpoint list is converted to an hlist and RCU-safe manipulation is used so that the list can be read with only the RCU read lock held. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller commit 0598cec957abbdd47b8eb7dceb51d54ac465417d Merge: 60f243ad1426b a224bd4b88caa Author: David S. Miller Date: Sun May 22 20:46:13 2022 +0100 Merge branch 'ipa-next' Alex Elder says: ==================== net: ipa: a few more small items This series consists of three small sets of changes. Version 2 adds a patch that avoids a warning that occurs when handling a modem crash (I unfortunately didn't notice it earlier). All other patches are the same--just rebased. The first three patches allow a few endpoint features to be specified. At this time, currently-defined endpoints retain the same configuration, but when the monitor functionality is added in the next cycle these options will be required. The fourth patch simply removes an unused function, explaining also why it would likely never be used. The fifth patch is new. It counts the number of modem TX endpoints and uses it to determine how many TREs a transaction needs when when handling a modem crash. It is needed to avoid exceeding the limited number of commands imposed by the last four patches. And the last four patches refactor code related to IPA immediate commands, eliminating an unused field and then simplifying and removing some unneeded code. ==================== Signed-off-by: David S. Miller commit a224bd4b88caa3ac62a4b541a07fae7ea26cab7a Author: Alex Elder Date: Sat May 21 19:32:23 2022 -0500 net: ipa: use data space for command opcodes The 64-bit data field in a transaction is not used for commands. And the opcode array is *only* used for commands. They're (currently) the same size; save a little space in the transaction structure by enclosing the two fields in a union. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 8797972afff3d462711758acec68be11172e2d01 Author: Alex Elder Date: Sat May 21 19:32:22 2022 -0500 net: ipa: remove command info pool The ipa_cmd_info structure now contains only one field, and it's an enumerated type whose values all fit in 8 bits. Currently we'll never use more than 8 TREs in a command transaction, and we can represent that number of command opcodes in the same space as a 64 bit pointer to an ipa_cmd_info structure. Define IPA_COMMAND_TRANS_TRE_MAX as the maximum number of TREs that can be in a command transaction. Replace the info pointer in a transaction with a fixed-size array named cmd_opcode[] of that many bytes. Store the opcode in this array when adding a command TRE to a transaction, as was done previously for the info array. This makes the ipa_cmd_info unused, so get rid of it. When committing an immediate command transaction, use the channel's Boolean command flag to determine whether to fill in the opcode, which will be taken (as before) from the array in the transaction. This makes the command info pool unnecessary, so get rid of it. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 4de284b72e59e1006a6b6358c060265a9f1be100 Author: Alex Elder Date: Sat May 21 19:32:21 2022 -0500 net: ipa: remove command direction argument We no longer use the direction argument for gsi_trans_cmd_add(), so get rid of it in its definition, and in its seven callers. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 7ffba3bdf76a7bf93ec2dc56369ea563dea92b7c Author: Alex Elder Date: Sat May 21 19:32:20 2022 -0500 net: ipa: get rid of ipa_cmd_info->direction The direction field of the ipa_cmd_info structure is set, but never used. It seems it might have been used for the DMA_SHARED_MEM immediate command, but the DIRECTION flag is set based on the value of the passed-in direction flag there. Anyway, remove this unused field from the ipa_cmd_info structure. This is done as a separate patch to make it very obvious that it's not required. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 2091c79ac4deb4f4dd6c5b223d50f4536e3265a2 Author: Alex Elder Date: Sat May 21 19:32:19 2022 -0500 net: ipa: count the number of modem TX endpoints In ipa_endpoint_modem_exception_reset_all(), a high estimate was made of the number of endpoints that need their status register updated. We only used what was needed, so the high estimate didn't matter much. However the next few patches are going to limit the number of commands in a single transaction, and the overestimate would exceed that. So count the number of modem TX endpoints at initialization time, and use it in ipa_endpoint_modem_exception_reset_all(). Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit d15180b4eadbdee782d97afcbf3c56e2f246c40a Author: Alex Elder Date: Sat May 21 19:32:18 2022 -0500 net: ipa: kill gsi_trans_commit_wait_timeout() Since the beginning gsi_trans_commit_wait_timeout() has existed to provide a way to allow waiting a limited time for a transaction to complete. But that function has never been used. In fact, there is no use for this function, because a transaction committed to hardware should *always* complete. The only reason it might not complete is if there were a hardware failure, or perhaps a system configuration error. Furthermore, if a timeout ever did occur, the IPA hardware would be in an indeterminate state, from which there is no recovery. It would require some sort of complete IPA reset, and would require the participation of the modem, and at this time there is no such sequence defined. So get rid of the definition of gsi_trans_commit_wait_timeout(), and update a few comments accordingly. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit beb90cba607ff060c325e6717d2d5e7ff58abf11 Author: Alex Elder Date: Sat May 21 19:32:17 2022 -0500 net: ipa: specify RX aggregation time limit in config data Don't assume that a 500 microsecond time limit should be used for all receive endpoints that support aggregation. Instead, specify the time limit to use in the configuration data. Set a 500 microsecond limit for all existing RX endpoints, as before. Checking for overflow for the time limit field is a bit complicated. Rather than duplicate a lot of code in ipa_endpoint_data_valid_one(), call WARN() if any value is found to be too large when encoding it. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 3cebb7c2ed2d76f6f8df67b030c34ffe27867766 Author: Alex Elder Date: Sat May 21 19:32:16 2022 -0500 net: ipa: support hard aggregation limits Add a new flag for AP receive endpoints that indicates whether a "hard limit" is used as a criterion for closing aggregation. Add comments explaining the difference between "hard" and "soft" aggregation limits. Pass a flag to ipa_aggr_size_kb() so it computes the proper aggregation size value whether using hard or soft limits. Move that function earlier in "ipa_endpoint.c" so it can be used without a forward-reference. Update ipa_endpoint_data_valid_one() so it validates endpoints whose data indicate a hard aggregation limit is used, and so it reports set aggregation flags for endpoints without aggregation enabled. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 153213f0554d5053d5f9385ae6b4f116c4dc1fb8 Author: Alex Elder Date: Sat May 21 19:32:15 2022 -0500 net: ipa: make endpoint HOLB drop configurable Add a new Boolean flag for RX endpoints defining whether HOLB drop is initially enabled or disabled for the endpoint. All existing AP endpoints should have HOLB drop disabled. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 60f243ad1426b796efed750937733b0e410f9257 Author: Julia Lawall Date: Sat May 21 13:11:28 2022 +0200 qed: fix typos in comments Spelling mistakes (triple letters) in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit b993e72cdd44345b12ed160dfb823bc9bd027108 Author: Julia Lawall Date: Sat May 21 13:11:23 2022 +0200 nfp: flower: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Niklas Söderlund Signed-off-by: David S. Miller commit 878e2eb29ac130c1a2dec6a3c3bb8706f5dd1476 Author: Julia Lawall Date: Sat May 21 13:11:16 2022 +0200 net: marvell: prestera: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit 3f660c1820f7aae10f841ac05aa6f804566ca2cb Author: Julia Lawall Date: Sat May 21 13:10:57 2022 +0200 cirrus: cs89x0: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit cc4e7fa549cb69c18bc2ba7209df373ca06749e3 Author: Julia Lawall Date: Sat May 21 13:10:53 2022 +0200 net: qed: fix typos in comments Spelling mistakes (triple letters) in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit b0ea505ba0d74dd9b5a2e40e872253b13e5c5671 Author: Julia Lawall Date: Sat May 21 13:10:31 2022 +0200 net/mlx5: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit e34be16bee65dc4eee4e4f9398e6acf26d69379e Author: Julia Lawall Date: Sat May 21 13:10:29 2022 +0200 net: mvpp2: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit 1f36a72ae347bc922bddf9382b608afa47a25a28 Author: Julia Lawall Date: Sat May 21 13:10:20 2022 +0200 net: sparx5: switchdev: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit 8877ecb0fc8d7662218a8e7ebb0650f320467935 Author: Christophe JAILLET Date: Sun May 22 15:14:23 2022 +0200 hwmon: (aquacomputer_d5next) Fix an error handling path in aqc_probe() If no memory can be allocated, some resources still need to be released as already done in the other error handling paths. Fixes: 752b927951ea ("hwmon: (aquacomputer_d5next) Add support for Aquacomputer Octo") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/be6b955d50de140fcc96bd116150b435021bf567.1653225250.git.christophe.jaillet@wanadoo.fr Reviewed-by: Aleksa Savic Signed-off-by: Guenter Roeck commit 90de6805267f8c79cd2b1a36805071e257c39b5c Author: Tal Cohen Date: Wed May 11 16:50:30 2022 +0300 habanalabs: use separate structure info for each error collect data Create separate info structure for each error type. The structures shall be used inside the large structure that contains the last session error. This is more scalable for adding more errors in the future. Signed-off-by: Tal Cohen Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit f873a27fd50d161111d0e52087af0f5b2111c5c4 Author: Yuri Nudelman Date: Sun May 15 13:46:37 2022 +0300 habanalabs: fix missing handle shift during mmap During mmap operation on the unified memory manager buffer, the vma page offset is shifted to extract the handle value. Due to a typo, it was not shifted back at the end. That could cause the offset to be modified after mmap operation, that may affect subsequent operations. In addition, in allocation flow, in case of out of memory error, idr would not be correctly destroyed, again because of a missing shift. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit e31dd9362f01682192d80221cc4339e4f7140f30 Author: Ohad Sharabi Date: Wed May 11 13:28:39 2022 +0300 habanalabs: remove hdev from hl_ctx_get args This argument is unused by the function. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 9e495e24003eec491141c80a9bd8fb4ea5edc171 Author: Ohad Sharabi Date: Mon Apr 11 09:31:32 2022 +0300 habanalabs: do MMU prefetch as deferred work When user requests to prefetch the MMU translations, the driver will not block the user until prefetch is done. Instead, the prefetch work will be delegated to a WQ which will do it in the background. This way, the prefetch may progress without blocking the user at all. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 83617f5a87f4ad8403bf1177708fedc98b0a1059 Author: Yuri Nudelman Date: Wed May 11 14:50:02 2022 +0300 habanalabs: order memory manager messages Changing format of memory manager messages to make it more readable. In addition, reducing the priority of a warning on missing handle during put. This scenario is not an indication of a problem and may happen in a legal flow, when handle is put from multiple flows. For example, in timeout and completion. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 804d514d7977adbdacb3d4b23bc7d35914fe8930 Author: Oded Gabbay Date: Wed May 11 12:55:30 2022 +0300 habanalabs: return -EFAULT on copy_to_user error If copy_to_user failed in info ioctl, we always return -EFAULT so the user will know there was an error. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 49d2a8af97a20d65d09ac85b57e525b32fdaa0e4 Author: Oded Gabbay Date: Wed May 11 10:06:39 2022 +0300 habanalabs: use NULL for eventfd eventfd is pointer. As such, it should be initialized to NULL, not to 0. In addition, no need to initialize it after creation because the entire structure is zeroed-out. Also, no need to initialize it before release because the entire structure is freed. Reported-by: kernel test robot Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 368b0b4fd6971b63ab9eb0a969b5847755d09493 Author: Oded Gabbay Date: Mon May 9 14:20:13 2022 +0300 habanalabs: update firmware header Update cpucp_if.h to latest version. Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 422ef171038d4855ffe938137039a8f3b3e84293 Author: Tal Cohen Date: Thu Apr 28 13:45:18 2022 +0300 habanalabs: add support for notification via eventfd The driver will be able to send notification events towards a user process, using user's registered event file descriptor. The driver uses the notification mechanism to inform the user about an occurred event. A user thread can wait until a notification is received from the driver. The driver stores the occurred event until the user reads it, using HL_INFO_GET_EVENTS - new ioctl opcode in the INFO ioctl. Gaudi specific implementation includes sending a notification on a TPC assertion event that is received from f/w. Signed-off-by: Tal Cohen Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit f2daa2d97ec16766bc36fc2b6218d0acb47885ed Author: Yuri Nudelman Date: Mon May 2 13:41:11 2022 +0300 habanalabs: add topic to memory manager buffer Currently, buffers from multiple flows pass through the same infra. This way, in logs, we are unable to distinguish between buffers that came from separate flows. To address this problem, add a "topic" to buffer behavior descriptor - a string identifier that will be used to identify in logs the flow this buffer relates to. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit c37803388c95833c4728b089e6c94996dc457d95 Author: Dani Liberman Date: Wed Apr 27 14:14:17 2022 +0300 habanalabs: handle race in driver fini Scenario: 1. During hard reset, driver executes device_kill_open_processes. 2. Drivers file descriptor is not closed yet (user process is alive), hence we are starting loop on all open file descriptors. 3. Just before getting task struct of user process, according to pid, SIGKILL is sent to the user process, hence get_pid_task fails, driver prints a warning and device_kill_open_processes returns an error. 4. Returned error causing driver fini do disable the device object of the process which causes a kernel crash. The fix is to handle this case not as an error and continue fini flow as normal, since the killed process (by the SIGKILL) will release its resources just like it will do when the driver sends him the sigkill. Signed-off-by: Dani Liberman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 0688474eda80ba8a87c38c138aa00b4fea90d8cc Author: Dafna Hirschfeld Date: Mon Apr 11 17:11:23 2022 +0300 habanalabs: add device memory scrub ability through debugfs Add the ability to scrub the device memory with a given value. Add file 'dram_mem_scrub_val' to set the value and a file 'dram_mem_scrub' to scrub the dram. This is very important to help during automated tests, when you want the CI system to randomize the memory before training certain DL topologies. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 829ec038c967d04032d6922b34abff0713660638 Author: Yuri Nudelman Date: Tue Mar 29 14:16:04 2022 +0300 habanalabs: use unified memory manager for CB flow With the new code required for the flow added, we can now switch to using the new memory manager infrastructure, removing the old code. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit dc653c36c98e559575644aaa7c5989301d98f7ed Author: Yuri Nudelman Date: Tue Mar 29 14:08:31 2022 +0300 habanalabs: unified memory manager new code for CB flow This commit adds the new code needed for command buffer flow using the new unified memory manager, without changing the actual functionality. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 2db04a68265519f6d3783f4cb99175fb6923aa2d Author: Ofir Bitton Date: Mon Apr 25 19:58:37 2022 +0300 habanalabs/gaudi: set arbitration timeout to a high value In certain workloads, arbitration timeout might expire although no actual issue present. Hence, we set timeout to a very high value. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit ff086c186bf2b2237410ce9145c16d2141a881ff Author: Yuri Nudelman Date: Thu Mar 31 14:15:16 2022 +0300 habanalabs: add put by handle method to memory manager Putting object by its handle and not by object pointer is useful in some finalization flows that do not have object pointer available. It eliminates the need to first get the object and then perform put twice. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 4e63ce6af63f3db7f922e3c564f23ac606218a3d Author: Yuri Nudelman Date: Wed Mar 23 15:08:22 2022 +0200 habanalabs: hide memory manager page shift The new unified memory manager uses page offset to pass buffer handle during the mmap operation. One problem with this approach is that it requires the handle to always be divisible by the page size, else, the user would not be able to pass it correctly as an argument to the mmap system call. Previously, this was achieved by shifting the handle left after alloc operation, and shifting it right before get operation. This was done in the user code. This creates code duplication, and, what's worse, requires some knowledge from the user regarding the handle internal structure, hurting the encapsulation. This patch encloses all the page shifts inside memory manager functions. This way, the user can take the handle as a black box, and simply use it, without any concert about how it actually works. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit de3484dfaa04a97cd0a11e5367635d36f5b49fee Author: farah kassabri Date: Wed Apr 13 18:16:34 2022 +0300 habanalabs: Add separate poll interval value for protocol Currently we're using the same poll interval value for both COMMs protocol(for sending a command and waits for an ACK) and the device CPU boot phases status waits. On COMMs protocol this interval should be much lower than the device CPU boot which may take long time to change status. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit b0b09b7a8b7d2a015adeb0c66d41f7a28cfc40f2 Author: Dani Liberman Date: Wed Apr 13 21:32:02 2022 +0300 habanalabs: use get_task_pid() to take PID find_get_pid() isn't good in case the user process was run inside docker. As a result, we didn't had the PID and we couldn't kill the user process in case the device got stuck and we needed to reset the device. Signed-off-by: Dani Liberman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 5d1a0de2c778f369970dd50f6713e95068926a8b Author: Ohad Sharabi Date: Sun Apr 10 11:19:42 2022 +0300 habanalabs: add prefetch flag to the MAP operation This patch let the user decide whether the translations done in the page tables will be fetched directly to the STLB right after the map. We want to let the user control whether to perform prefetch upon map operation. To do so a memory flag was added, to be used in the MAP ioctl, called HL_MEM_PREFETCH and if set- the mappings will be fetched directly to the STLB after map operation. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 77c97a7ea85f3a1f8d2c3bf54869c0b6638519c7 Author: Robin Murphy Date: Mon Apr 11 13:36:32 2022 +0100 habanalabs: Stop using iommu_present() Even if an IOMMU might be present for some PCI segment in the system, that doesn't necessarily mean it provides translation for the device we care about. Replace iommu_present() with a more appropriate check. Signed-off-by: Robin Murphy Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 0ff1d6f8f55eafadea0a5ca25d0eaf3571813c70 Author: Moti Haimovski Date: Tue Apr 5 11:45:51 2022 +0300 habanalabs: support debugfs Byte access to device DRAM The habanalabs HW requires memory resources to be used by its internal hardware structures. These structures are allocated and initialized by the driver. We would like to use the device HBM for that purpose. This memory is io-remapped and accessed using the writel()/writeb()/writew() commands. Since some of the HW structures are one byte in size we need to add support for the writeb() and readb() functions in the driver. Signed-off-by: Moti Haimovski Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit ab4ea5872842766b0155b2517db61a4ae99d98e0 Author: Ohad Sharabi Date: Thu Mar 24 16:34:49 2022 +0200 habanalabs: use for_each_sgtable_dma_sg for dma sgt Instead of using for_each_sg when iterating sgt that contains dma entries, use the more proper for_each_sgtable_dma_sg macro. In addition, both Goya and Gaudi have the exact same implementation of the asic function that encapsulate the usage of this macro, so it is better to move that implementation to the common code. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit b8d852add6ea50d1395522e31a2330b9e567d1a0 Author: Rajaravi Krishna Katta Date: Sun Apr 3 18:04:43 2022 +0300 habanalabs/gaudi: use lower_32_bits() for casting Use standard kernel macro to take lower 32 bits of 64-bits variable. Signed-off-by: Rajaravi Krishna Katta Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 2ba75d31198d2242fbce7a8082e44011bd4f2048 Author: Ohad Sharabi Date: Sun Apr 3 11:22:34 2022 +0300 habanalabs: refactor HOP functions in MMU V1 Take advantage of the HOPs shift/masks now defined as arrays. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit b31848430f49d070c2dd07fbcd719930c35fe1ec Author: Rajaravi Krishna Katta Date: Fri Apr 1 14:06:19 2022 +0300 habanalabs: fix comments according to kernel-doc Incorrect/Missing doxygen tag Signed-off-by: Rajaravi Krishna Katta Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 658591ec32f8038bb1c2cd692cb29c3c47161b81 Author: Oded Gabbay Date: Mon Apr 4 19:22:11 2022 +0300 habanalabs: remove user interrupt debug print As user interrupts are a common use case, this dump pollutes the dmesg log, hence removing it. Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit c82b025f2b8cf3c1e0f6dcca52ece71fba4f8b12 Author: Oded Gabbay Date: Sat Apr 2 22:09:16 2022 +0300 habanalabs: don't print normal reset operations Only a hard-reset is an unexpected event which should be notify in the kernel log. Other resets are normal operations and therefore we should not pollute the log with them. Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 738607f005dc07e59424837e0ab286cdc65ccfdf Author: Oded Gabbay Date: Wed Mar 30 10:02:06 2022 +0300 habanalabs: change a reset print to debug level Currently we have two reset prints per reset. One is in the common code and one in each asic-specific file. We can change the asic-specific message to be debug only as we can know the type of reset being done according to the print in the common code, which is also easier to maintain. Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit fcadbf56883eb36fa2186478cb7007b88cd3f068 Author: Oded Gabbay Date: Wed Mar 30 09:16:16 2022 +0300 habanalabs: remove redundant info print Halting compute engines is a print that doesn't add us any information because it is always done in the reset process and not used elsewhere. Even if it was, we don't use prints to mark functions we passed through. Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit cd92c3678ab3158f11319ea08b81ac58beb519c7 Author: Yuri Nudelman Date: Sun Mar 27 11:41:51 2022 +0300 habanalabs: wrong handle removal in memory manager During the unified memory manager release, a wrong id was used to remove an entry from the idr. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 799b9eb01a643ba5b6ad80aa89cd4a425c17971e Author: Dafna Hirschfeld Date: Wed Mar 16 16:38:17 2022 +0200 habanalabs: remove debugfs read/write callbacks The debugfs memory access now uses the callback 'access_dev_mem' so there is no use of the callbacks 'debugfs_{read32,read64,write32,write6}'. Remove them. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 9248aa90d2fa0a03955f0813d17accde9e1f0751 Author: Dafna Hirschfeld Date: Wed Mar 16 19:45:24 2022 +0200 habanalabs: enforce alignment upon registers access through debugfs When accessing the configuration registers through debugfs, it is only allowed to access aligned address. Fail if address is not aligned. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit ee8a10c833c4a49720055f23eeb215352b969bda Author: Dafna Hirschfeld Date: Wed Mar 23 17:21:56 2022 +0200 habanalabs: unify code for memory access from debugfs Currently each asic version implements 4 callbacks: 'debugfs_{read32/write32/read64/write64}' There is a lot of code duplication among the different callbacks of all asic versions. This patch unify the code in order to avoid the code duplication by iterating the pci_mem_region array in hl_device and use its fields instead of macros. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 234366d3b6dac33dc6f78abf0fbc4abe9bae986b Author: Dafna Hirschfeld Date: Wed Mar 23 17:11:45 2022 +0200 habanalabs: add callback and field to be used for debugfs refactor This is a preparation for unifying the code of accessing device memory through debugfs. Add struct fields and callbacks that will later be used in debugfs code and will reduce code duplication among the different read{32,64}/write{32,64} callbacks of every asic. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 116a28ac1f0802dc306392746c3dde272ee55c47 Author: kernel test robot Date: Fri Mar 25 05:23:11 2022 +0800 habanalabs: hl_ts_behavior can be static drivers/misc/habanalabs/common/memory.c:2137:28: warning: symbol 'hl_ts_behavior' was not declared. Should it be static? Fixes: 4d530e7d121a ("habanalabs: convert ts to use unified memory manager") Reported-by: kernel test robot Signed-off-by: kernel test robot Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit d0b59cf68cecf48cc3e7ab817046a221967fbf8c Author: Ohad Sharabi Date: Tue Mar 22 14:32:40 2022 +0200 habanalabs/gaudi: add debugfs to fetch internal sync status When Gaudi device is secured the monitors data in the configuration space is blocked from PCI access. As we need to enable user to get sync-manager monitors registers when debugging, this patch adds a debugfs that dumps the information to a binary file (blob). When a root user will trigger the dump, the driver will send request to the f/w to fill a data structure containing dump of all monitors registers. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit f5d85fe05a943920aed8e2911fe2a13f53b14bce Author: Ohad Sharabi Date: Tue Mar 22 09:21:29 2022 +0200 habanalabs: rephrase device out-of-memory message The out of memory message is rephrased to more subtle expression as out of memory may be caused by the user in case of, for example, greedy allocation. In addition the user is also being notified by an error code. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit c3712c1d7d3dc313527a7ff7c29726e091bc8f43 Author: Dafna Hirschfeld Date: Sun Mar 13 15:33:52 2022 +0200 habanalabs/gaudi: Use correct sram size macro for debugfs We currently allow accessing the whole SRAM bar size with the macro SRAM_BAR_SIZE, but the actual size of the sram region is the macro SRAM_SIZE which is only a portion of the whole bar size. So when accessing the sram through debugfs, use the macro SRAM_SIZE for the sram size which is the correct macro. Signed-off-by: Dafna Hirschfeld Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit acbabe63efa78012eb3702486e1cfe7b485f70a0 Author: Ohad Sharabi Date: Mon Mar 21 14:39:19 2022 +0200 habanalabs: add MMU prefetch to ASIC-specific code This is necessary pre-requisite for future ASIC support, where MMU TLB prefetch is supported. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 4d530e7d121a2b4fc703c4c2145ae761140bc18f Author: Yuri Nudelman Date: Sun Mar 20 16:15:01 2022 +0200 habanalabs: convert ts to use unified memory manager With the introduction of the unified memory manager infrastructure, the timestamp buffers can be converted to use it. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit babe8e7c04b5d3b7298b77acdd1de922c97442bc Author: Yuri Nudelman Date: Sun Mar 20 16:08:12 2022 +0200 habanalabs: unified memory manager infrastructure This is a part of overall refactoring attempt to separate nic and the core drivers. Currently, there are 4 different flows, that contain very similar code. These are the ts, nic, hwblocks and cb alloc/map flows. The similar aspect of all these flows is that they all contain a central store, with memory buffers inside, supporting the following set of operations: - Allocate buffer and return handle - Get buffer from the store with handle - Put the buffer (last put releases the buffer) - Map the buffer to the user This patch contains a generic data structure used to implement the above memory buffer store interface. Conversion of the existing code to use the new data structure will follow. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit b75cce27d0bc18b69471469fddf06fc9ac00bb8f Author: Ofir Bitton Date: Mon Mar 7 19:53:36 2022 +0200 habanalabs: save f/w preboot major version We need this property for doing backward compatibility hacks against the f/w. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 9138c24244a71bf90cd36123247b768e83433347 Author: Jakob Koschel Date: Thu Mar 24 08:10:48 2022 +0100 habanalabs: replace usage of found with dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 687c6b535e4cb7ef501ed0d67d6e6e478ee9040c Author: Tomer Tayar Date: Wed Mar 9 19:44:47 2022 +0200 habanalabs: modify dma_mask to be ASIC specific property The required DMA mask is no longer based on input from the F/W, but it is fixed per ASIC according to its address space. As such, the per-ASIC function to get this value can be replaced with a property variable. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit c41cb902b22f3e8eb5d491d26957941db31e8345 Author: Ofir Bitton Date: Tue Mar 15 08:57:22 2022 +0200 habanalabs: parse full firmware versions When parsing firmware versions strings, driver should not assume a specific length and parse up to the maximum supported version length. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 9d92689ca26e98e3fc24239934e24ea79ed5680a Author: Tomer Tayar Date: Wed Jan 26 19:55:53 2022 +0200 habanalabs/gaudi: avoid resetting max power in hard reset The default max power is deduced from the card type value in the CPU-CP info. This value is then set in the max power variable of the device structure. Getting the CPU-CP info is done as part of the late init phase which is called also during reset. This means that a max power value which is modified via sysfs will be reset during hard reset back to the default value. As the max power is updated in any case during device init in hl_sysfs_init(), this setting in late init can be removed, and the overriding during reset is thus avoided. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit b19768d81a6bd1591872952075ff9d960bd4e8d8 Author: Ofir Bitton Date: Tue Mar 1 10:14:14 2022 +0200 habanalabs/gaudi: increase submission resources In order to allow user to have larger amount of submissions, we increase the DMA and NIC queue depth to 4K. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit fdec56c1a416c6947b1db22617da15cb89f46c6c Author: Ofir Bitton Date: Thu Mar 3 09:43:10 2022 +0200 habanalabs: expose compute ctx status through info ioctl In order for the user to know if he can try and open device, we expose the compute ctx state. The user can now know if the context is used by another process or whether the device is still ongoing through cleanup or reset and will be available soon. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 4c3b9f6e3bd0480474666f9e016ff57ea0c5ecaa Author: Ofir Bitton Date: Mon Feb 28 16:08:20 2022 +0200 habanalabs: add new return code to device fd open In order to be more informative during device open, we are adding a new return code -EAGAIN that indicates device is still going through resource reclaiming and hence it cannot be used yet. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 050a6f349a09d3cefb14f4114bfa047b2c5b2a65 Author: Ohad Sharabi Date: Wed Feb 23 13:37:08 2022 +0200 habanalabs: add user API to get valid DRAM page sizes Future devices will support multiple device memory page sizes. In addition, an API for the user was added for it to be able to control the device memory allocation page size. This patch is a complementary patch to inform the user of the available page size supported by the device. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 06926dbed215ac98d253b151ae5ad3b0cabac2bf Author: Ohad Sharabi Date: Tue Mar 1 14:29:41 2022 +0200 habanalabs: convert all MMU masks/shifts to arrays There is no need to hold each MMU mask/shift as a denoted structure member (e.g. hop0_mask). Instead converting it to array will result in smaller and more readable code. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 2f8f0de878e0f25984befd5a1f8f001e7c5ff9fd Author: Ohad Sharabi Date: Sun Feb 27 14:48:56 2022 +0200 habanalabs: change mmu_get_real_page_size to be ASIC-specific This patch breaks the cumbersome implementation of "get real page size" along with it's multiple inner conditions and implement each case (according to the real complexity) inside an ASIC function. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 1359fcbe0f4aa2cd6ea684727a5a111eebeeed3a Author: Ohad Sharabi Date: Wed Feb 23 11:47:05 2022 +0200 habanalabs: add DRAM default page size to HW info When using the device memory allocation API the user ought to know what is the default allocation page size. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 378b02dc017777e1dea304b472f2e2db836b6706 Author: Ohad Sharabi Date: Wed Feb 23 11:27:36 2022 +0200 habanalabs: set non-0 value in dram default page size Looking forward we will need to report to the user what is the default page size used. This will be done more conveniently by explicitly updating the property rather than to rely on a "0 meaning default" value. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Signed-off-by: Greg Kroah-Hartman commit 5ab312b3a8fef467e807e8d7672e65cabe2376fd Author: Julia Lawall Date: Sat May 21 13:10:47 2022 +0200 hwmon: (sl28cpld) Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-37-Julia.Lawall@inria.fr Signed-off-by: Guenter Roeck commit d1baf7a3a3177d46a7149858beddb88a9eca7a54 Author: Adam Wujek Date: Thu May 19 23:34:01 2022 +0000 hwmon: (pmbus) Check PEC support before reading other registers Make sure that the support of PEC is determined before the read of other registers. Otherwise the validation of PEC can trigger an error on the read of STATUS_BYTE or STATUS_WORD registers. The problematic scenario is the following. A device with enabled PEC support is up and running and a kernel driver is loaded. Then the driver is unloaded (or device unbound), the HW device is reconfigured externally (e.g. by i2cset) to advertise itself as not supporting PEC. Without the move of the code, at the second load of the driver (or bind) the STATUS_BYTE or STATUS_WORD register is always read with PEC enabled, which is likely to cause a read error resulting with fail of a driver load (or bind). Signed-off-by: Adam Wujek Link: https://lore.kernel.org/r/20220519233334.438621-1-dev_public@wujek.eu Fixes: 75d2b2b06bd84 ("hwmon: (pmbus) disable PEC if not enabled") Fixes: 4e5418f787ec5 ("hwmon: (pmbus_core) Check adapter PEC support") [groeck: Added Fixes: tags, dropped continuation line] Signed-off-by: Guenter Roeck commit 9baabde04de64137e86b39112c6259f3da512bd6 Author: Guenter Roeck Date: Tue May 17 13:08:25 2022 -0700 hwmon: (dimmtemp) Fix bitmap handling Building arm:allmodconfig may fail with the following error. In function 'fortify_memcpy_chk', inlined from 'bitmap_copy' at include/linux/bitmap.h:261:2, inlined from 'bitmap_copy_clear_tail' at include/linux/bitmap.h:270:2, inlined from 'bitmap_from_u64' at include/linux/bitmap.h:622:2, inlined from 'check_populated_dimms' at drivers/hwmon/peci/dimmtemp.c:284:2: include/linux/fortify-string.h:344:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter) The problematic code is bitmap_from_u64(priv->dimm_mask, dimm_mask); dimm_mask is declared as u64, but the bitmap in priv->dimm_mask is only 24 bit wide. On 32-bit systems, this results in writes over the end of the bitmap. Fix the problem by using u32 instead of u64 for dimm_mask. This is currently sufficient, and a compile time check to ensure that the number of dimms does not exceed the bit map size is already in place. Fixes: 73bc1b885dae ("hwmon: peci: Add dimmtemp driver") Cc: Iwona Winiarska Reviewed-by: Iwona Winiarska Signed-off-by: Guenter Roeck commit 45988d907859b8e6c620c7b8742f65f5b1fbb565 Author: Holger Brunck Date: Tue May 17 15:56:14 2022 +0200 hwmon: (lm90) enable extended range according to DTS node Some lm90 compatible devices can operate in an extended temperature mode. This feature is now enabled if the property is set in the corresponding device tree node. Signed-off-by: Holger Brunck Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220517135614.8185-2-holger.brunck@hitachienergy.com Signed-off-by: Guenter Roeck commit 8dd248fa00db2b0145de95a7ef2b50b8fa71e1b0 Author: Holger Brunck Date: Tue May 17 15:56:13 2022 +0200 dt-bindings: hwmon: lm90: add ti,extended-range-enable property Some devices can operate in an extended temperature mode. Therefore add a boolean ti,extended-range-enable to be able to select this feature in the device tree node. Also make sure that this feature can only be enabled for the devices supporting this feature. Signed-off-by: Holger Brunck Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220517135614.8185-1-holger.brunck@hitachienergy.com Signed-off-by: Guenter Roeck commit 67f6abceab228d5f589435db2d99df6cbf43aa02 Author: Holger Brunck Date: Tue May 17 09:56:26 2022 +0200 dt-bindings: hwmon: lm90: add missing ti,tmp461 This sensor is already supported from the driver, but is missing in the list of compatible devices in the yaml file. Signed-off-by: Holger Brunck Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220517075626.16809-1-holger.brunck@hitachienergy.com Signed-off-by: Guenter Roeck commit be1ca367e7b6dcf0fe47fe577c65cabc305bbf87 Author: keliu Date: Tue May 17 06:31:26 2022 +0000 hwmon: (ibmaem) Directly use ida_alloc()/free() Use ida_alloc()/ida_free() instead of deprecated ida_simple_get()/ida_simple_remove() . Signed-off-by: keliu Link: https://lore.kernel.org/r/20220517063126.2142637-2-liuke94@huawei.com [groeck: Updated subject to include driver name] Signed-off-by: Guenter Roeck commit 718fbfa5da5da0b4d030e14ed737c228ca6a7cbf Author: keliu Date: Tue May 17 06:31:25 2022 +0000 hwmon: Directly use ida_alloc()/free() Use ida_alloc()/ida_free() instead of deprecated ida_simple_get()/ida_simple_remove() . Signed-off-by: keliu Link: https://lore.kernel.org/r/20220517063126.2142637-1-liuke94@huawei.com Signed-off-by: Guenter Roeck commit 5b4285c57b6f9b41f6c1def6b624da3a9b000dc6 Author: Eugene Shalygin Date: Tue May 17 10:05:08 2022 +0200 hwmon: (asus-ec-sensors) fix Formula VIII definition The ROG CROSSHAIR VIII FORMULA board has the same sensors as the CROSSHAIR VIII HERO [1] thus let's join their definitions which adds missing sensors for Formula. [1] https://github.com/LibreHardwareMonitor/LibreHardwareMonitor/pull/740 Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220517080508.1910953-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 3a3aad68621967561f20c6ace4bdbc910d01bc7d Author: Greg.Schwendimann@infineon.com Date: Mon May 16 14:03:43 2022 +0000 dt-bindings: trivial-devices: Add xdp152 Add Infineon Digital Multi-phase xdp152 family controllers. Signed-off-by: Greg Schwendimann Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/1a600fd51db942389a5078a72c3bf411@infineon.com Signed-off-by: Guenter Roeck commit ca538531c0deaeff352f1aa8caa216794cb14bc9 Author: Guenter Roeck Date: Thu May 12 12:06:00 2022 -0700 hwmon: (sl28cpld-hwmon) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Cc: Michael Walle Signed-off-by: Guenter Roeck commit 7282d2aefcc6cc3ab093968df108f399f93e69e8 Author: Guenter Roeck Date: Thu May 12 12:05:59 2022 -0700 hwmon: (pwm-fan) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Signed-off-by: Guenter Roeck commit 7c399d6a5bdf844fb02842e9db3d19d2df911c6a Author: Guenter Roeck Date: Thu May 12 12:05:59 2022 -0700 hwmon: (peci/dimmtemp) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Cc: Iwona Winiarska Signed-off-by: Guenter Roeck commit 09e02c8e632a1717e6ffaf352cfeb2840bc861d2 Author: Guenter Roeck Date: Thu May 12 12:05:59 2022 -0700 hwmon: (peci/cputemp) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Cc: Iwona Winiarska Reviewed-by: Iwona Winiarska Signed-off-by: Guenter Roeck commit 9070d8618eb2c6b7bfecc20a374f98bda4836026 Author: Guenter Roeck Date: Thu May 12 12:05:58 2022 -0700 hwmon: (mr75203) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Cc: Philipp Zabel Signed-off-by: Guenter Roeck commit c2e813438ef562eee81a42a7fe8f15fd7d9d29b9 Author: Guenter Roeck Date: Thu May 12 12:05:58 2022 -0700 hwmon: (ltc2992) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Signed-off-by: Guenter Roeck commit 6b767ccd3b7ef8a17313ec8d07d5c4c7623d1e67 Author: Guenter Roeck Date: Thu May 12 12:05:57 2022 -0700 hwmon: (as370-hwmon) Use HWMON_CHANNEL_INFO macro The HWMON_CHANNEL_INFO macro simplifies the code, reduces the likelihood of errors, and makes the code easier to read. The conversion was done automatically with coccinelle. The semantic patch used to make this change is as follows. @s@ identifier i,j,ty; @@ -struct hwmon_channel_info j = { - .type = ty, - .config = i, -}; @r@ initializer list elements; identifier s.i; @@ -u32 i[] = { - elements, - 0 -}; @script:ocaml t@ ty << s.ty; elements << r.elements; shorter; elems; @@ shorter := make_ident (List.hd(List.rev (Str.split (Str.regexp "_") ty))); elems := make_ident (String.concat "," (List.map (fun x -> Printf.sprintf "\n\t\t\t %s" x) (Str.split (Str.regexp " , ") elements))) @@ identifier s.j,t.shorter; identifier t.elems; @@ - &j + HWMON_CHANNEL_INFO(shorter,elems) This patch does not introduce functional changes. Many thanks to Julia Lawall for providing the coccinelle script. Signed-off-by: Guenter Roeck commit ddaefa209c4ac791c1262e97c9b2d0440c8ef1d5 Author: Guenter Roeck Date: Wed May 11 06:22:51 2022 -0700 hwmon: Make chip parameter for with_info API mandatory Various attempts were made recently to "convert" the old hwmon_device_register() API to devm_hwmon_device_register_with_info() by just changing the function name without actually converting the driver. Prevent this from happening by making the 'chip' parameter of devm_hwmon_device_register_with_info() mandatory. Signed-off-by: Guenter Roeck commit 87743bcf08072b3e1952a0bf5524b2833e667b4c Author: Guenter Roeck Date: Wed May 11 06:36:29 2022 -0700 thermal/drivers/thermal_hwmon: Use hwmon_device_register_for_thermal() The thermal subsystem registers a hwmon device without providing chip information or sysfs attribute groups. While undesirable, it would be difficult to change. On the other side, it abuses the hwmon_device_register_with_info API by not providing that information. Use new API specifically created for the thermal subsystem instead to let us enforce the 'chip' parameter for other callers of hwmon_device_register_with_info(). Acked-by: Rafael J . Wysocki Signed-off-by: Guenter Roeck commit e5d21072054fbadf41cd56062a3a14e447e8c22b Author: Guenter Roeck Date: Wed May 11 06:29:59 2022 -0700 hwmon: Introduce hwmon_device_register_for_thermal The thermal subsystem registers a hwmon driver without providing chip or sysfs group information. This is for legacy reasons and would be difficult to change. At the same time, we want to enforce that chip information is provided when registering a hwmon device using hwmon_device_register_with_info(). To enable this, introduce a special API for use only by the thermal subsystem. Acked-by: Rafael J . Wysocki Signed-off-by: Guenter Roeck commit 59e746ca86ff4f73183f6ff0e6b046705b00e081 Author: Corentin Labbe Date: Mon May 9 06:30:09 2022 +0000 hwmon: (acpi_power_meter) Fix style issues Fix style issues found by checkpatch. Signed-off-by: Corentin Labbe Link: https://lore.kernel.org/r/20220509063010.3878134-2-clabbe@baylibre.com Signed-off-by: Guenter Roeck commit 9ccafe466c3242a17ae7d2ea1b02986bb94fd587 Author: Debabrata Banerjee Date: Thu May 5 09:33:51 2022 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X570-E GAMING WIFI II Adds support for the ROG STRIX X570-E GAMING WIFI II board and simplifies formatting for the list of supported models. Signed-off-by: Debabrata Banerjee Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220505073351.123753-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 6bb77c55b05fccea588fdc069008fa81e7359679 Author: Zev Weiss Date: Wed Apr 27 18:27:07 2022 -0700 hwmon: (nct6775) Add i2c driver This driver provides an i2c I/O mechanism for the core nct6775 driver, as might be used by a BMC. Because the Super I/O chip is shared with the host CPU in such a scenario (and the host should ultimately be in control of it), the i2c driver is strictly read-only to avoid interfering with any usage by the host (aside from the bank-select register, which seems to be replicated for the i2c interface). Signed-off-by: Zev Weiss Tested-by: Renze Nicolai Link: https://lore.kernel.org/r/20220428012707.24921-3-zev@bewilderbeest.net Signed-off-by: Guenter Roeck commit 801549da5d71254198328ffb2c610dd86fe62803 Author: Zev Weiss Date: Wed Apr 27 18:27:06 2022 -0700 dt-bindings: hwmon: Add nuvoton,nct6775 These Super I/O chips have an i2c interface that some systems expose to a BMC; the BMC's device tree can now describe that via this binding. Signed-off-by: Zev Weiss Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220428012707.24921-2-zev@bewilderbeest.net Signed-off-by: Guenter Roeck commit 764124082805b41f2f203c37f80657f41f139aaf Author: Denis Pauk Date: Sat May 7 10:29:33 2022 +0300 hwmon: (nct6775) add ASUS PRO H410T / PRIME H410M-R / ROG X570-E GAMING WIFI II Boards such as * PRO H410T * PRIME H410M-R * ROG STRIX X570-E GAMING WIFI II have got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. This commit adds such boards to the WMI monitoring list. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Reported-by: renedis Reported-by: Dmitrii Levchenko Reported-by: Hubert Banas Link: https://lore.kernel.org/r/20220507072933.3013-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 512a4da1d9f55d9e3be87b2ea6d0a51ef342e764 Author: Karl Mehltretter Date: Sun May 8 16:46:01 2022 +0200 hwmon: (lm83) Remove unused include directives Some include directives are no longer necessary due to previous driver changes. Remove them now to further improve driver code clarity. Mutex usage has ceased since commit 719af4f1a40b ("hwmon: (lm83) Use regmap"). Ever since commit a0ac840d99fa ("hwmon: (lm83) Convert to use devm_hwmon_device_register_with_groups") functions sysfs_create_group and sysfs_remove_group are no longer used by the driver. Signed-off-by: Karl Mehltretter Link: https://lore.kernel.org/r/20220508144601.22796-1-kmehltretter@gmail.com Signed-off-by: Guenter Roeck commit 28bf22ef93eceb42c7583f0909bc9dedc07770e3 Author: Mårten Lindahl Date: Tue May 3 12:46:31 2022 +0200 hwmon: (pmbus) Add get_voltage/set_voltage ops The pmbus core does not have operations for getting or setting voltage. Add functions get/set voltage for the dynamic regulator framework. Signed-off-by: Mårten Lindahl Link: https://lore.kernel.org/r/20220503104631.3515715-5-marten.lindahl@axis.com [groeck: cosmetic alignment / empty line fixes] Signed-off-by: Guenter Roeck commit 3aa74796cfd038310f68c7e67c804224e5b43809 Author: Eduardo Valentin Date: Thu Apr 28 10:49:26 2022 -0700 hwmon: (pmbus) Register with thermal for PSC_TEMPERATURE Some pmbus device drivers have device tree support and may want to use of-thermal to register a thermal zone OF sensor for those device drivers. This way we allow describing device tree thermal zones for pmbus device drivers with device tree support. This patch achieves this by registering pmbus sensors with thermal subsystem if they are PSC_TEMPERATURE and are providing _input hwmon interface. Cc: Guenter Roeck (maintainer:PMBUS HARDWARE MONITORING DRIVERS) Cc: Jean Delvare (maintainer:HARDWARE MONITORING) Cc: linux-hwmon@vger.kernel.org (open list:PMBUS HARDWARE MONITORING DRIVERS) Cc: linux-kernel@vger.kernel.org (open list) Signed-off-by: Eduardo Valentin Signed-off-by: Eduardo Valentin Link: https://lore.kernel.org/r/20220428174926.2150-1-eduval@amazon.com Signed-off-by: Guenter Roeck commit d45cd804280d5cf43d539f49f671ea26552cedc3 Author: Chris Packham Date: Wed Mar 23 16:40:56 2022 +1300 hwmon: (adt7475) Use enum chips when loading attenuator settings Make use of enum chips and use a switch statement in load_attenuators() so that the compiler can tell us if we've failed to cater for a supported chip. Signed-off-by: Chris Packham Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220323034056.260455-4-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 7b8664f126e90d1d2129b8653c587bf230dd800c Author: Chris Packham Date: Wed Mar 23 16:40:55 2022 +1300 hwmon: (adt7475) Add support for pin configuration The adt7473, adt7475, adt7476 and adt7490 have pins that can be used for different functions. On the adt7473 and adt7475 this is pins 5 and 9. On the adt7476 and adt7490 this is pins 10 and 14. The first pin can either be PWM2(default) or SMBALERT#. The second pin can be TACH4(default), THERM#, SMBALERT# or GPIO. The adt7475 driver has always been able to detect the configuration if it had been done by an earlier boot stage. Add support for configuring the pins based on the hardware description in the device tree. Signed-off-by: Chris Packham Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220323034056.260455-3-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 4fc1b113624784cf1a3b5b1ea813afca2a0b9dcc Author: Chris Packham Date: Wed Mar 23 16:40:54 2022 +1300 dt-bindings: hwmon: Document adt7475 pin-function properties The adt7473, adt7475, adt7476 and adt7490 have pins that can be used for different functions. Add bindings so that it is possible to describe what pin functions are intended by the hardware design. Signed-off-by: Chris Packham Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220323034056.260455-2-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit c8f55be4a1c7b4f64ecac1369e55f366b7f03bd2 Author: Michael Walle Date: Fri Apr 1 23:40:32 2022 +0200 hwmon: add driver for the Microchip LAN966x SoC Add support for the temperatur sensor and the fan controller on the Microchip LAN966x SoC. Apparently, an Analog Bits PVT sensor is used which can measure temperature and process voltages. But only a forumlae for the temperature sensor is known. Additionally, the SoC support a fan tacho input as well as a PWM signal to control the fan. Signed-off-by: Michael Walle Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220401214032.3738095-5-michael@walle.cc [groeck: Added missing reference in Documentation/hwmon/index.rst] Signed-off-by: Guenter Roeck commit ede7e1c20b7533d89259027595fe4e0096b827c9 Author: Michael Walle Date: Fri Apr 1 23:40:31 2022 +0200 dt-bindings: hwmon: add Microchip LAN966x bindings Add a binding for the temperature sensor and the fan controller on the Microchip LAN966x family. Signed-off-by: Michael Walle Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220401214032.3738095-4-michael@walle.cc Signed-off-by: Guenter Roeck commit e0daf1a60ed47828cc3563c5d036692cc7a702e9 Author: Michael Walle Date: Fri Apr 1 23:40:30 2022 +0200 hwmon: (bt1-pvt) use generic polynomial functions The polynomial calculation function was moved into lib/ to be able to reuse it. Move over to this one. Signed-off-by: Michael Walle Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220401214032.3738095-3-michael@walle.cc Signed-off-by: Guenter Roeck commit cd705ea857fdd859a9df09e8adda4cb4c906e8a2 Author: Michael Walle Date: Fri Apr 1 23:40:29 2022 +0200 lib: add generic polynomial calculation Some temperature and voltage sensors use a polynomial to convert between raw data points and actual temperature or voltage. The polynomial is usually the result of a curve fitting of the diode characteristic. The BT1 PVT hwmon driver already uses such a polynonmial calculation which is rather generic. Move it to lib/ so other drivers can reuse it. Signed-off-by: Michael Walle Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220401214032.3738095-2-michael@walle.cc Signed-off-by: Guenter Roeck commit 9054416afcb443933c16f9e8c4531086e62eb689 Author: Greg.Schwendimann@infineon.com Date: Wed Apr 27 18:40:12 2022 +0000 hwmon: (pmbus) Add support for Infineon Digital Multi-phase xdp152 family controllers Add support for devices XDPE152C4, XDPE12584. Signed-off-by: Greg Schwendimann Link: https://lore.kernel.org/r/5e6d50e9b28140158f339b0de343eea4@infineon.com Signed-off-by: Guenter Roeck commit 30b5e6ef4a32ea4985b99200e06d6660a69f9246 Author: Geert Uytterhoeven Date: Fri May 20 16:32:30 2022 +0200 m68k: atari: Make Atari ROM port I/O write macros return void The macros implementing Atari ROM port I/O writes do not cast away their output, unlike similar implementations for other I/O buses. When they are combined using conditional expressions in the definitions of outb() and friends, this triggers sparse warnings like: drivers/net/appletalk/cops.c:382:17: error: incompatible types in conditional expression (different base types): drivers/net/appletalk/cops.c:382:17: unsigned char drivers/net/appletalk/cops.c:382:17: void Fix this by adding casts to "void". Reported-by: kernel test robot Reported-by: Guenter Roeck Signed-off-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Reviewed-by: Michael Schmitz Link: https://lore.kernel.org/r/c15bedc83d90a14fffcd5b1b6bfb32b8a80282c5.1653057096.git.geert@linux-m68k.org commit 73c348d4ab5c34aa2186071e66eaa5700d35e104 Author: Jiapeng Chong Date: Sun May 22 16:47:17 2022 +1000 xfs: Remove duplicate include Clean up the following includecheck warning: ./fs/xfs/xfs_attr_item.c: xfs_inode.h is included more than once. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 93e6aa4329d07fa01e1016446464c666c5b49b5c Author: Kaixu Xia Date: Sun May 22 16:47:11 2022 +1000 xfs: reduce IOCB_NOWAIT judgment for retry exclusive unaligned DIO Retry unaligned DIO with exclusive blocking semantics only when the IOCB_NOWAIT flag is not set. If we are doing nonblocking user I/O, propagate the error directly. Signed-off-by: Kaixu Xia Reviewed-by: Chaitanya Kulkarni Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit e62c720817597f259b81f1ff004eb042293bf046 Author: Jiapeng Chong Date: Sun May 22 16:46:57 2022 +1000 xfs: Remove dead code Remove tht entire xlog_recover_check_summary() function, this entire function is dead code and has been for 12 years. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Reviewed-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 41bc61c02a5a3aa4f8ba5f9e9c54668468925c72 Author: Julia Lawall Date: Sun May 22 16:46:38 2022 +1000 xfs: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit e3c5de22026fda01674c400b97f96857dfb58aab Author: Darrick J. Wong Date: Sun May 22 16:00:26 2022 +1000 xfs: rename struct xfs_attr_item to xfs_attr_intent Everywhere else in XFS, structures that capture the state of an ongoing deferred work item all have names that end with "_intent". The new extended attribute deferred work items are not named as such, so fix it to follow the naming convention used elsewhere. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit a5d28039ecb288f4788ae98c8291e092961e8742 Author: Oliver O'Halloran Date: Wed Sep 2 13:51:59 2020 +1000 powerpc/powernv/pci: Drop VF MPS fixup The MPS field in the VF config space is marked as reserved in current versions of the SR-IOV spec. In other words, this fixup doesn't do anything. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200902035159.1762596-1-oohall@gmail.com commit ad91f66f5fa7c6f9346e721c3159ce818568028b Author: Christophe Leroy Date: Thu May 19 19:24:15 2022 +0200 powerpc/fsl_book3e: Don't set rodata RO too early On fsl_book3e, rodata is set read-only at the same time as init text is set NX at the end of init. That's too early. As both action are performed at the same time, delay both actions to the time rodata is expected to be made read-only. It means we will have a small window with init mem freed but still executable. It shouldn't be an issue though, especially because the said memory gets poisoned and should therefore result to a bad instruction fault in case it gets executed. mmu_mark_initmem_nx() is bailing out before doing anything when CONFIG_STRICT_KERNEL_RWX is not selected or rodata_enabled is false. mmu_mark_rodata_ro() is called only when CONFIG_STRICT_KERNEL_RWX is selected and rodata_enabled is true so this is equivalent. Move code from mmu_mark_initmem_nx() into mmu_mark_rodata_ro() and remove the call to strict_kernel_rwx_enabled() which is not needed anymore. Fixes: d5970045cf9e ("powerpc/fsl_booke: Update of TLBCAMs after init") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/2e35f0fd649c83c5add17a99514ac040767be93a.1652981047.git.christophe.leroy@csgroup.eu commit 0ef1ffc7189521e293b4c5532659385dfddf8939 Author: Joel Stanley Date: Thu May 19 22:27:06 2022 +0930 powerpc/microwatt: Add mmu bits to device tree In commit 5402e239d09f ("powerpc/64s: Get LPID bit width from device tree") the kernel tried to determine the pid and lpid bits from the device tree. If they are not found, there is a fallback, but Microwatt wasn't covered as it has the unusual configuration of being both !HV and bare metal. Set the values in the device tree to avoid having to add a special case. The lpid value is the only one required, but add both for completeness. Fixes: 5402e239d09f ("powerpc/64s: Get LPID bit width from device tree") Signed-off-by: Joel Stanley Acked-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220519125706.593532-1-joel@jms.id.au commit 25e69962efdbbbd8bf52e6b4d7852c49717923a2 Author: Vasant Hegde Date: Tue Sep 14 15:46:30 2021 +0530 powerpc/powernv/flash: Check OPAL flash calls exist before using Currently only FSP based powernv systems supports firmware update interfaces. Hence check that the token OPAL_FLASH_VALIDATE exists before initalising the flash driver. Signed-off-by: Vasant Hegde Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210914101630.30613-1-hegdevasant@linux.vnet.ibm.com commit bb12dd42d20f5513a8d1da225232af0a0743fd79 Author: Krzysztof Kozlowski Date: Fri Sep 24 12:56:53 2021 +0200 powerpc/powermac: constify device_node in of_irq_parse_oldworld() The of_irq_parse_oldworld() does not modify passed device_node so make it a pointer to const for safety. Drop the extern while modifying the line. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210924105653.46963-2-krzysztof.kozlowski@canonical.com commit cc025916b12a452df7932da528d25b2ef2b05072 Author: Krzysztof Kozlowski Date: Fri Sep 24 12:56:52 2021 +0200 powerpc/powermac: add missing g5_phy_disable_cpu1() declaration g5_phy_disable_cpu1() is used outside of platforms/powermac/feature.c, so it should have a declaration to fix W=1 warning: arch/powerpc/platforms/powermac/feature.c:1533:6: error: no previous prototype for ‘g5_phy_disable_cpu1’ [-Werror=missing-prototypes] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210924105653.46963-1-krzysztof.kozlowski@canonical.com commit 7801cb1dc60f7348687ca1c3aa03a944687563f0 Author: Colin Ian King Date: Sat Mar 19 23:20:25 2022 +0000 selftests/powerpc/pmu: fix spelling mistake "mis-match" -> "mismatch" There are a few spelling mistakes in error messages. Fix them. Signed-off-by: Colin Ian King Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220319232025.22067-1-colin.i.king@gmail.com commit 26b78c81e84c5133b299fb11bf17ec1a3d2ad217 Author: Reza Arbab Date: Tue May 3 12:01:52 2022 -0500 powerpc: Enable the DAWR on POWER9 DD2.3 and above The hardware bug in POWER9 preventing use of the DAWR was fixed in DD2.3. Set the CPU_FTR_DAWR feature bit on these newer systems to start using it again, and update the documentation accordingly. The CPU features for DD2.3 are currently determined by "DD2.2 or later" logic. In adding DD2.3 as a discrete case for the first time here, I'm carrying the quirks of DD2.2 forward to keep all behavior outside of this DAWR change the same. This leaves the assessment and potential removal of those quirks on DD2.3 for later. Signed-off-by: Reza Arbab Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220503170152.23412-1-arbab@linux.ibm.com commit b4d9cc75721bdbceba0d71aa5accf6aa09ee26c1 Author: Michael Ellerman Date: Thu May 19 15:03:57 2022 +1000 powerpc/64s: Add CPU_FTRS_POWER10 to ALWAYS mask CPU_FTRS_POWER10 is missing from the CPU_FTRS_ALWAYS mask. Currently that doesn't cause any bug, because it is a superset of the POWER9 mask, which the exception of CPU_FTR_TM, but POWER7 doesn't have CPU_FTR_TM, so CPU_FTR_TM is not in the ALWAYS mask to begin with. However for consistency, and to be robust against future changes, it should be included in the ALWAYS mask. Fixes: a3ea40d5c736 ("powerpc: Add POWER10 architected mode") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220519122205.746276-2-mpe@ellerman.id.au commit 3e36960a27fec30f16bace1521dc852105522f5e Author: Michael Ellerman Date: Thu May 19 14:30:56 2022 +1000 powerpc/64s: Add CPU_FTRS_POWER9_DD2_2 to CPU_FTRS_ALWAYS mask CPU_FTRS_POWER9_DD2_2 is missing from CPU_FTRS_ALWAYS. That doesn't cause any bug, because CPU_FTRS_POWER9_DD2_2 adds new bits that don't appear in other values, so when anded with the other masks the result is the same. But for consistency we should have all values in the CPU_FTRS_ALWAYS mask, so that the logic is robust against the values being changed in future. Fixes: b5af4f279323 ("powerpc: Add CPU feature bits for TM bug workarounds on POWER9 v2.2") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220519122205.746276-1-mpe@ellerman.id.au commit 3768f6985700106e90eca87d814dc08e609a9969 Author: Darrick J. Wong Date: Sun May 22 15:59:48 2022 +1000 xfs: clean up state variable usage in xfs_attr_node_remove_attr The state variable is now a local variable pointing to a heap allocation, so we don't need to zero-initialize it, nor do we need the conditional to decide if we should free it. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson Signed-off-by: Dave Chinner commit 4136e38af728eddcab2e51aecde28e94d0782b9b Author: Darrick J. Wong Date: Sun May 22 15:59:48 2022 +1000 xfs: put attr[id] log item cache init with the others Initialize and destroy the xattr log item caches in the same places that we do all the other log item caches. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 500a512c60d132dbffc0233ba22ad067756c0ccd Author: Darrick J. Wong Date: Sun May 22 15:59:48 2022 +1000 xfs: remove struct xfs_attr_item.xattri_flags Nobody uses this field, so get rid of it and the unused flag definition. Rearrange the structure layout to reduce its size from 104 to 96 bytes. This gets us from 39 to 42 objects per page. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit e2c78949b641d34cb4051b32c2fa5e03a4bfef35 Author: Darrick J. Wong Date: Sun May 22 15:59:48 2022 +1000 xfs: use a separate slab cache for deferred xattr work state Create a separate slab cache for struct xfs_attr_item objects, since we can pack the (104-byte) intent items more tightly than we can with the general slab cache objects. On x86, this means 39 intents per memory page instead of 32. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit b53d212b4b5c29ab16edb7eca2b0e05927b7aa34 Author: Darrick J. Wong Date: Sun May 22 15:59:48 2022 +1000 xfs: put the xattr intent item op flags in their own namespace The flags that are stored in the extended attr intent log item really should have a separate namespace from the rest of the XFS_ATTR_* flags. Give them one to make it a little more obvious that they're intent item flags. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson Signed-off-by: Dave Chinner commit 87c78b612f4feccdcf4019351206ebe0e3dfe828 Author: Michael Ellerman Date: Thu May 19 00:26:29 2022 +1000 powerpc: Fix all occurences of "the the" Rather than waiting for the bots to fix these one-by-one, fix all occurences of "the the" throughout arch/powerpc. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220518142629.513007-1-mpe@ellerman.id.au commit 4d0cdd2bb8f0bf1a30d361f14bafc428794551e0 Author: Darrick J. Wong Date: Sun May 22 15:59:34 2022 +1000 xfs: clean up xfs_attr_node_hasname The calling conventions of this function are a mess -- callers /can/ provide a pointer to a pointer to a state structure, but it's not required, and as evidenced by the last two patches, the callers that do weren't be careful enough about how to deal with an existing da state. Push the allocation and freeing responsibilty to the callers, which means that callers from the xattr node state machine steps now have the visibility to allocate or free the da state structure as they please. As a bonus, the node remove/add paths for larp-mode replaces can reset the da state structure instead of freeing and immediately reallocating it. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 079e5fd3a1e41c186c1bc4166d409d22e70729bf Author: Madhavan Srinivasan Date: Tue Mar 22 10:26:38 2022 +0530 selftests/powerpc/pmu/ebb: remove fixed_instruction.S Commit 3752e453f6ba ("selftests/powerpc: Add tests of PMU EBBs") added selftest testcases to verify EBB interface. instruction_count_test.c testcase needs a fixed loop function to count overhead. Instead of using the thirty_two_instruction_loop() in fixed_instruction_loop.S in ebb folder, file is linked with thirty_two_instruction_loop() in loop.S from top folder. Since fixed_instruction_loop.S not used, patch removes the file. Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220322045638.10443-1-maddy@linux.ibm.com commit 8a57c3cc2bcb8df98c239d6804fd01834960b7d2 Author: Minghao Chi (CGEL ZTE) Date: Fri Feb 25 01:07:37 2022 +0000 powerpc/platforms/83xx: Use of_device_get_match_data() Use of_device_get_match_data() to simplify the code. Reported-by: Zeal Robot Signed-off-by: Minghao Chi (CGEL ZTE) Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220225010737.2038781-1-chi.minghao@zte.com.cn commit 3def164a5cedad9117859dd4610cae2cc59cb6d2 Author: Haowen Bai Date: Wed May 11 09:27:56 2022 +0800 powerpc/eeh: Drop redundant spinlock initialization slot_errbuf_lock has declared and initialized by DEFINE_SPINLOCK, so we don't need to spin_lock_init again, drop it. Signed-off-by: Haowen Bai Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1652232476-9696-1-git-send-email-baihaowen@meizu.com commit 57b742a5b8945118022973e6416b71351df512fb Author: Peng Wu Date: Mon Apr 25 08:12:45 2022 +0000 powerpc/iommu: Add missing of_node_put in iommu_init_early_dart The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Signed-off-by: Peng Wu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220425081245.21705-1-wupeng58@huawei.com commit 426e5805226358dbe9af233347c5bf3c81f2125c Author: Zheng Bin Date: Wed May 11 11:35:07 2022 +0800 powerpc/pseries/vas: Call misc_deregister if sysfs init fails Undo effects of misc_register if sysfs init fails after misc_register. Signed-off-by: Zheng Bin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220511033507.2745992-1-zhengbin13@huawei.com commit 0e0946e22f3665d27325d389ff45ade6e93f3678 Author: Vaibhav Jain Date: Wed May 11 13:56:36 2022 +0530 powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated 'char *' and at other places it assumes it to be a 'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size. Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for 'stat_id' entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to iterate over the array and free up individual elements. Fixes: 4c08d4bbc089 ("powerpc/papr_scm: Add perf interface support") Signed-off-by: Vaibhav Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220511082637.646714-1-vaibhav@linux.ibm.com commit fcee96924ba1596ca80a6770b2567ca546f9a482 Author: Miaoqian Lin Date: Thu May 12 16:37:18 2022 +0400 powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: abc3aeae3aaa ("fsl-rio: Add two ports and rapidio message units support") Signed-off-by: Miaoqian Lin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220512123724.62931-1-linmq006@gmail.com commit 1d1fb9618bdd5a5fbf9a9eb75133da301d33721c Author: Miaoqian Lin Date: Thu May 12 13:05:33 2022 +0400 powerpc/xive: Fix refcount leak in xive_spapr_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller") Signed-off-by: Miaoqian Lin Reviewed-by: Cédric Le Goater Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220512090535.33397-1-linmq006@gmail.com commit 48b63961c84671df4c4a4451c40057e34b26df1a Author: Oscar Salvador Date: Mon Apr 11 09:49:34 2022 +0200 powerpc/numa: Associate numa node to its cpu earlier powerpc is the only platform that do not rely on cpu_up()->try_online_node() to bring up a numa node, and special cases it, instead, deep in its own machinery: dlpar_online_cpu find_and_online_cpu_nid try_online_node This should not be needed, but the thing is that the try_online_node() from cpu_up() will not apply on the right node, because cpu_to_node() will return the old mapping numa<->cpu that gets set on boot stage for all possible cpus. That can be seen easily if we try to print out the numa node passed to try_online_node() in cpu_up(). The thing is that the numa<->cpu mapping does not get updated till a much later stage in start_secondary: start_secondary: set_numa_node(numa_cpu_lookup_table[cpu]) But we do not really care, as we already now the CPU <-> NUMA associativity back in find_and_online_cpu_nid(), so let us make use of that and set the proper numa<->cpu mapping, so cpu_to_node() in cpu_up() returns the right node and try_online_node() can do its work. Signed-off-by: Oscar Salvador Tested-by: Geetika Moolchandani Reviewed-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220411074934.4632-1-osalvador@suse.de commit 9a9c5ff5fff87eb1a43db0d899473554e408fd7b Author: Randy Dunlap Date: Sun Apr 10 09:10:35 2022 -0700 macintosh: via-pmu and via-cuda need RTC_LIB Fix build when RTC_LIB is not set/enabled. Eliminates these build errors: m68k-linux-ld: drivers/macintosh/via-pmu.o: in function `pmu_set_rtc_time': drivers/macintosh/via-pmu.c:1769: undefined reference to `rtc_tm_to_time64' m68k-linux-ld: drivers/macintosh/via-cuda.o: in function `cuda_set_rtc_time': drivers/macintosh/via-cuda.c:797: undefined reference to `rtc_tm_to_time64' Fixes: 0792a2c8e0bb ("macintosh: Use common code to access RTC") Reported-by: kernel test robot Suggested-by: Christophe Leroy Signed-off-by: Randy Dunlap Acked-by: Arnd Bergmann Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220410161035.592-1-rdunlap@infradead.org commit 86ce436e30d86327c9f5260f718104ae7b21f506 Author: Finn Thain Date: Thu Apr 7 20:11:32 2022 +1000 macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled drivers/macintosh/via-pmu-event.o: In function `via_pmu_event': via-pmu-event.c:(.text+0x44): undefined reference to `input_event' via-pmu-event.c:(.text+0x68): undefined reference to `input_event' via-pmu-event.c:(.text+0x94): undefined reference to `input_event' via-pmu-event.c:(.text+0xb8): undefined reference to `input_event' drivers/macintosh/via-pmu-event.o: In function `via_pmu_event_init': via-pmu-event.c:(.init.text+0x20): undefined reference to `input_allocate_device' via-pmu-event.c:(.init.text+0xc4): undefined reference to `input_register_device' via-pmu-event.c:(.init.text+0xd4): undefined reference to `input_free_device' make[1]: *** [Makefile:1155: vmlinux] Error 1 make: *** [Makefile:350: __build_one_by_one] Error 2 Don't call into the input subsystem unless CONFIG_INPUT is built-in. Reported-by: kernel test robot Signed-off-by: Finn Thain Tested-by: Randy Dunlap Reviewed-by: Christophe Leroy Acked-by: Randy Dunlap Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/5edbe76ce68227f71e09af4614cc4c1bd61c7ec8.1649326292.git.fthain@linux-m68k.org commit 3ffa9fd471f57f365bc54fc87824c530422f64a5 Author: Lv Ruyi Date: Thu Apr 7 09:00:43 2022 +0000 powerpc/powernv: fix missing of_node_put in uv_init() of_find_compatible_node() returns node pointer with refcount incremented, use of_node_put() on it when done. Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220407090043.2491854-1-lv.ruyi@zte.com.cn commit dc21ed2aef4150fc2fcf58227a4ff24502015c03 Author: Christophe Leroy Date: Thu Mar 31 12:03:06 2022 +0200 powerpc/85xx: Remove FSL_85XX_CACHE_SRAM CONFIG_FSL_85XX_CACHE_SRAM is an option that is not user selectable and which is not selected by any driver nor any defconfig. Remove it and all associated code. Signed-off-by: Christophe Leroy Acked-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/9949813a6b758903b7bee910f798ba2ca82ff8ee.1648720908.git.christophe.leroy@csgroup.eu commit 5dd9e27ea4a39f7edd4bf81e9e70208e7ac0b7c9 Author: Lv Ruyi Date: Sat Apr 2 01:34:19 2022 +0000 powerpc/xics: fix refcount leak in icp_opal_init() The of_find_compatible_node() function returns a node pointer with refcount incremented, use of_node_put() on it when done. Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220402013419.2410298-1-lv.ruyi@zte.com.cn commit ab0cc6bbf0c812731c703ec757fcc3fc3a457a34 Author: Kajol Jain Date: Fri May 6 11:40:15 2022 +0530 powerpc/perf: Fix the threshold compare group constraint for power9 Thresh compare bits for a event is used to program thresh compare field in Monitor Mode Control Register A (MMCRA: 9-18 bits for power9). When scheduling events as a group, all events in that group should match value in threshold bits (like thresh compare, thresh control, thresh select). Otherwise event open for the sibling events should fail. But in the current code, incase thresh compare bits are not valid, we are not failing in group_constraint function which can result in invalid group schduling. Fix the issue by returning -1 incase event is threshold and threshold compare value is not valid. Thresh control bits in the event code is used to program thresh_ctl field in Monitor Mode Control Register A (MMCRA: 48-55). In below example, the scheduling of group events PM_MRK_INST_CMPL (873534401e0) and PM_THRESH_MET (8734340101ec) is expected to fail as both event request different thresh control bits and invalid thresh compare value. Result before the patch changes: [command]# perf stat -e "{r8735340401e0,r8734340101ec}" sleep 1 Performance counter stats for 'sleep 1': 11,048 r8735340401e0 1,967 r8734340101ec 1.001354036 seconds time elapsed 0.001421000 seconds user 0.000000000 seconds sys Result after the patch changes: [command]# perf stat -e "{r8735340401e0,r8734340101ec}" sleep 1 Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (r8735340401e0). /bin/dmesg | grep -i perf may provide additional information. Fixes: 78a16d9fc1206 ("powerpc/perf: Avoid FAB_*_MATCH checks for power9") Signed-off-by: Kajol Jain Reviewed-by: Athira Rajeev Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220506061015.43916-2-kjain@linux.ibm.com commit 505d31650ba96d6032313480fdb566d289a4698c Author: Kajol Jain Date: Fri May 6 11:40:14 2022 +0530 powerpc/perf: Fix the threshold compare group constraint for power10 Thresh compare bits for a event is used to program thresh compare field in Monitor Mode Control Register A (MMCRA: 8-18 bits for power10). When scheduling events as a group, all events in that group should match value in threshold bits. Otherwise event open for the sibling events should fail. But in the current code, incase thresh compare bits are not valid, we are not failing in group_constraint function which can result in invalid group schduling. Fix the issue by returning -1 incase event is threshold and threshold compare value is not valid in group_constraint function. Patch also fixes the p10_thresh_cmp_val function to return -1, incase threshold bits are not valid and changes corresponding check in is_thresh_cmp_valid function to return false only when the thresh_cmp value is less then 0. Thresh control bits in the event code is used to program thresh_ctl field in Monitor Mode Control Register A (MMCRA: 48-55). In below example, the scheduling of group events PM_MRK_INST_CMPL (3534401e0) and PM_THRESH_MET (34340101ec) is expected to fail as both event request different thresh control bits. Result before the patch changes: [command]# perf stat -e "{r35340401e0,r34340101ec}" sleep 1 Performance counter stats for 'sleep 1': 8,482 r35340401e0 0 r34340101ec 1.001474838 seconds time elapsed 0.001145000 seconds user 0.000000000 seconds sys Result after the patch changes: [command]# perf stat -e "{r35340401e0,r34340101ec}" sleep 1 Performance counter stats for 'sleep 1': r35340401e0 r34340101ec 1.001499607 seconds time elapsed 0.000204000 seconds user 0.000760000 seconds sys Fixes: 82d2c16b350f7 ("powerpc/perf: Adds support for programming of Thresholding in P10") Signed-off-by: Kajol Jain Reviewed-by: Athira Rajeev Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220506061015.43916-1-kjain@linux.ibm.com commit cdf87d2bd12cf3ea760a1fa35907a31e5177f425 Author: YueHaibing Date: Tue May 17 17:49:00 2022 +0800 powerpc/kaslr_booke: Fix build error arch/powerpc/mm/nohash/kaslr_booke.c: In function ‘kaslr_get_cmdline’: arch/powerpc/mm/nohash/kaslr_booke.c:46:2: error: implicit declaration of function ‘early_init_dt_scan_chosen’ early_init_dt_scan_chosen(boot_command_line); ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/powerpc/mm/nohash/kaslr_booke.c: In function ‘get_initrd_range’: arch/powerpc/mm/nohash/kaslr_booke.c:210:10: error: implicit declaration of function ‘of_read_number’ start = of_read_number(prop, len / 4); ^~~~~~~~~~~~~~ Add missing include files to fix this. Fixes: 86c38fec69a4 ("powerpc: Remove asm/prom.h from all files that don't need it") Signed-off-by: YueHaibing Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220517094900.14900-1-yuehaibing@huawei.com commit 7574dd080ee0a1e8a9c6312dc7c8fe97f73415ff Author: YueHaibing Date: Tue May 17 17:48:30 2022 +0800 powerpc/book3e: Fix build error arch/powerpc/mm/nohash/fsl_book3e.c: In function ‘relocate_init’: arch/powerpc/mm/nohash/fsl_book3e.c:348:2: error: implicit declaration of function ‘early_get_first_memblock_info’ early_get_first_memblock_info(__va(dt_ptr), &size); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Add missing include file linux/of_fdt.h to fix this. Fixes: 86c38fec69a4 ("powerpc: Remove asm/prom.h from all files that don't need it") Signed-off-by: YueHaibing Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220517094830.27560-1-yuehaibing@huawei.com commit 41b7a347bf1491e7300563bb224432608b41f62a Author: Daniel Axtens Date: Wed May 18 20:05:31 2022 +1000 powerpc: Book3S 64-bit outline-only KASAN support Implement a limited form of KASAN for Book3S 64-bit machines running under the Radix MMU, supporting only outline mode. - Enable the compiler instrumentation to check addresses and maintain the shadow region. (This is the guts of KASAN which we can easily reuse.) - Require kasan-vmalloc support to handle modules and anything else in vmalloc space. - KASAN needs to be able to validate all pointer accesses, but we can't instrument all kernel addresses - only linear map and vmalloc. On boot, set up a single page of read-only shadow that marks all iomap and vmemmap accesses as valid. - Document KASAN in powerpc docs. Background ---------- KASAN support on Book3S is a bit tricky to get right: - It would be good to support inline instrumentation so as to be able to catch stack issues that cannot be caught with outline mode. - Inline instrumentation requires a fixed offset. - Book3S runs code with translations off ("real mode") during boot, including a lot of generic device-tree parsing code which is used to determine MMU features. [ppc64 mm note: The kernel installs a linear mapping at effective address c000...-c008.... This is a one-to-one mapping with physical memory from 0000... onward. Because of how memory accesses work on powerpc 64-bit Book3S, a kernel pointer in the linear map accesses the same memory both with translations on (accessing as an 'effective address'), and with translations off (accessing as a 'real address'). This works in both guests and the hypervisor. For more details, see s5.7 of Book III of version 3 of the ISA, in particular the Storage Control Overview, s5.7.3, and s5.7.5 - noting that this KASAN implementation currently only supports Radix.] - Some code - most notably a lot of KVM code - also runs with translations off after boot. - Therefore any offset has to point to memory that is valid with translations on or off. One approach is just to give up on inline instrumentation. This way boot-time checks can be delayed until after the MMU is set is up, and we can just not instrument any code that runs with translations off after booting. Take this approach for now and require outline instrumentation. Previous attempts allowed inline instrumentation. However, they came with some unfortunate restrictions: only physically contiguous memory could be used and it had to be specified at compile time. Maybe we can do better in the future. [paulus@ozlabs.org - Rebased onto 5.17. Note that a kernel with CONFIG_KASAN=y will crash during boot on a machine using HPT translation because not all the entry points to the generic KASAN code are protected with a call to kasan_arch_is_ready().] Originally-by: Balbir Singh # ppc64 out-of-line radix version Signed-off-by: Daniel Axtens Signed-off-by: Paul Mackerras [mpe: Update copyright year and comment formatting] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoTE69OQwiG7z+Gu@cleo commit 2ab2d5794f14c08676690bf0859f16cc768bb3a4 Author: Daniel Axtens Date: Wed May 18 20:07:05 2022 +1000 powerpc/kasan: Disable address sanitization in kexec paths The kexec code paths involve code that necessarily run in real mode, as CPUs are disabled and control is transferred to the new kernel. Disable address sanitization for the kexec code and the functions called in real mode on CPUs being disabled. [paulus@ozlabs.org: combined a few work-in-progress commits of Daniel's and wrote the commit message.] Signed-off-by: Daniel Axtens Signed-off-by: Paul Mackerras [mpe: Move pseries_machine_kexec() into kexec.c so setup.c can be instrumented] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoTFSQ2TUSEaDdVC@cleo commit 5352090a999570c6e8a701bcb755fd91e8c5a2cd Author: Daniel Axtens Date: Wed May 18 20:06:17 2022 +1000 powerpc/kasan: Don't instrument non-maskable or raw interrupts Disable address sanitization for raw and non-maskable interrupt handlers, because they can run in real mode, where we cannot access the shadow memory. (Note that kasan_arch_is_ready() doesn't test for real mode, since it is a static branch for speed, and in any case not all the entry points to the generic KASAN code are protected by kasan_arch_is_ready guards.) The changes to interrupt_nmi_enter/exit_prepare() look larger than they actually are. The changes are equivalent to adding !IS_ENABLED(CONFIG_KASAN) to the conditions for calling nmi_enter() or nmi_exit() in real mode. That is, the code is equivalent to using the following condition for calling nmi_enter/exit: if (((!IS_ENABLED(CONFIG_PPC_BOOK3S_64) || !firmware_has_feature(FW_FEATURE_LPAR) || radix_enabled()) && !IS_ENABLED(CONFIG_KASAN) || (mfmsr() & MSR_DR)) That unwieldy condition has been split into several statements with comments, for easier reading. The nmi_ipi_lock functions that call atomic functions (i.e., nmi_ipi_lock_start(), nmi_ipi_lock() and nmi_ipi_unlock()), besides being marked noinstr, now call arch_atomic_* functions instead of atomic_* functions because with KASAN enabled, the atomic_* functions are wrappers which explicitly do address sanitization on their arguments. Since we are trying to avoid address sanitization, we have to use the lower-level arch_atomic_* versions. In hv_nmi_check_nonrecoverable(), the regs_set_unrecoverable() call has been open-coded so as to avoid having to either trust the inlining or mark regs_set_unrecoverable() as noinstr. [paulus@ozlabs.org: combined a few work-in-progress commits of Daniel's and wrote the commit message.] Signed-off-by: Daniel Axtens Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoTFGaKM8Pd46PIK@cleo commit f08aed52412c860f68e30da148da58ad8e40a43b Author: Daniel Axtens Date: Wed May 18 20:04:58 2022 +1000 powerpc/mm/kasan: rename kasan_init_32.c to init_32.c kasan is already implied by the directory name, we don't need to repeat it. Suggested-by: Christophe Leroy Signed-off-by: Daniel Axtens Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoTEyoi+xu9brJYe@cleo commit 60e832def18de7a0753393034c6ae459b3bee70a Author: Daniel Axtens Date: Wed May 18 20:04:12 2022 +1000 kasan: Document support on 32-bit powerpc KASAN is supported on 32-bit powerpc and the docs should reflect this. Suggested-by: Christophe Leroy Signed-off-by: Daniel Axtens Signed-off-by: Paul Mackerras Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/YoTEnMLrnd64j0w5@cleo commit 84ade0a6655bee803d176525ef457175cbf4df22 Author: Naveen N. Rao Date: Mon May 16 12:44:22 2022 +0530 powerpc/ftrace: Remove ftrace init tramp once kernel init is complete Stop using the ftrace trampoline for init section once kernel init is complete. Fixes: 67361cf8071286 ("powerpc/ftrace: Handle large kernel configs") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220516071422.463738-1-naveen.n.rao@linux.vnet.ibm.com commit 5fe855169f9782c669f640b66242662209ffb72a Author: Christophe Leroy Date: Mon May 16 17:36:04 2022 +0200 powerpc/irq: Remove arch_local_irq_restore() for !CONFIG_CC_HAS_ASM_GOTO All supported versions of GCC & clang support asm goto. Remove the !CONFIG_CC_HAS_ASM_GOTO version of arch_local_irq_restore() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/58df50c9e77e2ed945bacdead30412770578886b.1652715336.git.christophe.leroy@csgroup.eu commit 48482f4dd3432e5e62873bf0f2e254cfb8ce2ac2 Author: Russell Currey Date: Tue Jun 8 16:48:09 2021 +1000 selftests/powerpc: Better reporting in spectre_v2 In commit f3054ffd71b5 ("selftests/powerpc: Return skip code for spectre_v2"), the spectre_v2 selftest is updated to be aware of cases where the vulnerability status reported in sysfs is incorrect, skipping the test instead. This happens because qemu can misrepresent the mitigation status of the host to the guest. If the count cache is disabled in the host, and this is correctly reported to the guest, then the guest won't apply mitigations. If the guest is then migrated to a new host where mitigations are necessary, it is now vulnerable because it has not applied mitigations. Update the selftest to report when we see excessive misses, indicative of the count cache being disabled. If software flushing is enabled, also warn that these flushes are just wasting performance. Signed-off-by: Russell Currey [mpe: Rebase and update change log appropriately] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210608064809.199116-1-ruscur@russell.cc commit d2a3c131981d4498571908df95c3c9393a00adf5 Author: Russell Currey Date: Mon Apr 4 20:15:36 2022 +1000 powerpc/powernv: Get STF barrier requirements from device-tree The device-tree property no-need-store-drain-on-priv-state-switch is equivalent to H_CPU_BEHAV_NO_STF_BARRIER from the H_CPU_GET_CHARACTERISTICS hcall on pseries. Since commit 84ed26fd00c5 ("powerpc/security: Add a security feature for STF barrier") powernv systems with this device-tree property have been enabling the STF barrier when they have no need for it. This patch fixes this by clearing the STF barrier feature on those systems. Fixes: 84ed26fd00c5 ("powerpc/security: Add a security feature for STF barrier") Reported-by: Joel Stanley Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220404101536.104794-2-ruscur@russell.cc commit 2efee6adb56159288bce9d1ab51fc9056d7007d4 Author: Russell Currey Date: Mon Apr 4 20:15:35 2022 +1000 powerpc/powernv: Get L1D flush requirements from device-tree The device-tree properties no-need-l1d-flush-msr-pr-1-to-0 and no-need-l1d-flush-kernel-on-user-access are the equivalents of H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY and H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS from the H_GET_CPU_CHARACTERISTICS hcall on pseries respectively. In commit d02fa40d759f ("powerpc/powernv: Remove POWER9 PVR version check for entry and uaccess flushes") the condition for disabling the L1D flush on kernel entry and user access was changed from any non-P9 CPU to only checking P7 and P8. Without the appropriate device-tree checks for newer processors on powernv, these flushes are unnecessarily enabled on those systems. This patch corrects this. Fixes: d02fa40d759f ("powerpc/powernv: Remove POWER9 PVR version check for entry and uaccess flushes") Reported-by: Joel Stanley Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220404101536.104794-1-ruscur@russell.cc commit 294299b3d39e8b4ae10c12ef1ed71405ef7b1e43 Author: Pali Rohár Date: Fri May 6 22:36:21 2022 +0200 powerpc/85xx/p2020: Add fsl,mpc8548-pmc node P2020 also contains Power Management Controller and their registers at offset 0xe0070 compatible with mpc8548. So add PMC node into DTS include file fsl/p2020si-post.dtsi Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220506203621.26314-1-pali@kernel.org commit c4bce84d0bd3f396f702d69be2e92bbd8af97583 Author: Michael Ellerman Date: Thu Apr 7 00:58:01 2022 +1000 powerpc/64: Only WARN if __pa()/__va() called with bad addresses We added checks to __pa() / __va() to ensure they're only called with appropriate addresses. But using BUG_ON() is too strong, it means virt_addr_valid() will BUG when DEBUG_VIRTUAL is enabled. Instead switch them to warnings, arm64 does the same. Fixes: 4dd7554a6456 ("powerpc/64: Add VIRTUAL_BUG_ON checks for __va and __pa addresses") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220406145802.538416-5-mpe@ellerman.id.au commit aa06530a535ffe8ba8b68054003b6fb262a8ec6f Author: Michael Ellerman Date: Thu May 5 22:51:23 2022 +1000 arch/Kconfig: Drop references to powerpc PAGE_SIZE symbols In the previous commit powerpc added PAGE_SIZE related config symbols using the generic names. So there's no need to refer to them in the definition of PAGE_SIZE_LESS_THAN_64KB etc, the negative dependency on the generic symbol is sufficient (in this case !PAGE_SIZE_64KB). Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220505125123.2088143-2-mpe@ellerman.id.au commit d036dc79cccd748e2a101c80c31efada7be8bb7c Author: Michael Ellerman Date: Thu May 5 22:51:22 2022 +1000 powerpc: Add generic PAGE_SIZE config symbols Other arches (sh, mips, hexagon) use standard names for PAGE_SIZE related config symbols. Add matching symbols for powerpc, which are enabled by default but depend on our architecture specific PAGE_SIZE symbols. This allows generic/driver code to express dependencies on the PAGE_SIZE without needing to refer to architecture specific config symbols. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220505125123.2088143-1-mpe@ellerman.id.au commit 657ac633302b9d694958a82654363cb559277759 Author: Haren Myneni Date: Sat Apr 9 01:46:15 2022 -0700 powerpc/pseries/vas: sysfs comments with the correct entries VAS entry is created as a misc device and the sysfs comments should list the proper entries Reported-by: Matheus Castanho Signed-off-by: Haren Myneni Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/6dee950c7b72a4965c102208041f14a063cf5a8c.camel@linux.ibm.com commit c127d130f6d59fa81701f6b04023cf7cd1972fb3 Author: Haren Myneni Date: Sat Apr 9 01:44:16 2022 -0700 powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr In init_winctx_regs(), __pa() is called on winctx->rx_fifo and this function is called to initialize registers for receive and fault windows. But the real address is passed in winctx->rx_fifo for receive windows and the virtual address for fault windows which causes errors with DEBUG_VIRTUAL enabled. Fixes this issue by assigning only real address to rx_fifo in vas_rx_win_attr struct for both receive and fault windows. Reported-by: Michael Ellerman Signed-off-by: Haren Myneni Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/338e958c7ab8f3b266fa794a1f80f99b9671829e.camel@linux.ibm.com commit 6bdc81eca9519a85d36b3915136640ef9cba1a23 Author: Christophe Leroy Date: Mon May 9 07:36:23 2022 +0200 powerpc/opcodes: Remove unused PPC_INST_XXX macros The following PPC_INST_XXX macros are not used anymore outside ppc-opcode.h: - PPC_INST_LD - PPC_INST_STD - PPC_INST_ADDIS - PPC_INST_ADD - PPC_INST_DIVD Remove them. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/8c28636126f69141419953b5638b4a908c184dc1.1652074503.git.christophe.leroy@csgroup.eu commit ae2c760fa10ba2475aa46fffa6be42050586c604 Author: Christophe Leroy Date: Mon May 9 07:36:22 2022 +0200 powerpc/inst: Remove PPC_INST_BL Convert last users of PPC_INST_BL to PPC_RAW_BL() And remove PPC_INST_BL. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d9eacb758e7ae7cf224211ebe3f6f7d409a333be.1652074503.git.christophe.leroy@csgroup.eu commit e0c2ef43210b023ed9a58c520c2fbede7010c592 Author: Christophe Leroy Date: Mon May 9 07:36:21 2022 +0200 powerpc/modules: Use PPC_LI macros instead of opencoding Use PPC_LI_MASK and PPC_LI() instead of opencoding. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/3d56d7bc3200403773d54e62659d0e01292a055d.1652074503.git.christophe.leroy@csgroup.eu commit 4390a58ee1c37dc915dcf44fabe925b160f5bcf0 Author: Christophe Leroy Date: Mon May 9 07:36:20 2022 +0200 powerpc/inst: Remove PPC_INST_BRANCH Convert last users of PPC_INST_BRANCH to PPC_RAW_BRANCH() And remove PPC_INST_BRANCH. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/fa8807108a2ef2287a2c9651d6e1ff7c051923d9.1652074503.git.christophe.leroy@csgroup.eu commit 8052d043a48f733905e8ea8f900bf58b441a317f Author: Christophe Leroy Date: Mon May 9 07:36:19 2022 +0200 powerpc/ftrace: Don't use copy_from_kernel_nofault() in module_trampoline_target() module_trampoline_target() is quite a hot path used when activating/deactivating function tracer. Avoid the heavy copy_from_kernel_nofault() by doing four calls to copy_inst_from_kernel_nofault(). Use __copy_inst_from_kernel_nofault() for the 3 last calls. First call is done to copy_from_kernel_nofault() to check address is within kernel space. No risk to wrap out the top of kernel space because the last page is never mapped so if address is in last page the first copy will fails and the other ones will never be performed. And also make it notrace just like all functions that call it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c55559103e014b7863161559d340e8e9484eaaa6.1652074503.git.christophe.leroy@csgroup.eu commit 8dfdbe4368c09d9eeae2df8968ee6c345ec8c1b5 Author: Christophe Leroy Date: Mon May 9 07:36:18 2022 +0200 powerpc/inst: Add __copy_inst_from_kernel_nofault() On the same model as get_user() versus __get_user(), introduce __copy_inst_from_kernel_nofault() which doesn't check address. To be used by callers that have already checked that the adress is a kernel address. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1f3702890d6dbd64702b61834753bcc96851c18c.1652074503.git.christophe.leroy@csgroup.eu commit af8b9f352ffd435734ab8f94f99ccb922da916b4 Author: Christophe Leroy Date: Mon May 9 07:36:17 2022 +0200 powerpc/ftrace: Minimise number of #ifdefs A lot of #ifdefs can be replaced by IS_ENABLED() Do so. Signed-off-by: Christophe Leroy [mpe: Fold in changes suggested by Naveen and Christophe on list] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/18ce6708d6f8c71d87436f9c6019f04df4125128.1652074503.git.christophe.leroy@csgroup.eu commit b97d0e3dcfba07590ec3d2ca2b95b2f029962d16 Author: Christophe Leroy Date: Mon May 9 07:36:16 2022 +0200 powerpc/ftrace: Simplify expected_nop_sequence() Avoid ifdefs around expected_nop_sequence(). While at it make it a bool. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/305d22472f1f92127fba09692df6bb5d079a8cd0.1652074503.git.christophe.leroy@csgroup.eu commit c8deb28095f9cd2ee2f4d16e948c9e816a22811b Author: Christophe Leroy Date: Mon May 9 07:36:15 2022 +0200 powerpc/ftrace: Use size macro instead of opencoding 0x80000000 is SZ_2G. Use it. Signed-off-by: Christophe Leroy [mpe: Fix comparison against unsigned -SZ_2G] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/bb6626e884acffe87b58736291df57db3deaa9b9.1652074503.git.christophe.leroy@csgroup.eu commit 35a2b533a261e2e43542df902bd9757a1deebfd5 Author: Steve French Date: Sun May 22 00:41:41 2022 -0500 smb3: add trace point for oplock not found In order to debug problems with server potentially sending us an oplock that we don't recognize (or a race with close and oplock break) it would be helpful to have a dynamic trace point for this case. New tracepoint is called trace_smb3_oplock_not_found Signed-off-by: Steve French commit 2b058acecf56f6b8fac781911a683219b9ca3b7b Author: ChenXiaoSong Date: Wed May 18 22:56:49 2022 +0800 cifs: return the more nuanced writeback error on close() As filemap_check_errors() only report -EIO or -ENOSPC, we return more nuanced writeback error -(file->f_mapping->wb_err & MAX_ERRNO). filemap_write_and_wait filemap_write_and_wait_range filemap_check_errors -ENOSPC or -EIO filemap_check_wb_err errseq_check return -(file->f_mapping->wb_err & MAX_ERRNO) Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit fb253d5ba3fcbd3b4216bcc37d019926f5e32ebb Author: Steve French Date: Sat May 21 23:56:16 2022 -0500 smb3: add trace point for lease not found issue When trying to debug problems with server sending us a lease we don't recognize, it would be helpful to have a dynamic trace point for this case. New tracepoint is called trace_smb3_lease_not_found Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit fb64f7f1057e5eb6fbf3b06f92d1cd80ad7f9998 Author: Julia Lawall Date: Sat May 21 13:11:19 2022 +0200 cifs: smbd: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Steve French commit ef09ed5d37b84d18562b30cf7253e57062d0db05 Author: Ye Bin Date: Mon May 16 20:26:34 2022 +0800 ext4: fix bug_on in ext4_writepages we got issue as follows: EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls ------------[ cut here ]------------ kernel BUG at fs/ext4/inode.c:2708! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155 RIP: 0010:ext4_writepages+0x1977/0x1c10 RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000 RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002 RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000 R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001 R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028 FS: 00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_writepages+0x130/0x3a0 filemap_fdatawrite_wbc+0x83/0xa0 filemap_flush+0xab/0xe0 ext4_alloc_da_blocks+0x51/0x120 __ext4_ioctl+0x1534/0x3210 __x64_sys_ioctl+0x12c/0x170 do_syscall_64+0x3b/0x90 It may happen as follows: 1. write inline_data inode vfs_write new_sync_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin ext4_da_write_inline_data_begin -> If inline data size too small will allocate block to write, then mapping will has dirty page ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA 2. fallocate do_vfs_ioctl ioctl_preallocate vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_map_blocks -> fail will goto restore data ext4_restore_inline_data ext4_create_inline_data ext4_write_inline_data ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA 3. writepages __ext4_ioctl ext4_alloc_da_blocks filemap_flush filemap_fdatawrite_wbc do_writepages ext4_writepages if (ext4_has_inline_data(inode)) BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) The root cause of this issue is we destory inline data until call ext4_writepages under delay allocation mode. But there maybe already convert from inline to extent. To solve this issue, we call filemap_flush first.. Cc: stable@kernel.org Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220516122634.1690462-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o commit 72f63f4a770310233dba3bff8fc6e41660ebaa27 Author: Ritesh Harjani Date: Sun May 15 12:07:48 2022 +0530 ext4: refactor and move ext4_ioctl_get_encryption_pwsalt() This patch move code for FS_IOC_GET_ENCRYPTION_PWSALT case into ext4's crypto.c file, i.e. ext4_ioctl_get_encryption_pwsalt() and uuid_is_zero(). This is mostly refactoring logic and should not affect any functionality change. Suggested-by: Eric Biggers Reviewed-by: Eric Biggers Signed-off-by: Ritesh Harjani Link: https://lore.kernel.org/r/5af98b17152a96b245b4f7d2dfb8607fc93e36aa.1652595565.git.ritesh.list@gmail.com Signed-off-by: Theodore Ts'o commit 3030b59c8533835f4e8b5e6d7047f80dcf7e40b9 Author: Ritesh Harjani Date: Sun May 15 12:07:47 2022 +0530 ext4: cleanup function defs from ext4.h into crypto.c Some of these functions when CONFIG_FS_ENCRYPTION is enabled are not really inline (let compiler be the best judge of it). Remove inline and move them into crypto.c where they should be present. Reviewed-by: Eric Biggers Signed-off-by: Ritesh Harjani Link: https://lore.kernel.org/r/b7b9de2c7226298663fb5a0c28909135e2ab220f.1652595565.git.ritesh.list@gmail.com Signed-off-by: Theodore Ts'o commit b1241c8eb977826cf9b1588514ab8896aa23896b Author: Ritesh Harjani Date: Sun May 15 12:07:46 2022 +0530 ext4: move ext4 crypto code to its own file crypto.c This is to cleanup super.c file which has grown quite large. So, start moving ext4 crypto related code to where it should be in the first place i.e. fs/ext4/crypto.c Reviewed-by: Eric Biggers Signed-off-by: Ritesh Harjani Link: https://lore.kernel.org/r/7d637e093cbc34d727397e8d41a53a1b9ca7d7a4.1652595565.git.ritesh.list@gmail.com Signed-off-by: Theodore Ts'o commit 376b9133826865568167b4091ef92a68c4622b87 Author: Hyunchul Lee Date: Fri May 20 14:35:47 2022 +0900 ksmbd: fix outstanding credits related bugs outstanding credits must be initialized to 0, because it means the sum of credits consumed by in-flight requests. And outstanding credits must be compared with total credits in smb2_validate_credit_charge(), because total credits are the sum of credits granted by ksmbd. This patch fix the following error, while frametest with Windows clients: Limits exceeding the maximum allowable outstanding requests, given : 128, pending : 8065 Fixes: b589f5db6d4a ("ksmbd: limits exceeding the maximum allowable outstanding requests") Cc: stable@vger.kernel.org Signed-off-by: Hyunchul Lee Reported-by: Yufan Chen Tested-by: Yufan Chen Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5366afc4065075a4456941fbd51c33604d631ee5 Author: Hyunchul Lee Date: Wed May 18 06:46:08 2022 +0900 ksmbd: smbd: fix connection dropped issue When there are bursty connection requests, RDMA connection event handler is deferred and Negotiation requests are received even if connection status is NEW. To handle it, set the status to CONNECTED if Negotiation requests are received. Reported-by: Yufan Chen Signed-off-by: Hyunchul Lee Tested-by: Yufan Chen Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7820c6ee029548290b318e522eb2578516d05393 Author: Yang Li Date: Thu May 12 15:56:05 2022 +0800 ksmbd: Fix some kernel-doc comments Remove some warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. fs/ksmbd/misc.c:30: warning: Function parameter or member 'str' not described in 'match_pattern' fs/ksmbd/misc.c:30: warning: Excess function parameter 'string' description in 'match_pattern' fs/ksmbd/misc.c:163: warning: Function parameter or member 'share' not described in 'convert_to_nt_pathname' fs/ksmbd/misc.c:163: warning: Function parameter or member 'path' not described in 'convert_to_nt_pathname' fs/ksmbd/misc.c:163: warning: Excess function parameter 'filename' description in 'convert_to_nt_pathname' fs/ksmbd/misc.c:163: warning: Excess function parameter 'sharepath' description in 'convert_to_nt_pathname' fs/ksmbd/misc.c:259: warning: Function parameter or member 'share' not described in 'convert_to_unix_name' fs/ksmbd/misc.c:259: warning: Function parameter or member 'name' not described in 'convert_to_unix_name' fs/ksmbd/misc.c:259: warning: Excess function parameter 'path' description in 'convert_to_unix_name' fs/ksmbd/misc.c:259: warning: Excess function parameter 'tid' description in 'convert_to_unix_name' Reported-by: Abaci Robot Signed-off-by: Yang Li Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7a84399e1ce3f5f2fbec3e7dd93459ba25badc2f Author: Namjae Jeon Date: Mon May 16 16:23:28 2022 +0900 ksmbd: fix wrong smbd max read/write size check smb-direct max read/write size can be different with smb2 max read/write size. So smb2_read() can return error by wrong max read/write size check. This patch use smb_direct_max_read_write_size for this check in smb-direct read/write(). Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 65bb45b97b578c8eed1ffa80caec84708df49729 Author: Namjae Jeon Date: Mon May 16 16:22:43 2022 +0900 ksmbd: add smbd max io size parameter Add 'smbd max io size' parameter to adjust smbd-direct max read/write size. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 65ca7a3ffff811d6c0d4342d467c381257d566d4 Author: Namjae Jeon Date: Mon May 16 16:22:09 2022 +0900 ksmbd: handle smb2 query dir request for OutputBufferLength that is too small We found the issue that ksmbd return STATUS_NO_MORE_FILES response even though there are still dentries that needs to be read while file read/write test using framtest utils. windows client send smb2 query dir request included OutputBufferLength(128) that is too small to contain even one entry. This patch make ksmbd immediately returns OutputBufferLength of response as zero to client. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit ee1b0558965909872775183dc237cdf9f8eddaba Author: Hyunchul Lee Date: Sat Apr 30 08:30:29 2022 +0900 ksmbd: smbd: handle multiple Buffer descriptors Make ksmbd handle multiple buffer descriptors when reading and writing files using SMB direct: Post the work requests of rdma_rw_ctx for RDMA read/write in smb_direct_rdma_xmit(), and the work request for the READ/WRITE response with a remote invalidation in smb_direct_writev(). Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4e3edd0092704b25626a0fe60a974f6f382ff93d Author: Hyunchul Lee Date: Sat Apr 30 08:30:28 2022 +0900 ksmbd: smbd: change the return value of get_sg_list Make get_sg_list return EINVAL if there aren't mapped scatterlists. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit 11659a8ddbd9c4c1ab6f3b8f52837178ef121b20 Author: Hyunchul Lee Date: Sat Apr 30 08:30:27 2022 +0900 ksmbd: smbd: simplify tracking pending packets Because we don't have to tracking pending packets by dividing these into packets with payload and packets without payload, merge the tracking code. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit ddbdc861e37c168cf2fb8a7b7477f5d18b4daf76 Author: Hyunchul Lee Date: Sat Apr 30 08:30:26 2022 +0900 ksmbd: smbd: introduce read/write credits for RDMA read/write SMB2_READ/SMB2_WRITE request has to be granted the number of rw credits, the pages the request wants to transfer / the maximum pages which can be registered with one MR to read and write a file. And allocate enough RDMA resources for the maximum number of rw credits allowed by ksmbd. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1807abcf8778bcbbf584fe54da9ccbe9029c49bb Author: Hyunchul Lee Date: Sat Apr 30 08:30:25 2022 +0900 ksmbd: smbd: change prototypes of RDMA read/write related functions Change the prototypes of RDMA read/write operations to accept a pointer and length of buffer descriptors. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit fabcf4d8696839a8da8a3f90d1fd30ae923ddde7 Author: Julia Lawall Date: Sat May 21 12:48:06 2022 -0700 Input: cypress_ps2 - fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-27-Julia.Lawall@inria.fr Signed-off-by: Dmitry Torokhov commit 8810d7feee5a0cf88d7854f4ad4930a4fab8dd70 Author: Niklas Cassel Date: Thu Apr 14 19:30:36 2022 +0200 riscv: Don't output a bogus mmu-type on a no MMU kernel Currently on a 64-bit kernel built without CONFIG_MMU, /proc/cpuinfo will show the current MMU mode as sv57. While the device tree property "mmu-type" does have a value "riscv,none" to describe a CPU without a MMU, since commit 73c7c8f68e72 ("riscv: Use pgtable_l4_enabled to output mmu_type in cpuinfo"), we no longer rely on device tree to output the MMU mode. (Not even for CONFIG_32BIT.) Therefore, instead of readding code to look at the "mmu-type" device tree property, let's continue with the existing convention to use fixed values for configurations where we don't determine the MMU mode at runtime. Add a new fixed value for !CONFIG_MMU in order to output the correct MMU mode in cpuinfo. Signed-off-by: Niklas Cassel Link: https://lore.kernel.org/r/20220414173037.1381927-1-niklas.cassel@wdc.com Signed-off-by: Palmer Dabbelt commit 4420658a4a7b03e3f4afb925bdd3ab9e06c2c46f Author: Guo Ren Date: Thu May 5 11:55:24 2022 +0800 riscv: atomic: Add custom conditional atomic operation implementation Add conditional atomic operations' custom implementation (similar to dec_if_positive), here is the list: - arch_atomic_inc_unless_negative - arch_atomic_dec_unless_positive - arch_atomic64_inc_unless_negative - arch_atomic64_dec_unless_positive Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20220505035526.2974382-4-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 1d7f6932c522ea95668e14265175ce3d753d0c24 Author: Guo Ren Date: Thu May 5 11:55:23 2022 +0800 riscv: atomic: Optimize dec_if_positive functions Current implementation wastes another register to pass the argument, but we only need addi to calculate the result. Optimize the code with minimize the usage of registers. Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20220505035526.2974382-3-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit dd8437cd4249e367f747a37b6a19d4cd04bf8796 Author: Guo Ren Date: Thu May 5 11:55:22 2022 +0800 riscv: atomic: Cleanup unnecessary definition The cmpxchg32 & cmpxchg32_local are not used in Linux anymore. So clean up asm/cmpxchg.h. Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20220505035526.2974382-2-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit c9fc5ca454b3f0606589bff306793a3d2f0d9f13 Author: Ronnie Sahlberg Date: Tue May 10 09:42:06 2022 +1000 cifs: set the CREATE_NOT_FILE when opening the directory in use_cached_dir() This enforces that we can only do this for directories and not normal files or else the server will return an error. This means that we will have conditionally check IF the path refers to a directory or not in all the call-sites where we are unsure. Right now this check is for "" i.e. root. Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 198bf836dfb9c76105c93e6a3138ed1a33841fad Author: Ronnie Sahlberg Date: Tue May 10 09:42:05 2022 +1000 cifs: check for smb1 in open_cached_dir() Check protocol version in open_cached_dir() and return not supported for SMB1. This allows us to call open_cached_dir() from code that is common to both smb1 and smb2/3 in future patches without having to do this check in the call-site. At the same time, add a check if tcon is valid or not for the same reason. Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit f695b2893505a5ac812f32167b48b028a4e41494 Author: Ronnie Sahlberg Date: Tue May 10 09:42:04 2022 +1000 cifs: move definition of cifs_fattr earlier in cifsglob.h This only moves these definitions to come earlier in the file but not change the definition itself. This is done to reduce the amount of changes in future patches. Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Enzo Matsumiya Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit c25f77899753fdd6f43fa6999abd53fd0059496e Author: Prasad Sodagudi Date: Tue May 17 16:13:00 2022 +0530 mailbox: qcom-ipcc: Log the pending interrupt during resume Enable logging of the pending interrupt that triggered device wakeup. This logging information helps to debug IRQs that cause periodic device wakeups by printing the detailed information of pending IPCC interrupts. Scenario: Device wakeup caused by Modem crash Logs: qcom-ipcc mailbox: virq: 182 triggered client-id: 2; signal-id: 2 From the IPCC bindings it can further be understood that the client here is IPCC_CLIENT_MPSS and the signal was IPCC_MPROC_SIGNAL_SMP2P. Reviewed-by: Manivannan Sadhasivam Signed-off-by: Prasad Sodagudi Signed-off-by: Sibi Sankar Signed-off-by: Jassi Brar commit 369e4ef87a8f5da7c348ec2c61ec5cd726e8337a Author: Mario Limonciello Date: Mon May 9 09:17:16 2022 -0500 mailbox: pcc: Fix an invalid-load caught by the address sanitizer `pcc_mailbox_probe` doesn't initialize all memory that has been allocated before the first time that one of it's members `txdone_irq` may be accessed. This leads to a an invalid load any time that this member is accessed: [ 2.429769] UBSAN: invalid-load in drivers/mailbox/pcc.c:684:22 [ 2.430324] UBSAN: invalid-load in drivers/mailbox/mailbox.c:486:12 [ 4.276782] UBSAN: invalid-load in drivers/acpi/cppc_acpi.c:314:45 Link: https://bugzilla.kernel.org/show_bug.cgi?id=215587 Fixes: ce028702ddbc ("mailbox: pcc: Move bulk of PCCT parsing into pcc_mbox_probe") Signed-off-by: Mario Limonciello Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar commit 9accf46b7fb893a46eff3a57407b02ac227a7cd7 Author: Fabien Dessenne Date: Tue May 3 16:55:59 2022 +0200 dt-bindings: mailbox: remove the IPCC "wakeup" IRQ The stm32 ipcc mailbox driver supports only two interrupts (rx and tx), so remove the unsupported "wakeup" one. Signed-off-by: Fabien Dessenne Reviewed-by: Rob Herring Signed-off-by: Jassi Brar commit a022c7c96ca1c7d8b4d2702973bf4b1a7cff5958 Author: Krzysztof Kozlowski Date: Sun May 1 12:34:27 2022 +0200 mailbox: correct kerneldoc Correct kerneldoc warnings like: drivers/mailbox/arm_mhu_db.c:47: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst drivers/mailbox/qcom-ipcc.c:58: warning: Function parameter or member 'num_chans' not described in 'qcom_ipcc' Signed-off-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Acked-by: Sudeep Holla Signed-off-by: Jassi Brar commit d9512696082bcfd068ce65476c85c5b17511d4df Author: ran jianping Date: Thu Apr 28 06:42:09 2022 +0000 mailbox: omap: using pm_runtime_resume_and_get to simplify the code Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and pm_runtime_put_noidle. This change is just to simplify the code, no actual functional changes. Reported-by: Zeal Robot Signed-off-by: ran jianping Signed-off-by: Jassi Brar commit 504ff5b00853b05133c9cddfc351548b48cc5bdc Author: ran jianping Date: Wed Apr 27 05:41:00 2022 +0000 mailbox:imx: using pm_runtime_resume_and_get Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and pm_runtime_put_noidle. This change is just to simplify the code, no actual functional changes. Reported-by: Zeal Robot Signed-off-by: ran jianping Signed-off-by: Jassi Brar commit 02b5c35a617137ccad8d6988805ab54c3a9efc81 Author: Tinghan Shen Date: Fri Apr 22 10:39:09 2022 +0800 mailbox: mediatek: support mt8186 adsp mailbox Add support of mt8186 adsp mailbox. Signed-off-by: Tinghan Shen Signed-off-by: Jassi Brar commit dea27cda46116afea45fdaade52adedb732d77ab Author: Tinghan Shen Date: Fri Apr 22 10:39:08 2022 +0800 dt-bindings: mailbox: mtk,adsp-mbox: add mt8186 compatible name Add compatible name for MediaTek MT8186 SoC ADSP mailbox. Signed-off-by: Tinghan Shen Acked-by: Rob Herring Signed-off-by: Jassi Brar commit 74c20dd0f89238068de5bb6ecd4e968eddab339d Author: Kartik Date: Thu Apr 14 13:05:57 2022 +0530 mailbox: tegra-hsp: Add 128-bit shared mailbox support Add support for 128-bit shared mailboxes found on Tegra234 chips. Signed-off-by: Kartik Signed-off-by: Jassi Brar commit 58919326e72f63c380dc3271dd1cc8bdf1bbe3e4 Author: Kartik Date: Thu Apr 14 13:05:56 2022 +0530 dt-bindings: tegra186-hsp: add type for shared mailboxes Tegra234 supports sending/receiving 32-bit and 128-bit data over a shared mailbox. Based on the data size to be used, clients need to specify the type of shared mailbox in the device tree. Add a macro for 128-bit shared mailbox. Mailbox clients can use this macro as a flag in device tree to enable 128-bit data support for a shared mailbox. Signed-off-by: Kartik Acked-by: Rob Herring Signed-off-by: Jassi Brar commit 8f585d14030dcf8fbec2f864d189515e8be37a80 Author: Kartik Date: Thu Apr 14 13:05:55 2022 +0530 mailbox: tegra-hsp: Add tegra_hsp_sm_ops This patch introduces tegra_hsp_sm_ops to abstract send & receive API's for shared mailboxes. Signed-off-by: Kartik Signed-off-by: Jassi Brar commit 1b3418ac6451b771b677e049b8a48d96e258e922 Author: Yongqiang Niu Date: Wed Apr 6 17:12:13 2022 +0800 dt-bindings: gce: add the GCE header file for MT8186 Add the GCE header file to define GCE subsys ids, hardware event ids and constants for MT8186. Signed-off-by: Yongqiang Niu Acked-by: Rob Herring Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit 1b0070aca35ed70f9cc6f97b5d9f7f98cb4771fd Author: Xiaomeng Tong Date: Tue Apr 5 16:05:56 2022 +0800 mailbox: remove an unneeded NULL check on list iterator The list iterator is always non-NULL so it doesn't need to be checked. Thus just remove the unnecessary NULL check. Signed-off-by: Xiaomeng Tong Signed-off-by: Jassi Brar commit 262190a8ca2b1e1ec75b8a4f1c7f07e585facd6f Author: Tom Rix Date: Sun Apr 3 10:53:04 2022 -0400 mailbox: imx: remove redundant initializer Smatch reports this issue imx-mailbox.c:887:10: warning: Initializer entry defined twice imx-mailbox.c:889:10: also defined here .rxdb = imx_mu_generic_rxdb, Is listed twice, so remove one. Signed-off-by: Tom Rix Signed-off-by: Jassi Brar commit cd285535b8eeed314813783ba9b5a851bdf6bca8 Author: Krzysztof Kozlowski Date: Sat Apr 2 17:55:50 2022 +0200 dt-bindings: mailbox: qcom-ipcc: simplify the example Consumer examples in the bindings of resource providers are trivial, useless and duplicating code. Additionally the incomplete qcom,smp2p example triggers DT schema warnings. Cleanup the example by removing the consumer part and fixing the indentation to DT schema convention. Reported-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Jassi Brar commit c244dc1bc92e94c625325a654337490bb1da871a Author: Rafael J. Wysocki Date: Sat May 21 18:02:26 2022 +0200 Revert "ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms" Commit 6eaf08770ee8 ("ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms") made acpi_ex_system_do_sleep() log a warning for sleep times greater than 10 ms, but such sleep times are used in power management AML because of the PCI specification requirements. This results with logging warnings that cannot really be acted on in any useful way which is annoying and these warnings show up in the logs on many production systems, so revert commit 6eaf08770ee8. Signed-off-by: Rafael J. Wysocki commit edbc7960bef7fd71ef1e44d0df15b864784b14c8 Author: Marek Vasut Date: Thu May 19 01:38:44 2022 +0200 drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid Handle empty data-lanes = < >; property, which translates to dsi_lanes = 0 as invalid. Fixes: ceb515ba29ba6 ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") Signed-off-by: Marek Vasut Cc: Jonas Karlman Cc: Laurent Pinchart Cc: Lucas Stach Cc: Marek Vasut Cc: Maxime Ripard Cc: Neil Armstrong Cc: Robert Foss Cc: Sam Ravnborg Reviewed-by: Andrzej Hajda Reviewed-by: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/20220518233844.248504-1-marex@denx.de commit 3fe07bcd800d6e5e4e4263ca2564d69095c157bf Author: Jens Axboe Date: Sat May 21 09:17:05 2022 -0600 io_uring: cleanup handling of the two task_work lists Rather than pass in a bool for whether or not this work item needs to go into the priority list or not, provide separate helpers for it. For most use cases, this also then gets rid of the branch for non-priority task work. While at it, rename the prior_task_list to prio_task_list. Prior is a confusing name for it, as it would seem to indicate that this is the previous task_work list. prio makes it clear that this is a priority task_work list. Signed-off-by: Jens Axboe commit 2aeb1f5fbbacbe159690ef7338503f323b0d4f46 Author: Julia Lawall Date: Sat May 21 13:10:49 2022 +0200 EDAC/xgene: Fix typo processsors -> processors Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220521111145.81697-39-Julia.Lawall@inria.fr commit 537b9f2bf60f4bbd8ab89cea16aaab70f0c1560d Author: Julia Lawall Date: Sat May 21 13:10:38 2022 +0200 mtip32xx: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-28-Julia.Lawall@inria.fr Signed-off-by: Jens Axboe commit 2aaf516084184e4e6f80da01b2b3ed882fd20a79 Author: Julia Lawall Date: Sat May 21 13:10:39 2022 +0200 blk-mq: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20220521111145.81697-29-Julia.Lawall@inria.fr Signed-off-by: Jens Axboe commit 3cd4030da3a9b54ee1ffb8397aba857397c703e4 Author: Julia Lawall Date: Sat May 21 13:11:03 2022 +0200 i2c: meson: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Wolfram Sang commit e35fb4188942a7338588536cf9e9756c34c103fb Author: Kuninori Morimoto Date: Fri May 20 22:29:18 2022 +0200 i2c: rcar: use flags instead of atomic_xfer i2c-rcar already has priv->flags. This patch adds a new persistent flag ID_P_NOT_ATOMIC and uses it to save the extra variable. The negation of the logic was done to make the code more readable. Signed-off-by: Kuninori Morimoto [wsa: negated the logic, rebased, updated the commit message] Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit f0f0e07685609c84ef5e0a3b1725bb666c95fbc4 Author: Wolfram Sang Date: Fri May 20 22:29:17 2022 +0200 i2c: rcar: REP_AFTER_RD is not a persistent flag Previous refactoring makes it easy now to convert the above flag to a non-persistent one. This is more appropriate and easier to maintain. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 4c278db7be94ab5e147f5bf409a7b5571cdd4a5a Author: Wolfram Sang Date: Fri May 20 22:29:16 2022 +0200 i2c: rcar: use BIT macro consistently Easier to read and ensures proper types. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 027bbb884be006b05d9c577d6401686053aa789e Author: Pawan Gupta Date: Thu May 19 20:35:15 2022 -0700 KVM: x86/speculation: Disable Fill buffer clear within guests The enumeration of MD_CLEAR in CPUID(EAX=7,ECX=0).EDX{bit 10} is not an accurate indicator on all CPUs of whether the VERW instruction will overwrite fill buffers. FB_CLEAR enumeration in IA32_ARCH_CAPABILITIES{bit 17} covers the case of CPUs that are not vulnerable to MDS/TAA, indicating that microcode does overwrite fill buffers. Guests running in VMM environments may not be aware of all the capabilities/vulnerabilities of the host CPU. Specifically, a guest may apply MDS/TAA mitigations when a virtual CPU is enumerated as vulnerable to MDS/TAA even when the physical CPU is not. On CPUs that enumerate FB_CLEAR_CTRL the VMM may set FB_CLEAR_DIS to skip overwriting of fill buffers by the VERW instruction. This is done by setting FB_CLEAR_DIS during VMENTER and resetting on VMEXIT. For guests that enumerate FB_CLEAR (explicitly asking for fill buffer clear capability) the VMM will not use FB_CLEAR_DIS. Irrespective of guest state, host overwrites CPU buffers before VMENTER to protect itself from an MMIO capable guest, as part of mitigation for MMIO Stale Data vulnerabilities. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit a992b8a4682f119ae035a01b40d4d0665c4a2875 Author: Pawan Gupta Date: Thu May 19 20:34:14 2022 -0700 x86/speculation/mmio: Reuse SRBDS mitigation for SBDS The Shared Buffers Data Sampling (SBDS) variant of Processor MMIO Stale Data vulnerabilities may expose RDRAND, RDSEED and SGX EGETKEY data. Mitigation for this is added by a microcode update. As some of the implications of SBDS are similar to SRBDS, SRBDS mitigation infrastructure can be leveraged by SBDS. Set X86_BUG_SRBDS and use SRBDS mitigation. Mitigation is enabled by default; use srbds=off to opt-out. Mitigation status can be checked from below file: /sys/devices/system/cpu/vulnerabilities/srbds Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 22cac9c677c95f3ac5c9244f8ca0afdc7c8afb19 Author: Pawan Gupta Date: Thu May 19 20:33:13 2022 -0700 x86/speculation/srbds: Update SRBDS mitigation selection Currently, Linux disables SRBDS mitigation on CPUs not affected by MDS and have the TSX feature disabled. On such CPUs, secrets cannot be extracted from CPU fill buffers using MDS or TAA. Without SRBDS mitigation, Processor MMIO Stale Data vulnerabilities can be used to extract RDRAND, RDSEED, and EGETKEY data. Do not disable SRBDS mitigation by default when CPU is also affected by Processor MMIO Stale Data vulnerabilities. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 2a250d4508597c6dd719db4be7af68575e828f7d Author: Dan Carpenter Date: Mon Mar 7 15:56:03 2022 +0300 i2c: qcom-geni: remove unnecessary conditions We know that "ret" is a negative error code at this point so there is no need to check. Signed-off-by: Dan Carpenter Signed-off-by: Wolfram Sang commit 8d50cdf8b8341770bc6367bce40c0c1bb0e1d5b3 Author: Pawan Gupta Date: Thu May 19 20:32:13 2022 -0700 x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data Add the sysfs reporting file for Processor MMIO Stale Data vulnerability. It exposes the vulnerability and mitigation state similar to the existing files for the other hardware vulnerabilities. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 99a83db5a605137424e1efe29dc0573d6a5b6316 Author: Pawan Gupta Date: Thu May 19 20:31:12 2022 -0700 x86/speculation/mmio: Enable CPU Fill buffer clearing on idle When the CPU is affected by Processor MMIO Stale Data vulnerabilities, Fill Buffer Stale Data Propagator (FBSDP) can propagate stale data out of Fill buffer to uncore buffer when CPU goes idle. Stale data can then be exploited with other variants using MMIO operations. Mitigate it by clearing the Fill buffer before entering idle state. Signed-off-by: Pawan Gupta Co-developed-by: Josh Poimboeuf Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov commit e5925fb867290ee924fcf2fe3ca887b792714366 Author: Pawan Gupta Date: Thu May 19 20:30:12 2022 -0700 x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations MDS, TAA and Processor MMIO Stale Data mitigations rely on clearing CPU buffers. Moreover, status of these mitigations affects each other. During boot, it is important to maintain the order in which these mitigations are selected. This is especially true for md_clear_update_mitigation() that needs to be called after MDS, TAA and Processor MMIO Stale Data mitigation selection is done. Introduce md_clear_select_mitigation(), and select all these mitigations from there. This reflects relationships between these mitigations and ensures proper ordering. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 8cb861e9e3c9a55099ad3d08e1a3b653d29c33ca Author: Pawan Gupta Date: Thu May 19 20:29:11 2022 -0700 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data Processor MMIO Stale Data is a class of vulnerabilities that may expose data after an MMIO operation. For details please refer to Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst. These vulnerabilities are broadly categorized as: Device Register Partial Write (DRPW): Some endpoint MMIO registers incorrectly handle writes that are smaller than the register size. Instead of aborting the write or only copying the correct subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than specified by the write transaction may be written to the register. On some processors, this may expose stale data from the fill buffers of the core that created the write transaction. Shared Buffers Data Sampling (SBDS): After propagators may have moved data around the uncore and copied stale data into client core fill buffers, processors affected by MFBDS can leak data from the fill buffer. Shared Buffers Data Read (SBDR): It is similar to Shared Buffer Data Sampling (SBDS) except that the data is directly read into the architectural software-visible state. An attacker can use these vulnerabilities to extract data from CPU fill buffers using MDS and TAA methods. Mitigate it by clearing the CPU fill buffers using the VERW instruction before returning to a user or a guest. On CPUs not affected by MDS and TAA, user application cannot sample data from CPU fill buffers using MDS or TAA. A guest with MMIO access can still use DRPW or SBDR to extract data architecturally. Mitigate it with VERW instruction to clear fill buffers before VMENTER for MMIO capable guests. Add a kernel parameter mmio_stale_data={off|full|full,nosmt} to control the mitigation. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit f52ea6c26953fed339aa4eae717ee5c2133c7ff2 Author: Pawan Gupta Date: Thu May 19 20:28:10 2022 -0700 x86/speculation: Add a common function for MD_CLEAR mitigation update Processor MMIO Stale Data mitigation uses similar mitigation as MDS and TAA. In preparation for adding its mitigation, add a common function to update all mitigations that depend on MD_CLEAR. [ bp: Add a newline in md_clear_update_mitigation() to separate statements better. ] Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 51802186158c74a0304f51ab963e7c2b3a2b046f Author: Pawan Gupta Date: Thu May 19 20:27:08 2022 -0700 x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug Processor MMIO Stale Data is a class of vulnerabilities that may expose data after an MMIO operation. For more details please refer to Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst Add the Processor MMIO Stale Data bug enumeration. A microcode update adds new bits to the MSR IA32_ARCH_CAPABILITIES, define them. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 4419470191386456e0b8ed4eb06a70b0021798a6 Author: Pawan Gupta Date: Thu May 19 20:26:07 2022 -0700 Documentation: Add documentation for Processor MMIO Stale Data Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 550b11395805060f5d61b2a367daf2d14c0d1d08 Author: Yang Yingliang Date: Sat May 14 10:31:48 2022 +0800 i2c: mt7621: Use devm_platform_get_and_ioremap_resource() Use devm_platform_get_and_ioremap_resource() to simplify code. Signed-off-by: Yang Yingliang Reviewed-by: Stefan Roese Signed-off-by: Wolfram Sang commit 5d24df3d690809952528e7a19a43d84bc5b99d44 Author: Miaoqian Lin Date: Wed May 11 15:42:03 2022 +0400 watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() in some error paths. Fixes: bf9006399939 ("watchdog: ts4800: add driver for TS-4800 watchdog") Signed-off-by: Miaoqian Lin Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220511114203.47420-1-linmq006@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9215a90dd56e008999dbaa228c8eb2c7df98a418 Author: Geert Uytterhoeven Date: Mon May 2 15:34:59 2022 +0200 dt-bindings: watchdog: renesas,wdt: R-Car V3U is R-Car Gen4 Despite the name, R-Car V3U is the first member of the R-Car Gen4 family. Hence move its compatible value to the R-Car Gen4 section. Signed-off-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Reviewed-by: Wolfram Sang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/2882a6de3905a57ae62d91060d27521af43c4068.1651497024.git.geert+renesas@glider.be Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d65112f58464fd0ab62b8e4fb6c66cbf29b24b43 Author: Phil Edworthy Date: Wed Apr 27 15:55:31 2022 +0200 watchdog: Add Renesas RZ/N1 Watchdog driver This is a driver for the standard WDT on the RZ/N1 devices. This WDT has very limited timeout capabilities. However, it can reset the device. To do so, the corresponding bits in the SysCtrl RSTEN register need to be enabled. This is not done by this driver. Signed-off-by: Phil Edworthy Signed-off-by: Jean-Jacques Hiblot Reviewed-by: Tzung-Bi Shih Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220427135531.708279-3-jjhiblot@traphandler.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9dc731bbb455eeaff6e90abef7a8d05dfa6ccc9a Author: Jean-Jacques Hiblot Date: Wed Apr 27 15:55:30 2022 +0200 dt-bindings: watchdog: renesas,wdt: Add support for RZ/N1 Describe the WDT hardware in the RZ/N1 series. Signed-off-by: Jean-Jacques Hiblot Reviewed-by: Geert Uytterhoeven Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220427135531.708279-2-jjhiblot@traphandler.com [groeck: Rebased, fixed conflicts] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 330415ebea81b65842e4cc6d2fd985c1b369e650 Author: Liu Xinpeng Date: Tue Apr 26 22:53:30 2022 +0800 watchdog: wdat_wdt: Stop watchdog when uninstalling module Test shows that wachdog still reboots machine after the module is removed. Use watchdog_stop_on_unregister to stop the watchdog on removing. Signed-off-by: Liu Xinpeng eviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1650984810-6247-4-git-send-email-liuxp11@chinatelecom.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 27fdf84510a1374748904db43f6755f912736d92 Author: Liu Xinpeng Date: Tue Apr 26 22:53:29 2022 +0800 watchdog: wdat_wdt: Stop watchdog when rebooting the system Executing reboot command several times on the machine "Dell PowerEdge R740", UEFI security detection stopped machine with the following prompt: UEFI0082: The system was reset due to a timeout from the watchdog timer. Check the System Event Log (SEL) or crash dumps from Operating Sysstem to identify the source that triggered the watchdog timer reset. Update the firmware or driver for the identified device. iDRAC has warning event: "The watchdog timer reset the system". This patch fixes this issue by adding the reboot notifier. Signed-off-by: Liu Xinpeng Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6d72c7ac9fbe26a77800676507da980436b40b2f Author: Liu Xinpeng Date: Tue Apr 26 22:53:28 2022 +0800 watchdog: wdat_wdt: Using the existing function to check parameter timeout If max_hw_heartbeat_ms is provided, the configured maximum timeout is not limited by it. The limit check in this driver therefore doesn't make much sense. Similar, the watchdog core ensures that minimum timeout limits are met if min_hw_heartbeat_ms is set. Using watchdog_timeout_invalid() makes more sense because it takes this into account. Signed-off-by: Liu Xinpeng Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1650984810-6247-2-git-send-email-liuxp11@chinatelecom.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 382256b219fbc901a69481e5b60812556f53152e Author: Andrej Picej Date: Mon Dec 6 07:47:31 2021 +0100 dt-bindings: watchdog: da9062: add watchdog timeout mode Document the watchdog timeout mode property. If this property is used the user can select what happens on watchdog timeout. Set this property to 1 to enable SHUTDOWN (the device resets), set it to 0 and the device will go to POWERDOWN on watchdog timeout. If this property is not set, don't touch the WATCHDOG_SD bit and leave the configuration to OTP. This way backward compatibility is not broken. Signed-off-by: Andrej Picej Reviewed-by: Adam Thomson Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20211206064732.280375-4-andrej.picej@norik.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit af84a5a75344871c44ddbf4ab901c3427909f893 Author: Biju Das Date: Sun Apr 24 08:13:23 2022 +0100 dt-bindings: watchdog: renesas,wdt: Document RZ/G2UL SoC Document RZ/G2UL WDT bindings. RZ/G2UL WDT is similar to one found on the RZ/G2L SoC. No driver changes are required as generic compatible string "renesas,rzg2l-wdt" will be used as a fallback. Signed-off-by: Biju Das Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220424071323.151757-1-biju.das.jz@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9ef958929fc288a85146d18368f4d2aaac80cdbc Author: Liu Xinpeng Date: Tue Apr 26 18:11:45 2022 +0800 watchdog: iTCO_wdt: Using existing macro define covers more scenarios For power management, SET_NOIRQ_SYSTEM_SLEEP_PM_OPS defined for CONFIG_PM_SLEEP, will point ->suspend_noirq, ->freeze_noirq and ->poweroff_noirq to the same function. Vice versa happens for ->resume_noirq, ->thaw_noirq and ->restore_noirq. Signed-off-by: Liu Xinpeng Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1650967905-3199-1-git-send-email-liuxp11@chinatelecom.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b3ac0c58fa8934926360268f3d89ec7680644d7b Author: Miaoqian Lin Date: Tue Apr 12 07:08:23 2022 +0000 watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking If the device is already in a runtime PM enabled state pm_runtime_get_sync() will return 1, so a test for negative value should be used to check for errors. Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support") Signed-off-by: Miaoqian Lin Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220412070824.23708-1-linmq006@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 26d14b9fc341893e862f17ab7db4543d5a530327 Author: Bjorn Andersson Date: Fri Apr 8 14:28:54 2022 -0700 dt-bindings: watchdog: Add SC8180X and SC8280XP compatibles Add compatibles for the SC8180X and SC8280XP platforms to the Qualcomm watchdog binding. Signed-off-by: Bjorn Andersson Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220408212854.581481-1-bjorn.andersson@linaro.org [groeck: Rebased and resolved conflicts] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c83f643878388d468e0a674ac9502d4080499646 Author: Jan Kiszka Date: Mon Feb 21 17:22:38 2022 +0100 watchdog: rti_wdt: Fix calculation and evaluation of preset heartbeat This ensures that the same value is read back as was eventually programmed when using seconds as accuracy. Even then, comparing the more precise heartbeat_ms against heartbeat in seconds will almost never provide a match and will needlessly raise a warning. Fix by comparing apples to apples. Tested in combination with U-Boot as watchdog starter. Signed-off-by: Jan Kiszka Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/6a4b54ac-9588-e172-c4c7-b91d524a851e@siemens.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 95d0eee9718a21ed35fb80a68d3a71759b136f77 Author: Kunihiko Hayashi Date: Thu Apr 7 16:46:46 2022 +0900 dt-bindings: watchdog: uniphier: Use unevaluatedProperties This refers common bindings, so this is preferred for unevaluatedProperties instead of additionalProperties. Signed-off-by: Kunihiko Hayashi Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1649317606-21267-1-git-send-email-hayashi.kunihiko@socionext.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ac97c9374d3cdfa42611a32a653ac75db423cac4 Author: Eliav Farber Date: Thu Apr 14 05:42:33 2022 +0000 watchdog: sp805: disable watchdog on remove Disable the watchdog if it is active while removing the module. It is necessary in order to prevent a reset in case watchdog hw was running before the removal. Signed-off-by: Eliav Farber Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220414054233.1357-2-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Author: Primoz Fiser Date: Fri Apr 22 09:27:12 2022 +0200 watchdog: da9063: optionally disable watchdog during suspend Optionally disable watchdog during suspend (if enabled) and re-enable it upon resume. This enables boards to sleep without being interrupted by the watchdog. This patch is based on commit f6c98b08381c ("watchdog: da9062: add power management ops") and commit 8541673d2a5f ("watchdog: da9062: fix power management ops") and brings the same functionality to DA9063. Signed-off-by: Primoz Fiser Reviewed-by: Adam Thomson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220422072713.3172345-2-primoz.fiser@norik.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b1912875a548cf32eebc77eec85034052909bba8 Author: Primoz Fiser Date: Fri Apr 22 09:27:11 2022 +0200 dt-bindings: mfd: da9063: watchdog: add suspend disable option Document the watchdog disable option which can be used if the hardware automatic suspend option is broken. Based on commit c514430c51ee8 ("dt-bindings: watchdog: da9062: add suspend disable option"). Signed-off-by: Primoz Fiser Reviewed-by: Rob Herring Reviewed-by: Adam Thomson Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220422072713.3172345-1-primoz.fiser@norik.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7b0efea4baf02f5e2f89e5f9b75ef891571b45f1 Author: Takashi Iwai Date: Sat May 21 08:53:25 2022 +0200 ALSA: usb-audio: Add missing ep_idx in fixed EP quirks The quirk entry for Focusrite Saffire 6 had no proper ep_idx for the capture endpoint, and this confused the driver, resulting in the broken sound. This patch adds the missing ep_idx in the entry. While we are at it, a couple of other entries (for Digidesign MBox and MOTU MicroBook II) seem to have the same problem, and those are covered as well. Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") Reported-by: André Kapelrud Cc: Link: https://lore.kernel.org/r/20220521065325.426-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5ce0b06ae5e69e23142e73c5c3c0260e9f2ccb4b Author: Takashi Iwai Date: Sat May 21 08:46:27 2022 +0200 ALSA: usb-audio: Workaround for clock setup on TEAC devices Maris reported that TEAC UD-501 (0644:8043) doesn't work with the typical "clock source 41 is not valid, cannot use" errors on the recent kernels. The currently known workaround so far is to restore (partially) what we've done unconditionally at the clock setup; namely, re-setup the USB interface immediately after the clock is changed. This patch re-introduces the behavior conditionally for TEAC devices. Further notes: - The USB interface shall be set later in snd_usb_endpoint_configure(), but this seems to be too late. - Even calling usb_set_interface() right after sne_usb_init_sample_rate() doesn't help; so this must be related with the clock validation, too. - The device may still spew the "clock source 41 is not valid" error at the first clock setup. This seems happening at the very first try of clock setup, but it disappears at later attempts. The error is likely harmless because the driver retries the clock setup (such an error is more or less expected on some devices). Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") Reported-and-tested-by: Maris Abele Cc: Link: https://lore.kernel.org/r/20220521064627.29292-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 12626530de84d2b00ff6480142f7f4374662c0c3 Author: Kees Cook Date: Fri May 20 09:55:37 2022 -0700 ALSA: lola: Bounds check loop iterator against streams array size GCC 12 sees that it's technically possible for num_streams to be larger than ARRAY_SIZE(pcm->streams). Bounds-check the iterator. ../sound/pci/lola/lola_pcm.c: In function 'lola_pcm_update': ../sound/pci/lola/lola_pcm.c:567:64: warning: array subscript [0, 31] is outside array bounds of 'struct lola_stream[16]' [-Warray-bounds] 567 | struct lola_stream *str = &pcm->streams[i]; | ~~~~~~~~~~~~^~~ In file included from ../sound/pci/lola/lola_pcm.c:15: ../sound/pci/lola/lola.h:307:28: note: while referencing 'streams' 307 | struct lola_stream streams[MAX_STREAM_COUNT]; | ^~~~~~~ Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220520165537.2139826-1-keescook@chromium.org Signed-off-by: Takashi Iwai commit 15ad333269a390b25e61677f18c8461850defcde Merge: 5c62383c06837 353bb6a5f2ac4 Author: Takashi Iwai Date: Sat May 21 08:47:40 2022 +0200 Merge tag 'asoc-fix-v5.18-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for v5.17 This is rather late and at this point I'm expecting it to get merged in the merge window rather than as a fix but if we get a -rc8 it's a small, driver specific fix which should be fine to send. commit 238904dd646c60017d75144760510454062bcc8a Author: Wolfram Sang Date: Fri May 20 12:33:25 2022 +0200 i2c: rcar: refactor handling of first message After moving ICMSR handling to interrupt handlers previously to fix a race condition, we can now also move ICMSR handling for the first message out of the function to prepare a message. By introducing a seperate function to initialize the first message, we can not only remove some code duplication but the remaining code is also easier to follow. The function to prepare a message is much simpler without ICMSR handling. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit a0fb48c9bd7e99c1cad6a5d592c0686fbe0d1803 Author: Wolfram Sang Date: Fri May 20 12:33:24 2022 +0200 i2c: rcar: avoid race condition with SMIs A customer experienced a race condition with 'repeated starts' when a System Management Interrupt took over for 30us and more. The problem was that during the SMI a new MAT interrupt came in because we set up the 'repeated start' condition. But the old one was not acknowledged yet. So, when it was acknowledged after the SMI, the new MAT interrupt was lost, confusing the state machine of the driver. The fix consists of two parts. First, we do not clear the status register for 'repeated starts' when preparing the next message anymore. The interrupt handlers for sending and receiving data is now solely responsible for that and it makes the code easier to follow, in fact. Secondly, clearing the status register is now split up to handle MAT interrupts independently. This avoids the race condition because the old MAT interrupt will be now cleared before we initiate the "repeated start" condition. Reported-by: Yoshihiro Shimoda Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 3c9fedf9903108430d36c20ed640069eef032f68 Author: Shubhrajyoti Datta Date: Tue May 17 11:04:52 2022 +0530 i2c: xiic: Correct the datatype for rx_watermark The message length data type should be u16 as per the i2c_msg structure. Signed-off-by: Shubhrajyoti Datta Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit 3fe2ec59db1a7569e18594b9c0cf1f4f1afd498e Author: Kuninori Morimoto Date: Fri May 20 11:54:21 2022 +0200 i2c: rcar: fix PM ref counts in probe error paths We have to take care of ID_P_PM_BLOCKED when bailing out during probe. Fixes: 7ee24eb508d6 ("i2c: rcar: disable PM in multi-master mode") Signed-off-by: Kuninori Morimoto Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit e5222d408de2a88e6b206c38217b48d092184553 Author: Tali Perry Date: Tue May 17 18:11:39 2022 +0800 i2c: npcm: Handle spurious interrupts On some platforms in rare cases (1 to 100,000 transactions), the i2c gets a spurious interrupt which means that we enter an interrupt but in the interrupt handler we don't find any status bit that points to the reason we got this interrupt. This may be a case of a rare HW issue or signal integrity issue that is still under investigation. In order to overcome this we are doing the following: 1. Disable incoming interrupts in master mode only when slave mode is not enabled. 2. Clear end of busy (EOB) after every interrupt. 3. Clear other status bits (just in case since we found them cleared) 4. Return correct status during the interrupt that will finish the transaction. On next xmit transaction if the bus is still busy the master will issue a recovery process before issuing the new transaction. Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver") Signed-off-by: Tali Perry Signed-off-by: Tyrone Ting Signed-off-by: Wolfram Sang commit ea9f8426d17620214ee345ffb77ee6cc196ff14f Author: Tyrone Ting Date: Tue May 17 18:11:38 2022 +0800 i2c: npcm: Correct register access width The SMBnCTL3 register is 8-bit wide and the 32-bit access was always incorrect, but simply didn't cause a visible error on the 32-bit machine. On the 64-bit machine, the kernel message reports that ESR value is 0x96000021. Checking Arm Architecture Reference Manual Armv8 suggests that it's the alignment fault. SMBnCTL3's address is 0xE. Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver") Signed-off-by: Tyrone Ting Reviewed-by: Jonathan Neuschäfer Signed-off-by: Wolfram Sang commit 0bf58eb12f05e2f2ae693977206fef868d9c5dce Author: Tali Perry Date: Tue May 17 18:11:37 2022 +0800 i2c: npcm: Add tx complete counter tx_complete counter is used to indicate successful transaction count. Similar counters for failed tx were previously added. Signed-off-by: Tali Perry Signed-off-by: Tyrone Ting Signed-off-by: Wolfram Sang commit 288b204492fddf28889cea6dc95a23976632c7a0 Author: Tali Perry Date: Tue May 17 18:11:36 2022 +0800 i2c: npcm: Fix timeout calculation Use adap.timeout for timeout calculation instead of hard-coded value of 35ms. Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver") Signed-off-by: Tali Perry Signed-off-by: Tyrone Ting Signed-off-by: Wolfram Sang commit 94acda59adb91ce6bbd500be5bcb240e4f3bea27 Author: Tali Perry Date: Tue May 17 18:11:35 2022 +0800 i2c: npcm: Remove unused variable clk_regmap Remove unused variable clk_regmap. Signed-off-by: Tali Perry Signed-off-by: Tyrone Ting Reviewed-by: Jonathan Neuschäfer Signed-off-by: Wolfram Sang commit 0585c1d20fc382bab6f1b50919d637d200e4701b Author: Tali Perry Date: Tue May 17 18:11:34 2022 +0800 i2c: npcm: Change the way of getting GCR regmap Change the way of getting NPCM system manager reigster (GCR) and still maintain the old mechanism as a fallback if getting nuvoton,sys-mgr fails while working with the legacy devicetree file. Signed-off-by: Tali Perry Signed-off-by: Tyrone Ting Acked-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit b7fa6242f3e035308a76284560e4f918dad9b017 Author: Christophe JAILLET Date: Fri May 20 23:20:58 2022 +0200 clk: bcm: rpi: Use correct order for the parameters of devm_kcalloc() We should have 'n', then 'size', not the opposite. This is harmless because the 2 values are just multiplied, but having the correct order silence a (unpublished yet) smatch warning. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/49d726d11964ca0e3757bdb5659e3b3eaa1572b5.1653081643.git.christophe.jaillet@wanadoo.fr Signed-off-by: Stephen Boyd commit 83ce0357dcb7fc7270fcb2c5cfea420085b8770e Author: Gabriel Fernandez Date: Mon May 16 09:05:57 2022 +0200 clk: stm32mp13: add safe mux management Some muxes need to set a the safe position when clock is off. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-12-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit ffa2d04d859e99d69d0c89d3dc50067022544354 Author: Gabriel Fernandez Date: Mon May 16 09:05:56 2022 +0200 clk: stm32mp13: add multi mux function Some RCC muxes can manages two output clocks with same register. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-11-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit bfad377983565358c8259e48693331b327535335 Author: Gabriel Fernandez Date: Mon May 16 09:05:55 2022 +0200 clk: stm32mp13: add all STM32MP13 kernel clocks Complete all kernel clocks of stm32mp13. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-10-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit ae0da9a6db8a85f6eed811b2e54df5057df8b343 Author: Gabriel Fernandez Date: Mon May 16 09:05:54 2022 +0200 clk: stm32mp13: add all STM32MP13 peripheral clocks All peripheral clocks are mainly based on stm32_gate clock. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-9-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 93e336c2d6d11c37c22823c7219866e06fd0276b Author: Gabriel Fernandez Date: Mon May 16 09:05:53 2022 +0200 clk: stm32mp13: manage secured clocks Don't register a clock if this clock is secured. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-8-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 5f0d47213f52c0623b3ce662c924575b2ba718ae Author: Gabriel Fernandez Date: Mon May 16 09:05:52 2022 +0200 clk: stm32mp13: add composite clock Just to introduce management of stm32 composite clock. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-7-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 720e34ab3e57e19dba70c384e30494f047999c43 Author: Gabriel Fernandez Date: Mon May 16 09:05:51 2022 +0200 clk: stm32mp13: add stm32 divider clock Just to introduce management of a stm32 divider clock Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-6-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 95f5e0a4c5fc654c9fdfe044e4c692bfead01352 Author: Gabriel Fernandez Date: Mon May 16 09:05:50 2022 +0200 clk: stm32mp13: add stm32_gate management Just to introduce management of a stm32 gate clock. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-5-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit f95cea8308de5ef4075ae4f1f8a72ec275b0d5b5 Author: Gabriel Fernandez Date: Mon May 16 09:05:49 2022 +0200 clk: stm32mp13: add stm32_mux clock management Just to introduce management of a stm32 mux clock. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-4-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 637cee5ffc71698eecf014a794e8d24a213b3c07 Author: Gabriel Fernandez Date: Mon May 16 09:05:48 2022 +0200 clk: stm32: Introduce STM32MP13 RCC drivers (Reset Clock Controller) This driver manages Reset and Clock of STM32MP13 soc. It uses a clk-stm32-core module to manage stm32 gate, mux and divider for STM32MP13 and for new future soc. All gates, muxes, dividers are identify by an index and information are stored in array (register address, shift, with, flags...) This is useful when we have two clocks with the same gate or when one mux manages two output clocks. Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-3-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 722dc8a1d5c8691ab9923b723db4354537206f97 Author: Gabriel Fernandez Date: Mon May 16 09:05:47 2022 +0200 dt-bindings: rcc: stm32: add new compatible for STM32MP13 SoC New compatible to manage clock and reset of STM32MP13 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Gabriel Fernandez Link: https://lore.kernel.org/r/20220516070600.7692-2-gabriel.fernandez@foss.st.com Signed-off-by: Stephen Boyd commit 560a3164c9a3ad0f9c71660f548171e04d89c7fa Author: Jakob Koschel Date: Thu Mar 24 08:10:19 2022 +0100 clk: ti: clkctrl: replace usage of found with dedicated list iterator variable To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Signed-off-by: Jakob Koschel Link: https://lore.kernel.org/r/20220324071019.59483-1-jakobkoschel@gmail.com Tested-by: Tony Lindgren Reviewed-by: Tony Lindgren Signed-off-by: Stephen Boyd commit 37004db2a560d7f0641bc81f0d405b8b9849e797 Author: Len Baker Date: Sat Sep 4 15:17:14 2021 +0200 clk: ti: composite: Prefer kcalloc over open coded arithmetic As noted in the "Deprecated Interfaces, Language Features, Attributes, and Conventions" documentation [1], size calculations (especially multiplication) should not be performed in memory allocator (or similar) function arguments due to the risk of them overflowing. This could lead to values wrapping around and a smaller allocation being made than the caller was expecting. Using those allocations could lead to linear overflows of heap memory and other misbehaviors. So, use the purpose specific kcalloc() function instead of the argument size * count in the kzalloc() function. [1] https://www.kernel.org/doc/html/v5.14/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Signed-off-by: Len Baker Link: https://lore.kernel.org/r/20210904131714.2312-1-len.baker@gmx.com Signed-off-by: Stephen Boyd commit 538101dd7ce360f29effeb45aecb1953bc0fd01b Author: Chanho Park Date: Fri May 20 12:06:25 2022 +0900 dt-bindings: clock: exynosautov9: correct count of NR_CLK _NR_CLKS which can be used to register clocks via nr_clk_ids. The clock IDs are started from 1. So, _NR_CLKS should be defined to "the last clock id + 1" Fixes: 680e1c8370a2 ("dt-bindings: clock: add clock binding definitions for Exynos Auto v9") Signed-off-by: Chanho Park Link: https://lore.kernel.org/r/20220520030625.145324-1-chanho61.park@samsung.com Reviewed-by: Chanwoo Choi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit c272e259116973b4c2d5c5ae7b6a4181aeeb38c7 Merge: 979497674e636 90a039fd19fc3 Author: Alexei Starovoitov Date: Fri May 20 19:48:29 2022 -0700 Merge branch 'bpf: refine kernel.unprivileged_bpf_disabled behaviour' Alan Maguire says: ==================== Unprivileged BPF disabled (kernel.unprivileged_bpf_disabled >= 1) is the default in most cases now; when set, the BPF system call is blocked for users without CAP_BPF/CAP_SYS_ADMIN. In some cases however, it makes sense to split activities between capability-requiring ones - such as program load/attach - and those that might not require capabilities such as reading perf/ringbuf events, reading or updating BPF map configuration etc. One example of this sort of approach is a service that loads a BPF program, and a user-space program that interacts with it. Here - rather than blocking all BPF syscall commands - unprivileged BPF disabled blocks the key object-creating commands (prog load, map load). Discussion has alluded to this idea in the past [1], and Alexei mentioned it was also discussed at LSF/MM/BPF this year. Changes since v3 [2]: - added acks to patch 1 - CI was failing on Ubuntu; I suspect the issue was an old capability.h file which specified CAP_LAST_CAP as < CAP_BPF, leading to the logic disabling all caps not disabling CAP_BPF. Use CAP_BPF as basis for "all caps" bitmap instead as we explicitly define it in cap_helpers.h if not already found in capabilities.h - made global variables arguments to subtests instead (Andrii, patch 2) Changes since v2 [3]: - added acks from Yonghong - clang compilation issue in selftest with bpf_prog_query() (Alexei, patch 2) - disable all capabilities for test (Yonghong, patch 2) - add assertions that size of perf/ringbuf data matches expectations (Yonghong, patch 2) - add map array size definition, remove unneeded whitespace (Yonghong, patch 2) Changes since RFC [4]: - widened scope of commands unprivileged BPF disabled allows (Alexei, patch 1) - removed restrictions on map types for lookup, update, delete (Alexei, patch 1) - removed kernel CONFIG parameter controlling unprivileged bpf disabled change (Alexei, patch 1) - widened test scope to cover most BPF syscall commands, with positive and negative subtests [1] https://lore.kernel.org/bpf/CAADnVQLTBhCTAx1a_nev7CgMZxv1Bb7ecz1AFRin8tHmjPREJA@mail.gmail.com/ [2] https://lore.kernel.org/bpf/1652880861-27373-1-git-send-email-alan.maguire@oracle.com/T/ [3] https://lore.kernel.org/bpf/1652788780-25520-1-git-send-email-alan.maguire@oracle.com/T/#t [4] https://lore.kernel.org/bpf/20220511163604.5kuczj6jx3ec5qv6@MBP-98dd607d3435.dhcp.thefacebook.com/T/#mae65f35a193279e718f37686da636094d69b96ee ==================== Signed-off-by: Alexei Starovoitov commit 90a039fd19fc35d03a74ce2973992c878546cb20 Author: Alan Maguire Date: Thu May 19 15:25:34 2022 +0100 selftests/bpf: add tests verifying unprivileged bpf behaviour tests load/attach bpf prog with maps, perfbuf and ringbuf, pinning them. Then effective caps are dropped and we verify we can - pick up the pin - create ringbuf/perfbuf - get ringbuf/perfbuf events, carry out map update, lookup and delete - create a link Negative testing also ensures - BPF prog load fails - BPF map create fails - get fd by id fails - get next id fails - query fails - BTF load fails Signed-off-by: Alan Maguire Acked-by: Yonghong Song Link: https://lore.kernel.org/r/1652970334-30510-3-git-send-email-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit c8644cd0efe719608ddcb341bcf087d4bc0bf6b8 Author: Alan Maguire Date: Thu May 19 15:25:33 2022 +0100 bpf: refine kernel.unprivileged_bpf_disabled behaviour With unprivileged BPF disabled, all cmds associated with the BPF syscall are blocked to users without CAP_BPF/CAP_SYS_ADMIN. However there are use cases where we may wish to allow interactions with BPF programs without being able to load and attach them. So for example, a process with required capabilities loads/attaches a BPF program, and a process with less capabilities interacts with it; retrieving perf/ring buffer events, modifying map-specified config etc. With all BPF syscall commands blocked as a result of unprivileged BPF being disabled, this mode of interaction becomes impossible for processes without CAP_BPF. As Alexei notes "The bpf ACL model is the same as traditional file's ACL. The creds and ACLs are checked at open(). Then during file's write/read additional checks might be performed. BPF has such functionality already. Different map_creates have capability checks while map_lookup has: map_get_sys_perms(map, f) & FMODE_CAN_READ. In other words it's enough to gate FD-receiving parts of bpf with unprivileged_bpf_disabled sysctl. The rest is handled by availability of FD and access to files in bpffs." So key fd creation syscall commands BPF_PROG_LOAD and BPF_MAP_CREATE are blocked with unprivileged BPF disabled and no CAP_BPF. And as Alexei notes, map creation with unprivileged BPF disabled off blocks creation of maps aside from array, hash and ringbuf maps. Programs responsible for loading and attaching the BPF program can still control access to its pinned representation by restricting permissions on the pin path, as with normal files. Signed-off-by: Alan Maguire Acked-by: Yonghong Song Acked-by: Shung-Hsi Yu Acked-by: KP Singh Link: https://lore.kernel.org/r/1652970334-30510-2-git-send-email-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit 979497674e63666a99fd7d242dba53a5ca5d628b Author: Benjamin Tissoires Date: Wed May 18 22:59:08 2022 +0200 bpf: Allow kfunc in tracing and syscall programs. Tracing and syscall BPF program types are very convenient to add BPF capabilities to subsystem otherwise not BPF capable. When we add kfuncs capabilities to those program types, we can add BPF features to subsystems without having to touch BPF core. Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20220518205924.399291-2-benjamin.tissoires@redhat.com Signed-off-by: Alexei Starovoitov commit aa5334b1f96801cd09775217a72ff252ef614d7a Merge: eac67d83bf255 538aaf9b23837 Author: Jakub Kicinski Date: Fri May 20 18:16:31 2022 -0700 Merge branch 'add-a-bhash2-table-hashed-by-port-address' Joanne Koong says: ==================== Add a bhash2 table hashed by port + address This patchset proposes adding a bhash2 table that hashes by port and address. The motivation behind bhash2 is to expedite bind requests in situations where the port has many sockets in its bhash table entry, which makes checking bind conflicts costly especially given that we acquire the table entry spinlock while doing so, which can cause softirq cpu lockups and can prevent new tcp connections. We ran into this problem at Meta where the traffic team binds a large number of IPs to port 443 and the bind() call took a significant amount of time which led to cpu softirq lockups, which caused packet drops and other failures on the machine The patches are as follows: 1/2 - Adds a second bhash table (bhash2) hashed by port and address 2/2 - Adds a test for timing how long an additional bind request takes when the bhash entry is populated When experimentally testing this on a local server for ~24k sockets bound to the port, the results seen were: ipv4: before - 0.002317 seconds with bhash2 - 0.000018 seconds ipv6: before - 0.002431 seconds with bhash2 - 0.000021 seconds ==================== Link: https://lore.kernel.org/r/20220520001834.2247810-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 538aaf9b2383701094a47797b4554c6a21c83eed Author: Joanne Koong Date: Thu May 19 17:18:34 2022 -0700 selftests: Add test for timing a bind request to a port with a populated bhash entry This test populates the bhash table for a given port with MAX_THREADS * MAX_CONNECTIONS sockets, and then times how long a bind request on the port takes. When populating the bhash table, we create the sockets and then bind the sockets to the same address and port (SO_REUSEADDR and SO_REUSEPORT are set). When timing how long a bind on the port takes, we bind on a different address without SO_REUSEPORT set. We do not set SO_REUSEPORT because we are interested in the case where the bind request does not go through the tb->fastreuseport path, which is fragile (eg tb->fastreuseport path does not work if binding with a different uid). To run the test locally, I did: * ulimit -n 65535000 * ip addr add 2001:0db8:0:f101::1 dev eth0 * ./bind_bhash_test 443 Signed-off-by: Joanne Koong Signed-off-by: Jakub Kicinski commit d5a42de8bdbe25081f07b801d8b35f4d75a791f4 Author: Joanne Koong Date: Thu May 19 17:18:33 2022 -0700 net: Add a second bind table hashed by port and address We currently have one tcp bind table (bhash) which hashes by port number only. In the socket bind path, we check for bind conflicts by traversing the specified port's inet_bind2_bucket while holding the bucket's spinlock (see inet_csk_get_port() and inet_csk_bind_conflict()). In instances where there are tons of sockets hashed to the same port at different addresses, checking for a bind conflict is time-intensive and can cause softirq cpu lockups, as well as stops new tcp connections since __inet_inherit_port() also contests for the spinlock. This patch proposes adding a second bind table, bhash2, that hashes by port and ip address. Searching the bhash2 table leads to significantly faster conflict resolution and less time holding the spinlock. Signed-off-by: Joanne Koong Reviewed-by: Eric Dumazet Acked-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski commit eac67d83bf2553f98cfddd42cfbcfd6f9ccfc287 Author: Jakub Kicinski Date: Thu May 19 23:00:13 2022 -0700 wwan: iosm: use a flexible array rather than allocate short objects GCC array-bounds warns that ipc_coredump_get_list() under-allocates the size of struct iosm_cd_table *cd_table. This is avoidable - we just need a flexible array. Nothing calls sizeof() on struct iosm_cd_list or anything that contains it. Reviewed-by: M Chetan Kumar Link: https://lore.kernel.org/r/20220520060013.2309497-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit eb4c0788964730d12e8dd520bd8f5217ca48321c Author: Yongzhi Liu Date: Thu May 19 05:09:48 2022 -0700 hv_netvsc: Fix potential dereference of NULL pointer The return value of netvsc_devinfo_get() needs to be checked to avoid use of NULL pointer in case of an allocation failure. Fixes: 0efeea5fb153 ("hv_netvsc: Add the support of hibernation") Signed-off-by: Yongzhi Liu Reviewed-by: Haiyang Zhang Link: https://lore.kernel.org/r/1652962188-129281-1-git-send-email-lyz_cs@pku.edu.cn Signed-off-by: Jakub Kicinski commit 29849a486a85f7ab1f3b389db5e3d4948119bef2 Author: Xiu Jianfeng Date: Thu May 19 14:29:32 2022 +0800 stcp: Use memset_after() to zero sctp_stream_out_ext Use memset_after() helper to simplify the code, there is no functional change in this patch. Signed-off-by: Xiu Jianfeng Link: https://lore.kernel.org/r/20220519062932.249926-1-xiujianfeng@huawei.com Signed-off-by: Jakub Kicinski commit f7b5a89c66defe87d11240cfdaa8b6cbee5784eb Author: Alaa Mohamed Date: Fri May 20 02:20:40 2022 +0200 net: mscc: fix the alignment in ocelot_port_fdb_del() align the extack argument of the ocelot_port_fdb_del() function. Signed-off-by: Alaa Mohamed Link: https://lore.kernel.org/r/20220520002040.4442-1-eng.alaamohamedsoliman.am@gmail.com Signed-off-by: Jakub Kicinski commit c2e10f53455c898050738d6a5f8c237f27aec225 Author: Alaa Mohamed Date: Fri May 20 02:36:14 2022 +0200 net: vxlan: Fix kernel coding style The continuation line does not align with the opening bracket and this patch fix it. Signed-off-by: Alaa Mohamed Link: https://lore.kernel.org/r/20220520003614.6073-1-eng.alaamohamedsoliman.am@gmail.com Signed-off-by: Jakub Kicinski commit dbb2f362c7835660a4e39eadd7481563e2e176b7 Author: Jakub Kicinski Date: Thu May 19 23:19:55 2022 -0700 eth: bnxt: make ulp_id unsigned to make GCC 12 happy GCC array bounds checking complains that ulp_id is validated only against upper bound. Make it unsigned. Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20220520061955.2312968-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5feba47273952918e6563d692d9c5ce35a2165b3 Author: Amit Cohen Date: Thu May 19 10:09:21 2022 +0300 selftests: fib_nexthops: Make ping timeout configurable Commit 49bb39bddad2 ("selftests: fib_nexthops: Make the test more robust") increased the timeout of ping commands to 5 seconds, to make the test more robust. Make the timeout configurable using '-w' argument to allow user to change it depending on the system that runs the test. Some systems suffer from slow forwarding performance, so they may need to change the timeout. Signed-off-by: Amit Cohen Reviewed-by: Shuah Khan Link: https://lore.kernel.org/r/20220519070921.3559701-1-amcohen@nvidia.com Signed-off-by: Jakub Kicinski commit 9ee152ee3ee3568b1a3302f2bb816d5440e6f5f1 Author: Yang Yingliang Date: Thu May 19 11:21:08 2022 +0800 net: wwan: t7xx: use GFP_ATOMIC under spin lock in t7xx_cldma_gpd_set_next_ptr() Sometimes t7xx_cldma_gpd_set_next_ptr() is called under spin lock, so add 'gfp_mask' parameter in t7xx_cldma_gpd_set_next_ptr() to pass the flag. Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Loic Poulain Link: https://lore.kernel.org/r/20220519032108.2996400-1-yangyingliang@huawei.com Signed-off-by: Jakub Kicinski commit ed46b3e1272d6e5c79c8333a60115003035cfbd4 Merge: fe5c5fc145edc fe29794c3585d Author: Jakub Kicinski Date: Fri May 20 17:16:09 2022 -0700 Merge branch 'amt-fix-several-bugs-in-gateway-mode' Taehee Yoo says: ==================== amt: fix several bugs in gateway mode This patchset fixes bugs in amt module. First patch fixes amt gateway mode's status stuck. amt gateway and relay established so these two mode manage status. But gateway stuck to change its own status if a relay doesn't send responses. Second patch fixes a memory leak. amt gateway skips some handling of advertisement message. So, a memory leak would occur. ==================== Link: https://lore.kernel.org/r/20220519031555.3192-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit dc2df00af951569689ec39ce0a41b1dff7e3595e Author: Rolf Eike Beer Date: Fri May 20 15:28:21 2022 +0200 net: tulip: fix build with CONFIG_GSC Fix typo which breaks build for parisc. Fixes: 3daebfbeb455 ("net: tulip: convert to devres") Reported-by: Linux Kernel Functional Testing Link: https://lore.kernel.org/all/CA+G9fYuCzU5VZ_nc+6NEdBXJdVCH=J2SB1Na1G_NS_0BNdGYtg@mail.gmail.com/ Reported-by: kernel test robot Signed-off-by: Rolf Eike Beer Link: https://lore.kernel.org/r/4719560.GXAFRqVoOG@eto.sf-tec.de Signed-off-by: Jakub Kicinski commit fe29794c3585d039fefebaa2b5a4932a627ad4fd Author: Taehee Yoo Date: Thu May 19 03:15:55 2022 +0000 amt: fix memory leak for advertisement message When a gateway receives an advertisement message, it extracts relay information and then it should be freed. But the advertisement handler doesn't free it. So, memory leak would occur. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 937956ba404e70a765ca5aa39d3d7564d86a8872 Author: Taehee Yoo Date: Thu May 19 03:15:54 2022 +0000 amt: fix gateway mode stuck If a gateway can not receive any response to requests from a relay, gateway resets status from SENT_REQUEST to INIT and variable about a relay as well. And then it should start the full establish step from sending a discovery message and receiving advertisement message. But, after failure in amt_req_work() it continues sending a request message step with flushed(invalid) relay information and sets SENT_REQUEST. So, a gateway can't be established with a relay. In order to avoid this situation, it stops sending the request message step if it fails. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit c09b0cd2cc6c3f91988a20d45fa45c889f72c56c Author: Jakub Kicinski Date: Wed May 18 11:55:22 2022 -0700 net: avoid strange behavior with skb_defer_max == 1 When user sets skb_defer_max to 1 the kick threshold is 0 (half of 1). If we increment queue length before the check the kick will never happen, and the skb may get stranded. This is likely harmless but can be avoided by moving the increment after the check. This way skb_defer_max == 1 will always kick. Still a silly config to have, but somehow that feels more correct. While at it drop a comment which seems to be outdated or confusing, and wrap the defer_count write with a WRITE_ONCE() since it's read on the fast path that avoids taking the lock. Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220518185522.2038683-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fe5c5fc145edcf98a759b895f52b646730eeb7be Author: Jakub Kicinski Date: Wed May 18 17:43:05 2022 -0700 net: stmmac: fix out-of-bounds access in a selftest GCC 12 points out that struct tc_action is smaller than struct tcf_action: drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c: In function ‘stmmac_test_rxp’: drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1132:21: warning: array subscript ‘struct tcf_gact[0]’ is partly outside array bounds of ‘unsigned char[272]’ [-Warray-bounds] 1132 | gact->tcf_action = TC_ACT_SHOT; | ^~ Fixes: ccfc639a94f2 ("net: stmmac: selftests: Add a selftest for Flexible RX Parser") Link: https://lore.kernel.org/r/20220519004305.2109708-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cc398a34d16fd90a2dcc59b1105c634f038ea53b Author: Martin Habets Date: Thu May 19 08:17:15 2022 +0100 sfc/siena: Remove duplicate check on segments Siena only supports software TSO. This means more code can be deleted, as pointed out by the Smatch static checker warning: drivers/net/ethernet/sfc/siena/tx.c:184 __efx_siena_enqueue_skb() warn: duplicate check 'segments' (previous on line 158) Fixes: 956f2d86cb37 ("sfc/siena: Remove build references to missing functionality") Reported-by: Dan Carpenter Link: https://lore.kernel.org/kernel-janitors/YoH5tJMnwuGTrn1Z@kili/ Signed-off-by: Martin Habets Link: https://lore.kernel.org/r/165294463549.23865.4557617334650441347.stgit@palantir17.mph.net Signed-off-by: Jakub Kicinski commit 2dc323b1c4cb8ab7db9f8286a9c3267ce66419ab Author: Mykola Lysenko Date: Thu May 19 23:13:03 2022 -0700 selftests/bpf: Remove filtered subtests from output Currently filtered subtests show up in the output as skipped. Before: $ sudo ./test_progs -t log_fixup/missing_map #94 /1 log_fixup/bad_core_relo_trunc_none:SKIP #94 /2 log_fixup/bad_core_relo_trunc_partial:SKIP #94 /3 log_fixup/bad_core_relo_trunc_full:SKIP #94 /4 log_fixup/bad_core_relo_subprog:SKIP #94 /5 log_fixup/missing_map:OK #94 log_fixup:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED After: $ sudo ./test_progs -t log_fixup/missing_map #94 /5 log_fixup/missing_map:OK #94 log_fixup:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Mykola Lysenko Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220520061303.4004808-1-mykolal@fb.com commit fa376860658252a4559026496528c5d3a36b52e3 Author: Mykola Lysenko Date: Fri May 20 00:01:44 2022 -0700 selftests/bpf: Fix subtest number formatting in test_progs Remove weird spaces around / while preserving proper indentation Signed-off-by: Mykola Lysenko Signed-off-by: Andrii Nakryiko Acked-by: Daniel Müller Link: https://lore.kernel.org/bpf/20220520070144.10312-1-mykolal@fb.com commit b23316aabffa835ecc516cb81daeef5b9155e8a5 Author: Yuntao Wang Date: Thu May 19 23:06:10 2022 +0800 selftests/bpf: Add missing trampoline program type to trampoline_count test Currently the trampoline_count test doesn't include any fmod_ret bpf programs, fix it to make the test cover all possible trampoline program types. Since fmod_ret bpf programs can't be attached to __set_task_comm function, as it's neither whitelisted for error injection nor a security hook, change it to bpf_modify_return_test. This patch also does some other cleanups such as removing duplicate code, dropping inconsistent comments, etc. Signed-off-by: Yuntao Wang Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220519150610.601313-1-ytcoode@gmail.com commit 71081e7ac16c93acdd18afa65daa468620bb1b64 Author: Enzo Matsumiya Date: Wed May 18 11:41:04 2022 -0300 cifs: print TIDs as hex Makes these debug messages easier to read Signed-off-by: Enzo Matsumiya Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 337b8b0e4343567221ef8d88aac5e418208d4ac1 Author: Enzo Matsumiya Date: Wed May 18 11:41:05 2022 -0300 cifs: return ENOENT for DFS lookup_cache_entry() EEXIST didn't make sense to use when dfs_cache_find() couldn't find a cache entry nor retrieve a referral target. It also doesn't make sense cifs_dfs_query_info_nonascii_quirk() to emulate ENOENT anymore. Signed-off-by: Enzo Matsumiya Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 421ef3d56513b2ff02e563623688cb6ab4977c4f Author: Enzo Matsumiya Date: Wed May 18 13:31:55 2022 -0300 cifs: don't call cifs_dfs_query_info_nonascii_quirk() if nodfs was set Also return EOPNOTSUPP if path is remote but nodfs was set. Fixes: a2809d0e1696 ("cifs: quirk for STATUS_OBJECT_NAME_INVALID returned for non-ASCII dfs refs") Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 96af42c50adb6cee517c355bfd50060ef27bfa87 Merge: 7aa424e02a04b 4f90d034bba9b Author: Andrii Nakryiko Date: Fri May 20 15:29:01 2022 -0700 Merge branch 'bpf: mptcp: Support for mptcp_sock' Mat Martineau says: ==================== This patch set adds BPF access to mptcp_sock structures, along with associated self tests. You may recognize some of the code from earlier (https://lore.kernel.org/bpf/20200918121046.190240-6-nicolas.rybowski@tessares.net/) but it has been reworked quite a bit. v1 -> v2: Emit BTF type, add func_id checks in verifier.c and bpf_trace.c, remove build check for CONFIG_BPF_JIT, add selftest check for CONFIG_MPTCP, and add a patch to include CONFIG_IKCONFIG/CONFIG_IKCONFIG_PROC for the BPF self tests. v2 -> v3: Access sysctl through the filesystem to work around CI use of the more limited busybox sysctl command. v3 -> v4: Dropped special case kernel code for tcp_sock is_mptcp, use existing bpf_tcp_helpers.h, and add check for 'ip mptcp monitor' support. v4 -> v5: Use BPF test skeleton, more consistent use of ASSERT macros, drop some unnecessary parameters / checks, and use tracing to acquire MPTCP token. Geliang Tang (6): bpf: add bpf_skc_to_mptcp_sock_proto selftests/bpf: Enable CONFIG_IKCONFIG_PROC in config selftests/bpf: test bpf_skc_to_mptcp_sock selftests/bpf: verify token of struct mptcp_sock selftests/bpf: verify ca_name of struct mptcp_sock selftests/bpf: verify first of struct mptcp_sock ==================== Signed-off-by: Andrii Nakryiko commit 4f90d034bba9bdcb06a3cb53c43012351c1b39ff Author: Geliang Tang Date: Thu May 19 16:30:16 2022 -0700 selftests/bpf: Verify first of struct mptcp_sock This patch verifies the 'first' struct member of struct mptcp_sock, which points to the first subflow of msk. Save 'sk' in mptcp_storage, and verify it with 'first' in verify_msk(). v5: - Use ASSERT_EQ() instead of a manual comparison + log (Andrii). Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Matthieu Baerts Link: https://lore.kernel.org/bpf/20220519233016.105670-8-mathew.j.martineau@linux.intel.com commit ccc090f469000fd757049028eeb0dff43013f7c1 Author: Geliang Tang Date: Thu May 19 16:30:15 2022 -0700 selftests/bpf: Verify ca_name of struct mptcp_sock This patch verifies another member of struct mptcp_sock, ca_name. Add a new function get_msk_ca_name() to read the sysctl tcp_congestion_control and verify it in verify_msk(). v3: Access the sysctl through the filesystem to avoid compatibility issues with the busybox sysctl command. v4: use ASSERT_* instead of CHECK_FAIL (Andrii) v5: use ASSERT_STRNEQ() instead of strncmp() (Andrii) Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Matthieu Baerts Link: https://lore.kernel.org/bpf/20220519233016.105670-7-mathew.j.martineau@linux.intel.com commit 0266223467728d553b99adea769d9ff3b6e41372 Author: Geliang Tang Date: Thu May 19 16:30:14 2022 -0700 selftests/bpf: Verify token of struct mptcp_sock This patch verifies the struct member token of struct mptcp_sock. Add a new member token in struct mptcp_storage to store the token value of the msk socket got by bpf_skc_to_mptcp_sock(). Trace the kernel function mptcp_pm_new_connection() by using bpf fentry prog to obtain the msk token and save it in a global bpf variable. Pass the variable to verify_msk() to verify it with the token saved in socket_storage_map. v4: - use ASSERT_* instead of CHECK_FAIL (Andrii) - skip the test if 'ip mptcp monitor' is not supported (Mat) v5: - Drop 'ip mptcp monitor', trace mptcp_pm_new_connection instead (Martin) - Use ASSERT_EQ (Andrii) Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Matthieu Baerts Link: https://lore.kernel.org/bpf/20220519233016.105670-6-mathew.j.martineau@linux.intel.com commit 3bc48b56e345e2ed83841dd08a00c6a9f112be6c Author: Geliang Tang Date: Thu May 19 16:30:13 2022 -0700 selftests/bpf: Test bpf_skc_to_mptcp_sock This patch extends the MPTCP test base, to test the new helper bpf_skc_to_mptcp_sock(). Define struct mptcp_sock in bpf_tcp_helpers.h, use bpf_skc_to_mptcp_sock to get the msk socket in progs/mptcp_sock.c and store the infos in socket_storage_map. Get the infos from socket_storage_map in prog_tests/mptcp.c. Add a new function verify_msk() to verify the infos of MPTCP socket, and rename verify_sk() to verify_tsk() to verify TCP socket only. v2: Add CONFIG_MPTCP check for clearer error messages v4: - use ASSERT_* instead of CHECK_FAIL (Andrii) - drop bpf_mptcp_helpers.h (Andrii) v5: - some 'ASSERT_*' were replaced in the next commit by mistake. - Drop CONFIG_MPTCP (Martin) - Use ASSERT_EQ (Andrii) Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Matthieu Baerts Link: https://lore.kernel.org/bpf/20220519233016.105670-5-mathew.j.martineau@linux.intel.com commit 8039d353217c1d9dae921f131cfe4153bc23e960 Author: Nicolas Rybowski Date: Thu May 19 16:30:12 2022 -0700 selftests/bpf: Add MPTCP test base This patch adds a base for MPTCP specific tests. It is currently limited to the is_mptcp field in case of plain TCP connection because there is no easy way to get the subflow sk from a msk in userspace. This implies that we cannot lookup the sk_storage attached to the subflow sk in the sockops program. v4: - add copyright 2022 (Andrii) - use ASSERT_* instead of CHECK_FAIL (Andrii) - drop SEC("version") (Andrii) - use is_mptcp in tcp_sock, instead of bpf_tcp_sock (Martin & Andrii) v5: - Drop connect_to_mptcp_fd (Martin) - Use BPF test skeleton (Andrii) - Use ASSERT_EQ (Andrii) - Drop the 'msg' parameter of verify_sk Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Nicolas Rybowski Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Matthieu Baerts Link: https://lore.kernel.org/bpf/20220519233016.105670-4-mathew.j.martineau@linux.intel.com commit d3294cb1e06d70a689924792c2acb897eac7d781 Author: Geliang Tang Date: Thu May 19 16:30:11 2022 -0700 selftests/bpf: Enable CONFIG_IKCONFIG_PROC in config CONFIG_IKCONFIG_PROC is required by BPF selftests, otherwise we get errors like this: libbpf: failed to open system Kconfig libbpf: failed to load object 'kprobe_multi' libbpf: failed to load BPF skeleton 'kprobe_multi': -22 It's because /proc/config.gz is opened in bpf_object__read_kconfig_file() in tools/lib/bpf/libbpf.c: file = gzopen("/proc/config.gz", "r"); So this patch enables CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC in tools/testing/selftests/bpf/config. Suggested-by: Mat Martineau Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220519233016.105670-3-mathew.j.martineau@linux.intel.com commit 3bc253c2e652cf5f12cd8c00d80d8ec55d67d1a7 Author: Geliang Tang Date: Thu May 19 16:30:10 2022 -0700 bpf: Add bpf_skc_to_mptcp_sock_proto This patch implements a new struct bpf_func_proto, named bpf_skc_to_mptcp_sock_proto. Define a new bpf_id BTF_SOCK_TYPE_MPTCP, and a new helper bpf_skc_to_mptcp_sock(), which invokes another new helper bpf_mptcp_sock_from_subflow() in net/mptcp/bpf.c to get struct mptcp_sock from a given subflow socket. v2: Emit BTF type, add func_id checks in verifier.c and bpf_trace.c, remove build check for CONFIG_BPF_JIT v5: Drop EXPORT_SYMBOL (Martin) Co-developed-by: Nicolas Rybowski Co-developed-by: Matthieu Baerts Signed-off-by: Nicolas Rybowski Signed-off-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220519233016.105670-2-mathew.j.martineau@linux.intel.com commit 7aa424e02a04bba5ecc84afe9b58b16e9e0b34f8 Author: Feng Zhou Date: Wed May 18 10:50:53 2022 +0800 selftests/bpf: Fix some bugs in map_lookup_percpu_elem testcase comments from Andrii Nakryiko, details in here: https://lore.kernel.org/lkml/20220511093854.411-1-zhoufeng.zf@bytedance.com/T/ use /* */ instead of // use libbpf_num_possible_cpus() instead of sysconf(_SC_NPROCESSORS_ONLN) use 8 bytes for value size fix memory leak use ASSERT_EQ instead of ASSERT_OK add bpf_loop to fetch values on each possible CPU Fixes: ed7c13776e20c74486b0939a3c1de984c5efb6aa ("selftests/bpf: add test case for bpf_map_lookup_percpu_elem") Signed-off-by: Feng Zhou Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220518025053.20492-1-zhoufeng.zf@bytedance.com commit b2441b3bdce6c02cb96278d98c620d7ba1d41b7b Author: Arnd Bergmann Date: Fri May 20 22:40:56 2022 +0200 h8300: remove stale bindings and symlink These four files are left over from the h8300 removal. Reported-by: Geert Uytterhoeven Reported-by: Uwe Kleine-König Signed-off-by: Arnd Bergmann commit 34e37b4c432cd0f1842b352fde4b8878b4166888 Author: Dan Williams Date: Fri May 20 11:30:15 2022 -0700 cxl/port: Enable HDM Capability after validating DVSEC Ranges CXL memory expanders that support the CXL 2.0 memory device class code include an "HDM Decoder Capability" mechanism to supplant the "CXL DVSEC Range" mechanism originally defined in CXL 1.1. Both mechanisms depend on a "mem_enable" bit being set in configuration space before either mechanism activates. When the HDM Decoder Capability is enabled the CXL DVSEC Range settings are ignored. Previously, the cxl_mem driver was relying on platform-firmware to set "mem_enable". That is an invalid assumption as there is no requirement that platform-firmware sets the bit before the driver sees a device, especially in hot-plug scenarios. Additionally, ACPI-platforms that support CXL 2.0 devices also support the ACPI CEDT (CXL Early Discovery Table). That table outlines the platform permissible address ranges for CXL operation. So, there is a need for the driver to set "mem_enable", and there is information available to determine the validity of the CXL DVSEC Ranges. Arrange for the driver to optionally enable the HDM Decoder Capability if "mem_enable" was not set by platform firmware, or the CXL DVSEC Range configuration was invalid. Be careful to only disable memory decode if the kernel was the one to enable it. In other words, if CXL is backing all of kernel memory at boot the device needs to maintain "mem_enable" and "HDM Decoder enable" all the way up to handoff back to platform firmware (e.g. ACPI S5 state entry may require CXL memory to stay active). Fixes: 560f78559006 ("cxl/pci: Retrieve CXL DVSEC memory info") Cc: Dan Carpenter [dan: fix early terminiation of range-allowed loop] Cc: Ariel Sibley [ariel: Memory_size must be non-zero] Cc: Jonathan Cameron Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165307136375.2499769.861793697156744166.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 97fa5887cf283bb75ffff5f6b2c0e71794c02400 Author: Monish Kumar R Date: Fri May 20 18:30:44 2022 +0530 USB: new quirk for Dell Gen 2 devices Add USB_QUIRK_NO_LPM and USB_QUIRK_RESET_RESUME quirks for Dell usb gen 2 device to not fail during enumeration. Found this bug on own testing Signed-off-by: Monish Kumar R Cc: stable Link: https://lore.kernel.org/r/20220520130044.17303-1-monish.kumar.r@intel.com Signed-off-by: Greg Kroah-Hartman commit 8cfd16f7223264d3fbaa4737ef67ff2d2621ec9f Merge: 859bdc359567f 33b7af2f459df Author: Greg Kroah-Hartman Date: Fri May 20 21:14:44 2022 +0200 Merge tag 'usb-serial-5.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 5.19-rc1 Here are the USB-serial updates for 5.19-rc1, including: - a workaround for pl2303 devices with unexpected bcdUSB - a new modem device id Included is also a printk clean up. All but the modem-id commit have been in linux-next with no reported issues. * tag 'usb-serial-5.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel BG95 modem USB: serial: pl2303: fix type detection for odd device USB: serial: ftdi_sio: clean up printk format specifier commit cafada1fe932ce761d6c0bc1d56967e27abe4cff Author: Greg Kroah-Hartman Date: Fri May 20 21:07:05 2022 +0200 Revert "speakup: Generate speakupmap.h automatically" This reverts commit 6646b95aab5f62c049f1416a3801dec5432c348b. Stephen reports that it breaks the build for him so revert it for now. Cc: Samuel Thibault Reported-by: Stephen Rothwell Link: https://lore.kernel.org/r/20220520194637.03824f7f@canb.auug.org.au Signed-off-by: Greg Kroah-Hartman commit b90f994a37cc1fc028807007fbf5f1df7d6bf141 Author: Mårten Lindahl Date: Thu Apr 28 16:40:38 2022 +0200 hwmon: (pmbus/ltc2978) Add chip specific write_byte_data Several of the manuals for devices supported by this driver describes the need for a minimum wait time before the chip is ready to receive next command. This wait time is already implemented in the driver as a ltc_wait_ready function with a driver defined wait time of 100 ms, and is considered for specific devices before reading/writing data on the pmbus. Since this driver uses the default pmbus_regulator_ops for the enable/ disable/is_enabled functions we should add a driver specific callback for write_byte_data to prevent bypassing the wait time recommendations for the following devices: ltc3880/ltc3882/ltc3883/ltc3884/ltc3886/ ltc3887/ltc3889/ltm4664/ltm4675/ltm4676/ltm4677/ltm4678/ltm4680/ltm4686/ ltm4700/ltc7880. Signed-off-by: Mårten Lindahl Link: https://lore.kernel.org/r/20220428144039.2464667-4-marten.lindahl@axis.com Signed-off-by: Guenter Roeck commit f0a5c839766334b09e0f280fa10ff5555f71f825 Author: Mårten Lindahl Date: Thu Apr 28 16:40:37 2022 +0200 hwmon: (pmbus) Use _pmbus_read_byte_data with callback Some of the pmbus core functions uses pmbus_read_byte_data, which does not support driver callbacks for chip specific write operations. This could potentially influence some specific regulator chips that for example need a time delay before each data access. Lets use _pmbus_read_byte_data with callback check. Signed-off-by: Mårten Lindahl Link: https://lore.kernel.org/r/20220428144039.2464667-3-marten.lindahl@axis.com Signed-off-by: Guenter Roeck commit 5de3e13f7f6b496bd7bd9ff4d2b915b7d3e67cda Author: Mårten Lindahl Date: Thu Apr 28 16:40:36 2022 +0200 hwmon: (pmbus) Introduce and use write_byte_data callback Some of the pmbus core functions uses pmbus_write_byte_data, which does not support driver callbacks for chip specific write operations. This could potentially influence some specific regulator chips that for example need a time delay before each data access. Lets add support for driver callback with _pmbus_write_byte_data. Signed-off-by: Mårten Lindahl Link: https://lore.kernel.org/r/20220428144039.2464667-2-marten.lindahl@axis.com Signed-off-by: Guenter Roeck commit edd969aa9a268b0c70d2787f258a2b4e271a5fe0 Author: Eugene Shalygin Date: Wed Apr 27 20:02:36 2022 +0200 hwmon: (asus-ec-sensors) add doc entry for PRIME X470-PRO Add PRIME X470-PRO to the list of supported boards. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220427180237.1475954-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 7cc44e5a45a69274071297579d3e6afeef24cc65 Author: Eugene Shalygin Date: Wed Apr 27 16:30:01 2022 +0200 hwmon: (asus-ec-sensors) add PRIME X470-PRO board This board is supposed to be handled by the asus-wmi-sensors driver, but due to a buggy WMI implementation the driver and the official ASUS software make the BIOS hang together with fan controls [1, 2]. This driver complements values provided by the SIO chip and does not freeze the BIOS, as tested by a user [2]. [1] https://github.com/electrified/asus-wmi-sensors/blob/master/README.md [2] https://github.com/zeule/asus-ec-sensors/issues/12 Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220427143001.1443605-5-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 45934e4af6736dc14c5641e25666b6a6a9d009d9 Author: Eugene Shalygin Date: Wed Apr 27 16:30:00 2022 +0200 hwmon: (asus-ec-sensors) add support for board families DSDT code for AMD 400-series chipset shows that sensor addresses differ for this generation from those for the AMD 500-series boards. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220427143001.1443605-4-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit de8fbac5e59e239b00cdac611784b1bc1ff53d14 Author: Eugene Shalygin Date: Wed Apr 27 16:29:59 2022 +0200 hwmon: (asus-ec-sensors) implement locking via the ACPI global lock For some board models ASUS uses the global ACPI lock to guard access to the hardware, so do we. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220427143001.1443605-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 5cd29012028d997f46518dae0a8133e0985713f3 Author: Eugene Shalygin Date: Wed Apr 27 16:29:58 2022 +0200 hwmon: (asus-ec-sensors) introduce ec_board_info struct for board data We need to keep some more information about the current board than just the sensors set, and with more boards to add the dmi id array grows quickly. Our probe code is always the same so let's switch to a custom test code and a custom board info array. That allows us to omit board vendor string (ASUS uses two strings that differ in case) in the board info and use case-insensitive comparison, and also do not duplicate sensor definitions for such board variants as " (WI-FI)" when sensors are identical to the base variant. Also saves a quarter of the module size by replacing big dmi_system_id structs with smaller ones. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220427143001.1443605-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 849b0156d9960da628a06756bb920d9571c15e66 Author: Eddie James Date: Wed Apr 27 09:04:43 2022 -0500 hwmon: (occ) Delay hwmon registration until user request Instead of registering the hwmon device at probe time, use the existing "occ_active" sysfs file to control when the driver polls the OCC for sensor data and registers with hwmon. The reason for this change is that the SBE, which is the device by which the driver communicates with the OCC, cannot handle communications during certain system state transitions, resulting in unrecoverable system errors. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220427140443.11428-1-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit c3963bc0a0cf9ecb205a9d4976eb92b6df2fa3fd Author: Zev Weiss Date: Tue Apr 26 18:01:53 2022 -0700 hwmon: (nct6775) Split core and platform driver This splits the nct6775 driver into an interface-independent core and a separate platform driver that wraps inb/outb port I/O (or asuswmi methods) around that core. Signed-off-by: Zev Weiss Tested-by: Renze Nicolai Link: https://lore.kernel.org/r/20220427010154.29749-7-zev@bewilderbeest.net Tested-by: Oleksandr Natalenko Signed-off-by: Guenter Roeck commit ae0d7227741f6791f056f906625ffbd5fe95fb2c Author: Zev Weiss Date: Tue Apr 26 18:01:52 2022 -0700 hwmon: (nct6775) Convert S_I* permissions macros to octal Checkpatch has been warning about these for a while; the octal versions are both more comprehensible and more concise. Signed-off-by: Zev Weiss Link: https://lore.kernel.org/r/20220427010154.29749-6-zev@bewilderbeest.net Tested-by: Oleksandr Natalenko Signed-off-by: Guenter Roeck commit bd2e82bd4f4839f70c00a480e0133dc9650d7211 Author: Zev Weiss Date: Tue Apr 26 18:01:51 2022 -0700 hwmon: (nct6775) Add read-only mode When enabled, all write bits are removed from the modes of all sysfs attribute files. This provides a bit of infrastructure for the upcoming i2c version of this driver, which should generally avoid writes to device registers so as not to interfere with simultaneous use of the device via the LPC interface. Signed-off-by: Zev Weiss Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220427010154.29749-5-zev@bewilderbeest.net Tested-by: Oleksandr Natalenko Signed-off-by: Guenter Roeck commit 3c7e4935d46803f009e344546e41e777df7537b1 Author: Zev Weiss Date: Tue Apr 26 18:01:50 2022 -0700 hwmon: (nct6775) Rearrange attr-group initialization We now track the number of attribute groups in nct6775_data, as a measure to simplify handling differences in the set of enabled attribute groups between nct6775 drivers (platform & i2c). As a side effect, we also reduce the amount of IS_ERR()/PTR_ERR() boilerplate a bit. Signed-off-by: Zev Weiss Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220427010154.29749-4-zev@bewilderbeest.net Tested-by: Oleksandr Natalenko Signed-off-by: Guenter Roeck commit 4ef2774511dc6e552228bd6c3fefa2e7d41f38b7 Author: Zev Weiss Date: Tue Apr 26 18:01:49 2022 -0700 hwmon: (nct6775) Convert register access to regmap API This replaces the nct6775_data->{read,write}_value function pointers with a regmap. The major difference is that the regmap access functions may fail, and hence require checking at each call site. While the existing WMI register-access code had potential failure paths, they were masked by the fact that the read_value() function returned the register value directly, and hence squashed errors undetectably by simply returning zero, and while the write_value() functions were capable of reporting errors, all callers ignored them. This improves the robustness of the existing code, and also prepares the driver for an i2c version to be added soon, for which register accesses are much more likely to actually fail. The conversion of the register-access call sites is largely mechanical (reading a register now returns the value via an out-param pointer, and returned errors must be checked for and propagated to callers), though the nct6775_write_fan_div() function is refactored slightly to avoid duplicating nearly identical (and now lengthier) code in each switch case. Signed-off-by: Zev Weiss Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220427010154.29749-3-zev@bewilderbeest.net Tested-by: Oleksandr Natalenko Signed-off-by: Guenter Roeck commit 981c5f3c744bbe2e6420a8a834d52c7ed2a75b7f Author: Armin Wolf Date: Tue Apr 26 23:31:54 2022 +0200 hwmon: (dell-smm) Warn if SMM call took a very long time to execute If a particular SMM call takes a very long time to execute, the user might experience audio problems. Print a warning if a particular SMM call took over 0.250 seconds to execute, so the user can check whether or not possible audio problems are caused by this driver. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220426213154.724708-4-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit f44aa665ee9647a204066b287c8fc8c604440425 Author: Armin Wolf Date: Tue Apr 26 23:31:53 2022 +0200 hwmon: (dell-smm) Cleanup init code The default values for i8k_fan_mult and i8k_fan_max should be assigend only if the values specified as module params or in DMI are invalid/missing. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220426213154.724708-3-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 4fc1a51c8572179abb767f56cbfc433e00e310c1 Author: Armin Wolf Date: Tue Apr 26 23:31:52 2022 +0200 hwmon: (dell-smm) Avoid unnecessary SMM calls during init When the driver tries to detect the fan multiplier during module initialisation, it issues one SMM call for each fan. Those SMM calls are however redundant and also try to query fans which may not be present. Fix that by detecting the fan multiplier during hwmon initialisation when no extra SMM calls are needed. Also dont assume the last nominal speed entry to be the biggest and instead check all entries. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220426213154.724708-2-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit c851b715d38de0c262a63de16ad954ed39b47aca Author: Peter Rosin Date: Mon Apr 25 22:35:50 2022 +0200 hwmon: (lm75) Add Atmel AT30TS74 support Atmel (now Microchip) AT30TS74 is an LM75 compatible sensor. Add it. Signed-off-by: Peter Rosin Link: https://lore.kernel.org/r/9494dfbc-f506-3e94-501d-6760c487c93d@axentia.se Signed-off-by: Guenter Roeck commit be754099e5d400e01b2dc12119208be052e87b1b Author: Peter Rosin Date: Mon Apr 25 22:35:41 2022 +0200 dt-bindings: hwmon: Add Atmel AT30TS74 Document the Atmel (now Microchip) AT30TS74 which is an LM75 based temperature sensor. Acked-by: Rob Herring Signed-off-by: Peter Rosin Link: https://lore.kernel.org/r/9c01b1b5-871a-2b34-9f98-766d043e0759@axentia.se Signed-off-by: Guenter Roeck commit 8c099cd381aa36373593d4efc92493c1345c73da Author: Camel Guo Date: Mon Apr 25 12:00:19 2022 +0200 hwmon: (tmp401) Fix incorrect return value of tmp401_init_client When ti,n-factor, ti,beta-compentation are not defined in devicetree, of_property_read_u32|s32 returns -EINVAL. In this case, tmp401_init_client should return 0 instead of simply pass ret to its caller. Signed-off-by: Camel Guo Link: https://lore.kernel.org/r/20220425100019.562781-1-camel.guo@axis.com Signed-off-by: Guenter Roeck commit e5c498ccc90c87155d1f6980cac050d48b8a84b4 Author: Atif Ofluoglu Date: Fri Apr 15 16:34:29 2022 +0300 hwmon: (pmbus/max16601) Add MAX16602 support Adding another MAX16602 chip support to MAX16601 driver Tested with MAX16602 works as expected. Signed-off-by: Atif Ofluoglu Signed-off-by: Guenter Roeck commit 229b159c505a7ee5da86f952db1e644b213ccb61 Author: Jack Doan Date: Sun Apr 24 00:14:22 2022 -0500 hwmon: (aquacomputer_d5next) Add support for Aquacomputer Farbwerk Extend aquacomputer_d5next driver to expose hardware temperature sensors of the Aquacomputer Farbwerk RGB controller, which communicates through a proprietary USB HID protocol. Four temperature sensors are available. Additionally, serial number and firmware version are exposed through debugfs. Also, add Jack Doan to MAINTAINERS for this driver. Signed-off-by: Jack Doan Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/YmTcrq8Gzel0zYYD@jackdesk Signed-off-by: Guenter Roeck commit c8e5e37a609da0779d601835972a62ebac057e2e Author: Armin Wolf Date: Sun Apr 24 17:48:24 2022 +0200 hwmon: (dell-smm) Update Documentation regarding firmware bugs When adding the Inspiron 3505 to the fan type blacklist, the Documentation was not updated to mention the firmware bug on this machine. Fix that. Fixes: 6ba463edccb9 (hwmon: (dell-smm) Add Inspiron 3505 to fan type blacklist) Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220424154824.9396-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit c7250b5d553cae39bdfcac95ef5bdac6f6a5b022 Author: Oleksandr Shamray Date: Mon Apr 18 15:12:59 2022 +0300 hwmon: (jc42) Add support for S-34TS04A S-34TS04A is a JC42 compatible 2-wire serial EEPROM with temperature sensor from Seiko Instruments/ABLIC. Signed-off-by: Oleksandr Shamray Reviewed-by: Vadim Pasternak Signed-off-by: Guenter Roeck commit bd79021072ac841e73ec5300a4dbfbdeff431582 Author: Camel Guo Date: Thu Apr 14 09:58:23 2022 +0200 hwmon: (tmp401) Add support of three advanced features tmp401 driver supports TMP401, TMP411 and TMP43X temperature sensors. According to their datasheet: - all of them support extended temperature range feature; - TMP411 and TPM43X support n-factor correction feature; - TMP43X support beta compensation feature. In order to support setting them during bootup, this commit reads ti,extended-range-enable, ti,n-factor and ti,beta-compensation and set the corresponding registers during probing. Signed-off-by: Camel Guo Link: https://lore.kernel.org/r/20220414075824.2634839-3-camel.guo@axis.com Signed-off-by: Guenter Roeck commit bd90c5b939502136ae95005e470914e935a548bc Author: Camel Guo Date: Thu Apr 14 09:58:22 2022 +0200 dt-bindings: hwmon: Add TMP401, TMP411 and TMP43x Document the TMP401, TMP411 and TMP43x device devicetree bindings Reviewed-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Signed-off-by: Camel Guo Link: https://lore.kernel.org/r/20220414075824.2634839-2-camel.guo@axis.com Signed-off-by: Guenter Roeck commit 0616ea3f1b93a99264d84f3d002ae117f6526b62 Merge: d6fc5db0f8282 18f3976fdb5da Author: Catalin Marinas Date: Fri May 20 18:51:54 2022 +0100 Merge branch 'for-next/esr-elx-64-bit' into for-next/core * for-next/esr-elx-64-bit: : Treat ESR_ELx as a 64-bit register. KVM: arm64: uapi: Add kvm_debug_exit_arch.hsr_high KVM: arm64: Treat ESR_EL2 as a 64-bit register arm64: Treat ESR_ELx as a 64-bit register arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall arm64: Make ESR_ELx_xVC_IMM_MASK compatible with assembly commit d6fc5db0f82828c74742319cb6c988c4a8aac535 Merge: e003d5335c387 9f93c2e0cda49 Author: Catalin Marinas Date: Fri May 20 18:51:15 2022 +0100 Merge branch 'for-next/kselftest' into for-next/core * for-next/kselftest: (32 commits) : arm64 kselftest updates. kselftest/arm64: Explicitly build no BTI tests with BTI disabled kselftest/arm64: bti: force static linking selftests/arm64: Use switch statements in mte_common_util.c selftests/arm64: Remove casts to/from void in check_tags_inclusion selftests/arm64: Check failures to set tags in check_tags_inclusion selftests/arm64: Allow zero tags in mte_switch_mode() selftests/arm64: Log errors in verify_mte_pointer_validity() kselftest/arm64: Fix ABI header directory location selftests/arm64: Fix O= builds for the floating point tests selftests/arm64: Clean the fp helper libraries selftests/arm64: Define top_srcdir for the fp tests selftests/arm64: Use TEST_GEN_PROGS_EXTENDED in the FP Makefile kselftest/arm64: fix array_size.cocci warning selftests/arm64: Add a testcase for handling of ZA on clone() kselftest/arm64: Add SME support to syscall ABI test kselftest/arm64: Add coverage for the ZA ptrace interface kselftest/arm64: Add streaming SVE to SVE ptrace tests kselftest/arm64: signal: Add SME signal handling tests kselftest/arm64: Add stress test for SME ZA context switching kselftest/arm64: signal: Handle ZA signal context in core code ... commit e003d5335c3877bcbee8d0c347d3c3ee36cdd8b7 Merge: 201729d53a349 dffdeade18432 Author: Catalin Marinas Date: Fri May 20 18:50:57 2022 +0100 Merge branch 'for-next/sysreg-gen' into for-next/core * for-next/sysreg-gen: (32 commits) : Automatic system register definition generation. arm64/sysreg: Generate definitions for FAR_ELx arm64/sysreg: Generate definitions for DACR32_EL2 arm64/sysreg: Generate definitions for CSSELR_EL1 arm64/sysreg: Generate definitions for CPACR_ELx arm64/sysreg: Generate definitions for CONTEXTIDR_ELx arm64/sysreg: Generate definitions for CLIDR_EL1 arm64/sve: Generate ZCR definitions arm64/sme: Generate defintions for SVCR arm64/sme: Generate SMPRI_EL1 definitions arm64/sme: Automatically generate SMPRIMAP_EL2 definitions arm64/sme: Automatically generate SMIDR_EL1 defines arm64/sme: Automatically generate defines for SMCR arm64/sysreg: Support generation of RAZ fields arm64/sme: Remove _EL0 from name of SVCR - FIXME sysreg.h arm64/sme: Standardise bitfield names for SVCR arm64/sme: Drop SYS_ from SMIDR_EL1 defines arm64/fp: Rename SVE and SME LEN field name to _WIDTH arm64/fp: Make SVE and SME length register definition match architecture arm64/sysreg: fix odd line spacing arm64/sysreg: improve comment for regs without fields ... commit 201729d53a34924cfcd011f71e49de9bb2902bd8 Merge: c5781212985a7 8e1f78a92101e bd5552bc4807a 18788e34642e2 aea3cb356c964 c4a0ebf87cebb 8f0f104e2ab6e Author: Catalin Marinas Date: Fri May 20 18:50:35 2022 +0100 Merge branches 'for-next/sme', 'for-next/stacktrace', 'for-next/fault-in-subpage', 'for-next/misc', 'for-next/ftrace' and 'for-next/crashkernel', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: perf/arm-cmn: Decode CAL devices properly in debugfs perf/arm-cmn: Fix filter_sel lookup perf/marvell_cn10k: Fix tad_pmu_event_init() to check pmu type first drivers/perf: hisi: Add Support for CPA PMU drivers/perf: hisi: Associate PMUs in SICL with CPUs online drivers/perf: arm_spe: Expose saturating counter to 16-bit perf/arm-cmn: Add CMN-700 support perf/arm-cmn: Refactor occupancy filter selector perf/arm-cmn: Add CMN-650 support dt-bindings: perf: arm-cmn: Add CMN-650 and CMN-700 perf: check return value of armpmu_request_irq() perf: RISC-V: Remove non-kernel-doc ** comments * for-next/sme: (30 commits) : Scalable Matrix Extensions support. arm64/sve: Move sve_free() into SVE code section arm64/sve: Make kernel FPU protection RT friendly arm64/sve: Delay freeing memory in fpsimd_flush_thread() arm64/sme: More sensibly define the size for the ZA register set arm64/sme: Fix NULL check after kzalloc arm64/sme: Add ID_AA64SMFR0_EL1 to __read_sysreg_by_encoding() arm64/sme: Provide Kconfig for SME KVM: arm64: Handle SME host state when running guests KVM: arm64: Trap SME usage in guest KVM: arm64: Hide SME system registers from guests arm64/sme: Save and restore streaming mode over EFI runtime calls arm64/sme: Disable streaming mode and ZA when flushing CPU state arm64/sme: Add ptrace support for ZA arm64/sme: Implement ptrace support for streaming mode SVE registers arm64/sme: Implement ZA signal handling arm64/sme: Implement streaming SVE signal handling arm64/sme: Disable ZA and streaming mode when handling signals arm64/sme: Implement traps and syscall handling for SME arm64/sme: Implement ZA context switching arm64/sme: Implement streaming SVE context switching ... * for-next/stacktrace: : Stacktrace cleanups. arm64: stacktrace: align with common naming arm64: stacktrace: rename stackframe to unwind_state arm64: stacktrace: rename unwinder functions arm64: stacktrace: make struct stackframe private to stacktrace.c arm64: stacktrace: delete PCS comment arm64: stacktrace: remove NULL task check from unwind_frame() * for-next/fault-in-subpage: : btrfs search_ioctl() live-lock fix using fault_in_subpage_writeable(). btrfs: Avoid live-lock in search_ioctl() on hardware with sub-page faults arm64: Add support for user sub-page fault probing mm: Add fault_in_subpage_writeable() to probe at sub-page granularity * for-next/misc: : Miscellaneous patches. arm64: Kconfig.platforms: Add comments arm64: Kconfig: Fix indentation and add comments arm64: mm: avoid writable executable mappings in kexec/hibernate code arm64: lds: move special code sections out of kernel exec segment arm64/hugetlb: Implement arm64 specific huge_ptep_get() arm64/hugetlb: Use ptep_get() to get the pte value of a huge page arm64: mm: Make arch_faults_on_old_pte() check for migratability arm64: mte: Clean up user tag accessors arm64/hugetlb: Drop TLB flush from get_clear_flush() arm64: Declare non global symbols as static arm64: mm: Cleanup useless parameters in zone_sizes_init() arm64: fix types in copy_highpage() arm64: Set ARCH_NR_GPIO to 2048 for ARCH_APPLE arm64: cputype: Avoid overflow using MIDR_IMPLEMENTOR_MASK arm64: document the boot requirements for MTE arm64/mm: Compute PTRS_PER_[PMD|PUD] independently of PTRS_PER_PTE * for-next/ftrace: : ftrace cleanups. arm64/ftrace: Make function graph use ftrace directly ftrace: cleanup ftrace_graph_caller enable and disable * for-next/crashkernel: : Support for crashkernel reservations above ZONE_DMA. arm64: kdump: Do not allocate crash low memory if not needed docs: kdump: Update the crashkernel description for arm64 of: Support more than one crash kernel regions for kexec -s of: fdt: Add memory for devices by DT property "linux,usable-memory-range" arm64: kdump: Reimplement crashkernel=X arm64: Use insert_resource() to simplify code kdump: return -ENOENT if required cmdline option does not exist commit dffdeade18432d257e0c1845dc4e694f414a9721 Author: Mark Brown Date: Fri May 20 17:16:38 2022 +0100 arm64/sysreg: Generate definitions for FAR_ELx Convert FAR_ELx to automatic register generation as per DDI0487H.a. In the architecture these registers have a single field "named" as "Faulting Virtual Address for synchronous exceptions taken to ELx" occupying the entire register, in order to fit in with the requirement to describe the contents of the register I have created a single field named ADDR. No functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-7-broonie@kernel.org Signed-off-by: Catalin Marinas commit 01baa57ad6865bf60d5fcd77b31b2bd8bb155176 Author: Mark Brown Date: Fri May 20 17:16:37 2022 +0100 arm64/sysreg: Generate definitions for DACR32_EL2 Convert DACR32_EL2 to automatic register generation as per DDI0487H.a, no functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-6-broonie@kernel.org Signed-off-by: Catalin Marinas commit 8bd354b30533632396627291c4a3792f9c2947b2 Author: Mark Brown Date: Fri May 20 17:16:36 2022 +0100 arm64/sysreg: Generate definitions for CSSELR_EL1 Convert CSSELR_EL1 to automatic generation as per DDI0487H.a, no functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-5-broonie@kernel.org Signed-off-by: Catalin Marinas commit b5c0f1051dc3ba4a4c53fccb6604ecc56b0a2982 Author: Mark Brown Date: Fri May 20 17:16:35 2022 +0100 arm64/sysreg: Generate definitions for CPACR_ELx Convert the CPACR system register definitions to be automatically generated using the definitions in DDI0487H.a. The kernel does have some additional definitions for subfields of SMEN, FPEN and ZEN which are not identified as distinct subfields in the architecture so the definitions are not updated as part of this patch. No functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-4-broonie@kernel.org Signed-off-by: Catalin Marinas commit 8c12e22c9f88142630bfadc3685b640aea94a9d5 Author: Mark Brown Date: Fri May 20 17:16:34 2022 +0100 arm64/sysreg: Generate definitions for CONTEXTIDR_ELx Convert the various CONTEXTIDR_ELx register definitions to be automatically generated following the definitions in DDI0487H.a. No functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-3-broonie@kernel.org Signed-off-by: Catalin Marinas commit af65ea977bb8056b4e12b7057ababf19ab086f67 Author: Mark Brown Date: Fri May 20 17:16:33 2022 +0100 arm64/sysreg: Generate definitions for CLIDR_EL1 Convert CLIDR_EL1 to be automatically generated with definition as per DDI0487H.a. No functional change. Signed-off-by: Mark Brown Reviewed-by: Mark Rutland Link: https://lore.kernel.org/r/20220520161639.324236-2-broonie@kernel.org Signed-off-by: Catalin Marinas commit 781121a7f6d11d7cae44982f174ea82adeec7db0 Author: Brian Norris Date: Fri May 6 18:01:06 2022 +0200 clang-format: Fix space after for_each macros Set SpaceBeforeParens to ControlStatementsExceptForEachMacros to not add space between a for_each macro and the following parenthesis. This option is available since clang-format-11 [1] and is in line with the checkpatch.pl rules [2]. I found that this patch has also been sent by Brian Norris some weeks ago [3]. Link: https://clang.llvm.org/docs/ClangFormatStyleOptions.html [1] Link: https://lore.kernel.org/r/8b6b252b-47a6-9d52-f0bd-10d3bc4ad244@digikod.net [2] Link: https://lore.kernel.org/lkml/YmHuZjmP9MxkgJ0R@google.com/ [3] Cc: Miguel Ojeda Cc: Tom Rix Signed-off-by: Brian Norris Co-developed-by: Mickaël Salaün Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506160106.522341-6-mic@digikod.net [Adjusted authorship as agreed] Signed-off-by: Miguel Ojeda commit d7f6604341c748f803810664d5603af22b84a8cc Author: Mickaël Salaün Date: Fri May 6 18:01:04 2022 +0200 clang-format: Fix goto labels indentation Thanks to IndentGotoLabels introduced with clang-format-10 [1], we can avoid goto labels identation. This follows the current coding style and it is then in line with the checkpatch.pl rules [2]. Link: https://clang.llvm.org/docs/ClangFormatStyleOptions.html [1] Link: https://lore.kernel.org/r/8b6b252b-47a6-9d52-f0bd-10d3bc4ad244@digikod.net [2] Cc: Miguel Ojeda Cc: Tom Rix Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506160106.522341-4-mic@digikod.net [Updated header comment to >= 10] Signed-off-by: Miguel Ojeda commit 7869b481025c048ec6ea5b99acb14d057547de80 Author: Zheyu Ma Date: Fri May 20 10:56:24 2022 +0800 gpio: ml-ioh: Convert to use managed functions pcim* and devm_* When removing the module, we will get the following flaw: [ 14.204955] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'gpio_ml_ioh' [ 14.205827] WARNING: CPU: 0 PID: 305 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0 ... [ 14.220613] ioh_gpio_remove+0xc5/0xe0 [gpio_ml_ioh] [ 14.221075] pci_device_remove+0x92/0x240 Fix this by using managed functions, this makes the error handling more simpler. Fixes: e971ac9a564a ("gpio: ml-ioh: use resource management for irqs") Signed-off-by: Zheyu Ma Signed-off-by: Bartosz Golaszewski commit f4d84c52643ae1d63a8e73e2585464470e7944d1 Author: Chuck Lever Date: Sun Mar 27 16:46:47 2022 -0400 NFSD: Clean up nfsd_open_verified() Its only caller always passes S_IFREG as the @type parameter. As an additional clean-up, add a kerneldoc comment. Signed-off-by: Chuck Lever commit 1c388f27759c5d9271d4fca081f7ee138986eb7d Author: Chuck Lever Date: Mon Mar 28 15:36:58 2022 -0400 NFSD: Remove do_nfsd_create() Now that its two callers have their own version-specific instance of this function, do_nfsd_create() is no longer used. Signed-off-by: Chuck Lever commit 254454a5aa4a9f696d6bae080c08d5863e650f49 Author: Chuck Lever Date: Mon Mar 28 14:47:34 2022 -0400 NFSD: Refactor NFSv4 OPEN(CREATE) Copy do_nfsd_create() to nfs4proc.c and remove NFSv3-specific logic. Signed-off-by: Chuck Lever commit df9606abddfb01090d5ece7dcc2441d848f690f0 Author: Chuck Lever Date: Mon Mar 28 13:29:23 2022 -0400 NFSD: Refactor NFSv3 CREATE The NFSv3 CREATE and NFSv4 OPEN(CREATE) use cases are about to diverge such that it makes sense to split do_nfsd_create() into one version for NFSv3 and one for NFSv4. As a first step, copy do_nfsd_create() to nfs3proc.c and remove NFSv4-specific logic. One immediate legibility benefit is that the logic for handling NFSv3 createhow is now quite straightforward. NFSv4 createhow has some subtleties that IMO do not belong in generic code. Signed-off-by: Chuck Lever commit 5f46e950c395b9c14c282b53ba78c5fd46d6c256 Author: Chuck Lever Date: Mon Mar 28 16:10:17 2022 -0400 NFSD: Refactor nfsd_create_setattr() I'd like to move do_nfsd_create() out of vfs.c. Therefore nfsd_create_setattr() needs to be made publicly visible. Note that both call sites in vfs.c commit both the new object and its parent directory, so just combine those common metadata commits into nfsd_create_setattr(). Signed-off-by: Chuck Lever commit 14ee45b70dd0d9ae76fb066cd8c0652d657353f6 Author: Chuck Lever Date: Mon Mar 28 10:16:42 2022 -0400 NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create() Clean up: The "out" label already invokes fh_drop_write(). Note that fh_drop_write() is already careful not to invoke mnt_drop_write() if either it has already been done or there is nothing to drop. Therefore no change in behavior is expected. Signed-off-by: Chuck Lever commit e61568599c9ad638fdaba150fee07d7065e31851 Author: Chuck Lever Date: Fri Mar 25 14:47:54 2022 -0400 NFSD: Clean up nfsd3_proc_create() As near as I can tell, mode bit masking and setting S_IFREG is already done by do_nfsd_create() and vfs_create(). The NFSv4 path (do_open_lookup), for example, does not bother with this special processing. Signed-off-by: Chuck Lever commit 19bc59bbeddf07360ef8bceb420f95712977a32f Merge: 83a7a614ce584 9282d0996936c Author: Palmer Dabbelt Date: Fri May 20 10:14:08 2022 -0700 Merge tag 'generic-ticket-spinlocks-v6' into for-next asm-generic: New generic ticket-based spinlock This contains a new ticket-based spinlock that uses only generic atomics and doesn't require as much from the memory system as qspinlock does in order to be fair. It also includes a bit of documentation about the qspinlock and qrwlock fairness requirements. This will soon be used by a handful of architectures that don't meet the qspinlock requirements. * tag 'generic-ticket-spinlocks-v6': csky: Move to generic ticket-spinlock RISC-V: Move to queued RW locks RISC-V: Move to generic spinlocks openrisc: Move to ticket-spinlock asm-generic: qrwlock: Document the spinlock fairness requirements asm-generic: qspinlock: Indicate the use of mixed-size atomics asm-generic: ticket-lock: New generic ticket-based spinlock commit cdb4913293897dde0df522ed5789ba016f3b9157 Merge: 21673fcb2532d 492449ae4f0ad Author: Thomas Gleixner Date: Fri May 20 18:48:54 2022 +0200 Merge tag 'irqchip-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - Add new infrastructure to stop gpiolib from rewriting irq_chip structures behind our back. Convert a few of them, but this will obviously be a long effort. - A bunch of GICv3 improvements, such as using MMIO-based invalidations when possible, and reducing the amount of polling we perform when reconfiguring interrupts. - Another set of GICv3 improvements for the Pseudo-NMI functionality, with a nice cleanup making it easy to reason about the various states we can be in when an NMI fires. - The usual bunch of misc fixes and minor improvements. Link: https://lore.kernel.org/all/20220519165308.998315-1-maz@kernel.org commit dc7769244e03e932262a4f10eeab11657cb601c7 Author: Jakub Kicinski Date: Thu May 19 19:13:47 2022 -0700 tcp_ipv6: set the drop_reason in the right place Looks like the IPv6 version of the patch under Fixes was a copy/paste of the IPv4 but hit the wrong spot. It is tcp_v6_rcv() which uses drop_reason as a boolean, and needs to be protected against reason == 0 before calling free. tcp_v6_do_rcv() has a pretty straightforward flow. The resulting warning looks like this: WARNING: CPU: 1 PID: 0 at net/core/skbuff.c:775 Call Trace: tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1767) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input_finish (include/linux/rcupdate.h:726) ip6_input (include/linux/netfilter.h:307) Fixes: f8319dfd1b3b ("net: tcp: reset 'drop_reason' to NOT_SPCIFIED in tcp_v{4,6}_rcv()") Tested-by: Matthieu Baerts Link: https://lore.kernel.org/r/20220520021347.2270207-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 79025e727a846be6fd215ae9cdb654368ac3f9a6 Author: Jens Axboe Date: Thu May 19 17:31:37 2022 -0600 random: wire up fops->splice_{read,write}_iter() Now that random/urandom is using {read,write}_iter, we can wire it up to using the generic splice handlers. Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Jens Axboe [Jason: added the splice_write path. Note that sendfile() and such still does not work for read, though it does for write, because of a file type restriction in splice_direct_to_actor(), which I'll address separately.] Cc: Al Viro Signed-off-by: Jason A. Donenfeld commit 22b0a222af4df8ee9bb8e07013ab44da9511b047 Author: Jens Axboe Date: Thu May 19 17:43:15 2022 -0600 random: convert to using fops->write_iter() Now that the read side has been converted to fix a regression with splice, convert the write side as well to have some symmetry in the interface used (and help deprecate ->write()). Signed-off-by: Jens Axboe [Jason: cleaned up random_ioctl a bit, require full writes in RNDADDENTROPY since it's crediting entropy, simplify control flow of write_pool(), and incorporate suggestions from Al.] Cc: Al Viro Signed-off-by: Jason A. Donenfeld commit 1b388e7765f2eaa137cf5d92b47ef5925ad83ced Author: Jens Axboe Date: Thu May 19 17:31:36 2022 -0600 random: convert to using fops->read_iter() This is a pre-requisite to wiring up splice() again for the random and urandom drivers. It also allows us to remove the INT_MAX check in getrandom(), because import_single_range() applies capping internally. Signed-off-by: Jens Axboe [Jason: rewrote get_random_bytes_user() to simplify and also incorporate additional suggestions from Al.] Cc: Al Viro Signed-off-by: Jason A. Donenfeld commit 3d593b6e80ad2c911b5645af28d83eabb96e7c1b Author: Fabio Baltieri Date: Thu Apr 28 10:04:19 2022 +0000 pwm: pwm-cros-ec: Add channel type support Add support for EC_PWM_TYPE_DISPLAY_LIGHT and EC_PWM_TYPE_KB_LIGHT pwm types to the PWM cros_ec_pwm driver. This allows specifying one of these PWM channel by functionality, and let the EC firmware pick the correct channel, thus abstracting the hardware implementation from the kernel driver. To use it, define the node with the "google,cros-ec-pwm-type" compatible. Signed-off-by: Fabio Baltieri Reviewed-by: Tzung-Bi Shih Signed-off-by: Thierry Reding commit a48d66d87274b7ec538cdf82abc8d3ebf4bf0363 Author: Fabio Baltieri Date: Thu Apr 28 10:04:20 2022 +0000 dt-bindings: google,cros-ec-pwm: Add the new -type compatible Update google,cros-ec-pwm node documentation to mention the google,cros-ec-pwm-type compatible as a valid alternative. Signed-off-by: Fabio Baltieri Reviewed-by: Rob Herring Signed-off-by: Thierry Reding commit 84d0940454a3bca6c7c59cf16b6de2f173e81a11 Author: Fabio Baltieri Date: Thu Apr 28 10:04:18 2022 +0000 dt-bindings: Add mfd/cros_ec definitions Add a dt-bindings include file for cros_ec devicetree definition, define a pair of special purpose PWM channels in it. Signed-off-by: Fabio Baltieri Acked-by: Rob Herring Signed-off-by: Thierry Reding commit c71159648c3cf0f7127ddc0bdf3eb4d7885210df Author: Janis Schoetterl-Glausch Date: Thu May 12 15:10:18 2022 +0200 KVM: s390: selftest: Test suppression indication on key prot exception Check that suppression is not indicated on injection of a key checked protection exception caused by a memop after it already modified guest memory, as that violates the definition of suppression. Signed-off-by: Janis Schoetterl-Glausch Reviewed-by: Christian Borntraeger Link: https://lore.kernel.org/r/20220512131019.2594948-3-scgl@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Janosch Frank commit c783631b0bffe6060113ff0aafe5fdbd71bea793 Author: Janis Schoetterl-Glausch Date: Thu May 12 15:10:17 2022 +0200 KVM: s390: Don't indicate suppression on dirtying, failing memop If user space uses a memop to emulate an instruction and that memop fails, the execution of the instruction ends. Instruction execution can end in different ways, one of which is suppression, which requires that the instruction execute like a no-op. A writing memop that spans multiple pages and fails due to key protection may have modified guest memory, as a result, the likely correct ending is termination. Therefore, do not indicate a suppressing instruction ending in this case. Signed-off-by: Janis Schoetterl-Glausch Reviewed-by: Christian Borntraeger Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20220512131019.2594948-2-scgl@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Janosch Frank commit cbac924200b838cfb8d8b1415113d788089dc50b Author: Steffen Eiden Date: Tue May 10 14:47:24 2022 +0000 selftests: drivers/s390x: Add uvdevice tests Adds some selftests to test ioctl error paths of the uv-uapi. The Kconfig S390_UV_UAPI must be selected and the Ultravisor facility must be available. The test can be executed by non-root, however, the uvdevice special file /dev/uv must be accessible for reading and writing which may imply root privileges. ./test-uv-device TAP version 13 1..6 # Starting 6 tests from 3 test cases. # RUN uvio_fixture.att.fault_ioctl_arg ... # OK uvio_fixture.att.fault_ioctl_arg ok 1 uvio_fixture.att.fault_ioctl_arg # RUN uvio_fixture.att.fault_uvio_arg ... # OK uvio_fixture.att.fault_uvio_arg ok 2 uvio_fixture.att.fault_uvio_arg # RUN uvio_fixture.att.inval_ioctl_cb ... # OK uvio_fixture.att.inval_ioctl_cb ok 3 uvio_fixture.att.inval_ioctl_cb # RUN uvio_fixture.att.inval_ioctl_cmd ... # OK uvio_fixture.att.inval_ioctl_cmd ok 4 uvio_fixture.att.inval_ioctl_cmd # RUN attest_fixture.att_inval_request ... # OK attest_fixture.att_inval_request ok 5 attest_fixture.att_inval_request # RUN attest_fixture.att_inval_addr ... # OK attest_fixture.att_inval_addr ok 6 attest_fixture.att_inval_addr # PASSED: 6 / 6 tests passed. # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Steffen Eiden Acked-by: Janosch Frank Message-Id: <20220510144724.3321985-3-seiden@linux.ibm.com> Link: https://lore.kernel.org/kvm/20220510144724.3321985-3-seiden@linux.ibm.com/ Signed-off-by: Janosch Frank commit 4689752c79fa30e91b49b39a9fba93c4d1f3e20c Author: Steffen Eiden Date: Mon May 16 11:33:35 2022 +0000 drivers/s390/char: Add Ultravisor io device This patch adds a new miscdevice to expose some Ultravisor functions to userspace. Userspace can send IOCTLs to the uvdevice that will then emit a corresponding Ultravisor Call and hands the result over to userspace. The uvdevice is available if the Ultravisor Call facility is present. Userspace can call the Retrieve Attestation Measurement Ultravisor Call using IOCTLs on the uvdevice. The uvdevice will do some sanity checks first. Then, copy the request data to kernel space, build the UVCB, perform the UV call, and copy the result back to userspace. Signed-off-by: Steffen Eiden Reviewed-by: Janosch Frank Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/kvm/20220516113335.338212-1-seiden@linux.ibm.com/ Message-Id: <20220516113335.338212-1-seiden@linux.ibm.com> Signed-off-by: Janosch Frank (whitespace and tristate fixes, pick) commit 80a22fde803af6f390be49ee5ced6ee75595ba05 Author: Uwe Kleine-König Date: Tue May 17 17:05:55 2022 +0200 pwm: Document that the pinstate of a disabled PWM isn't reliable Some (most?) drivers emit the inactive state when the PWM is disabled. However there are exceptions, so document that a consumer better doesn't depend on this behaviour. Some known exceptions: - imx27 emits 0 independent of the configured polarity - mxs just drives the output to the last emitted state. - iqs620a makes the output tristated on disable, so an external pull-down would be required. Signed-off-by: Uwe Kleine-König Acked-by: Alexander Stein Signed-off-by: Thierry Reding commit a1bbf823e5e9178ec2f70dd52345fd1a57efe145 Author: Uwe Kleine-König Date: Tue May 17 22:07:09 2022 +0200 pwm: twl-led: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit c449a8ca5ea4da2465e7b399ce18e5c5bc824c4f Author: Uwe Kleine-König Date: Sun May 8 11:40:32 2022 +0200 pwm: lpc18xx: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This pushes a variant of pwm_apply_legacy into the driver that was slightly simplified because the .set_polarity callback was a noop. There is no change in behavior. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 758de66f4bd2cac2b1d71db917c65c3d611d4e74 Author: Uwe Kleine-König Date: Sat May 7 10:43:37 2022 +0200 pwm: mediatek: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Thierry Reding commit 5fa3b87fe8fb1ce941c6418539f7b8062c0dea9c Author: Uwe Kleine-König Date: Sat May 7 10:29:01 2022 +0200 pwm: lpc32xx: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit fd3ddd4355c0e5388b40d48321e2e834393a4912 Author: Uwe Kleine-König Date: Fri May 6 18:48:06 2022 +0200 pwm: tegra: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 57c95faabf094192049bffa5599ae6ab5ff88edf Author: Uwe Kleine-König Date: Fri May 6 16:15:35 2022 +0200 pwm: stmpe: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b2e60b32b4fe5da4cf7fedd976416b5f47f62332 Author: Uwe Kleine-König Date: Fri May 6 16:09:52 2022 +0200 pwm: sti: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). This just pushed a variant of pwm_apply_legacy() into the driver that was slightly simplified because the driver doesn't provide a .set_polarity() callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit cb696e74892b266bd7e03137b5e5c1c4e92bf2ea Author: AngeloGioacchino Del Regno Date: Tue May 3 12:54:04 2022 +0200 pwm: pwm-mediatek: Add support for MediaTek Helio X10 MT6795 The MediaTek Helio X10 MT6795 SoC has 7 PWMs: add a compatible string to use the right match data. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b76160954cb0fc8b4a389e54daf22a87d4f44fbe Author: AngeloGioacchino Del Regno Date: Tue May 3 12:54:05 2022 +0200 dt-bindings: pwm: pwm-mediatek: Add documentation for MT6795 SoC Add binding documentation for the MT6795 Helio X10 SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 9cf62d91e4b78d8165e68aab3f8041b6bc3a0874 Author: Tetsuo Handa Date: Fri May 6 22:50:13 2022 +0900 RDMA/mlx4: Avoid flush_scheduled_work() usage Flushing system-wide workqueues is dangerous and will be forbidden. Replace system_wq with local cm_wq. Link: https://lore.kernel.org/r/22f7183b-cc16-5a34-e879-7605f5efc6e6@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Signed-off-by: Jason Gunthorpe commit 8c193f4714df136a6747fb66f4218134771092be Author: Uwe Kleine-König Date: Mon Apr 25 15:22:44 2022 +0200 pwm: tegra: Optimize period calculation Dividing by the result of a division looses precision because the result is rounded twice. E.g. with clk_rate = 48000000 and period = 32760033 the following numbers result: rate = pc->clk_rate >> PWM_DUTY_WIDTH = 187500 hz = DIV_ROUND_CLOSEST_ULL(100ULL * NSEC_PER_SEC, period_ns) = 3052 rate = DIV_ROUND_CLOSEST_ULL(100ULL * rate, hz) = 6144 The exact result would be 6142.5061875 and (apart from rounding) this is found by using a single division. As a side effect is also a tad cheaper to calculate. Also using clk_rate >> PWM_DUTY_WIDTH looses precision. Consider for example clk_rate = 47999999 and period = 106667: mul_u64_u64_div_u64(pc->clk_rate >> PWM_DUTY_WIDTH, period_ns, NSEC_PER_SEC) = 19 mul_u64_u64_div_u64(pc->clk_rate, period_ns, NSEC_PER_SEC << PWM_DUTY_WIDTH) = 20 (The exact result is 20.000062083332033.) With this optimizations also switch from round-closest to round-down for the period calculation. Given that the calculations were non-optimal for quite some time now with variations in both directions which nobody reported as a problem, this is the opportunity to align the driver's behavior to the requirements of new drivers. This has several upsides: - Implementation is easier as there are no round-nearest variants of mul_u64_u64_div_u64(). - Requests for too small periods are now consistently refused. This was kind of arbitrary before, where period_ns < min_period_ns was refused, but in some cases min_period_ns isn't actually implementable and then values between min_period_ns and the actual minimum were rounded up to the actual minimum. Note that the duty_cycle calculation isn't using the usual round-down approach yet. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 615f4e84461b71e5fed01d9f6d9d98ef3dd1d452 Author: Uwe Kleine-König Date: Wed Apr 20 14:12:40 2022 +0200 pwm: renesas-tpu: Improve precision of period and duty_cycle calculation Dividing by the result of a division looses precision. Consider for example clk_rate = 33000000 and period_ns = 500001. Then clk_rate / (NSEC_PER_SEC / period_ns) has the exact value 16500.033, but in C this evaluates to 16508. It gets worse for even bigger values of period_ns, so with period_ns = 500000001, the exact result is 16500000.033 while in C we get 33000000. For that reason use clk_rate * period_ns / NSEC_PER_SEC instead which doesn't suffer from this problem. To ensure this doesn't overflow add a safeguard check for clk_rate. Note that duty > period can never happen, so the respective check can be dropped. Incidentally this fixes a division by zero if period_ns > NSEC_PER_SEC. Another side effect is that values bigger than INT_MAX for period and duty_cyle are not wrongly discarded any more. Fixes: 99b82abb0a35 ("pwm: Add Renesas TPU PWM driver") Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Reding commit 3c173376efc461dc670b02ba2846c2a533491104 Author: Uwe Kleine-König Date: Wed Apr 20 14:12:39 2022 +0200 pwm: renesas-tpu: Improve maths to compute register settings The newly computed register values are intended to exactly match the previously computed values. The main improvement is that the prescaler is computed without a loop that involves two divisions in each step. This uses the fact, that prescalers[i] = 1 << (2 * i). Assuming a moderately smart compiler, the needed number of divisions for the case where the requested period is too big, is reduced from 5 to 2. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Reding commit 208ab8676b9c787b4285364fcb52a159f94b861d Author: Uwe Kleine-König Date: Wed Apr 20 14:12:38 2022 +0200 pwm: renesas-tpu: Rename variables to match the usual naming The driver used "pwm" for struct tpu_pwm_device pointers. This name is usually only used for struct pwm_device pointers which this driver calls "_pwm". So rename to the driver data pointers to "tpd" which then allows to drop the underscore from "_pwm". Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Reding commit ec00cd5e63f05461ab48128775c73c851c3c2b18 Author: Uwe Kleine-König Date: Wed Apr 20 14:12:37 2022 +0200 pwm: renesas-tpu: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). As pwm->state might not be updated in tpu_pwm_apply() before calling tpu_pwm_config(), an additional parameter is needed for tpu_pwm_config() to not change the implemented logic. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Reding commit ff4bcd56c0495dd37f9e843a6aa0682abd7fae37 Author: Uwe Kleine-König Date: Wed Apr 20 14:12:36 2022 +0200 pwm: renesas-tpu: Make use of devm functions This simplifies an error path in .probe() and allows to drop the .remove() function. Reviewed-by: Geert Uytterhoeven Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 6eb3af76ade388329a6c87ba41d38000184ae4e8 Author: Uwe Kleine-König Date: Wed Apr 20 14:12:35 2022 +0200 pwm: renesas-tpu: Make use of dev_err_probe() The added benefit is that the error code is mentioned in the error message and its usage is a bit more compact than open coding it. This also improves behaviour in case devm_clk_get() returns -EPROBE_DEFER. While touching this code, consistently start error messages with upper case. Reviewed-by: Geert Uytterhoeven Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit e0e14cdff31d326f81e0edbd5140f788c870756c Author: Kan Liang Date: Wed May 18 07:39:00 2022 -0700 perf parse-events: Move slots event for the hybrid platform too The commit 94dbfd6781a0e87b ("perf parse-events: Architecture specific leader override") introduced a feature to reorder the slots event to fulfill the restriction of the perf metrics topdown group. But the feature doesn't work on the hybrid machine. $ perf stat -e "{cpu_core/instructions/,cpu_core/slots/,cpu_core/topdown-retiring/}" -a sleep 1 Performance counter stats for 'system wide': cpu_core/instructions/ cpu_core/slots/ cpu_core/topdown-retiring/ 1.002871801 seconds time elapsed A hybrid platform has a different PMU name for the core PMUs, while current perf hard code the PMU name "cpu". Introduce a new function to check whether the system supports the perf metrics feature. The result is cached for the future usage. For X86, the core PMU name always has "cpu" prefix. With the patch: $ perf stat -e "{cpu_core/instructions/,cpu_core/slots/,cpu_core/topdown-retiring/}" -a sleep 1 Performance counter stats for 'system wide': 76,337,010 cpu_core/slots/ 10,416,809 cpu_core/instructions/ 11,692,372 cpu_core/topdown-retiring/ 1.002805453 seconds time elapsed Reviewed-by: Ian Rogers Signed-off-by: Kan Liang Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220518143900.1493980-5-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e7d1374ed5cb346efd9b3df03814dbc0767adb4e Author: Kan Liang Date: Wed May 18 07:38:59 2022 -0700 perf parse-events: Support different format of the topdown event name The evsel->name may have a different format for a topdown event, a pure topdown name (e.g., topdown-fe-bound), or a PMU name + a topdown name (e.g., cpu/topdown-fe-bound/). The cpu/topdown-fe-bound/ kind format isn't supported by the arch_evlist__leader(). This format is a very common format for a hybrid platform, which requires specifying the PMU name for each event. Without the patch, $ perf stat -e '{instructions,slots,cpu/topdown-fe-bound/}' -a sleep 1 Performance counter stats for 'system wide': instructions slots cpu/topdown-fe-bound/ 1.003482041 seconds time elapsed Some events weren't counted. Try disabling the NMI watchdog: echo 0 > /proc/sys/kernel/nmi_watchdog perf stat ... echo 1 > /proc/sys/kernel/nmi_watchdog The events in group usually have to be from the same PMU. Try reorganizing the group. With the patch, $ perf stat -e '{instructions,slots,cpu/topdown-fe-bound/}' -a sleep 1 Performance counter stats for 'system wide': 157,383,996 slots 25,011,711 instructions 27,441,686 cpu/topdown-fe-bound/ 1.003530890 seconds time elapsed Fixes: bc355822f0d9623b ("perf parse-events: Move slots only with topdown") Reviewed-by: Ian Rogers Signed-off-by: Kan Liang Cc: Adrian Hunter Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220518143900.1493980-4-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e8f4f794d7047dd36f090f44f12cd645fba204d2 Author: Kan Liang Date: Wed May 18 07:38:58 2022 -0700 perf stat: Always keep perf metrics topdown events in a group If any member in a group has a different cpu mask than the other members, the current perf stat disables group. when the perf metrics topdown events are part of the group, the below error will be triggered. $ perf stat -e "{slots,topdown-retiring,uncore_imc_free_running_0/dclk/}" -a sleep 1 WARNING: grouped events cpus do not match, disabling group: anon group { slots, topdown-retiring, uncore_imc_free_running_0/dclk/ } Performance counter stats for 'system wide': 141,465,174 slots topdown-retiring 1,605,330,334 uncore_imc_free_running_0/dclk/ The perf metrics topdown events must always be grouped with a slots event as leader. Factor out evsel__remove_from_group() to only remove the regular events from the group. Remove evsel__must_be_in_group(), since no one use it anymore. With the patch, the topdown events aren't broken from the group for the splitting. $ perf stat -e "{slots,topdown-retiring,uncore_imc_free_running_0/dclk/}" -a sleep 1 WARNING: grouped events cpus do not match, disabling group: anon group { slots, topdown-retiring, uncore_imc_free_running_0/dclk/ } Performance counter stats for 'system wide': 346,110,588 slots 124,608,256 topdown-retiring 1,606,869,976 uncore_imc_free_running_0/dclk/ 1.003877592 seconds time elapsed Fixes: a9a1790247bdcf3b ("perf stat: Ensure group is defined on top of the same cpu mask") Signed-off-by: Kan Liang Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220518143900.1493980-3-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 39d5f412da84784bcc7f39ed49e55376be526fc7 Author: Kan Liang Date: Wed May 18 07:38:57 2022 -0700 perf evsel: Fixes topdown events in a weak group for the hybrid platform The patch ("perf evlist: Keep topdown counters in weak group") fixes the perf metrics topdown event issue when the topdown events are in a weak group on a non-hybrid platform. However, it doesn't work for the hybrid platform. $./perf stat -e '{cpu_core/slots/,cpu_core/topdown-bad-spec/, cpu_core/topdown-be-bound/,cpu_core/topdown-fe-bound/, cpu_core/topdown-retiring/,cpu_core/branch-instructions/, cpu_core/branch-misses/,cpu_core/bus-cycles/,cpu_core/cache-misses/, cpu_core/cache-references/,cpu_core/cpu-cycles/,cpu_core/instructions/, cpu_core/mem-loads/,cpu_core/mem-stores/,cpu_core/ref-cycles/, cpu_core/cache-misses/,cpu_core/cache-references/}:W' -a sleep 1 Performance counter stats for 'system wide': 751,765,068 cpu_core/slots/ (84.07%) cpu_core/topdown-bad-spec/ cpu_core/topdown-be-bound/ cpu_core/topdown-fe-bound/ cpu_core/topdown-retiring/ 12,398,197 cpu_core/branch-instructions/ (84.07%) 1,054,218 cpu_core/branch-misses/ (84.24%) 539,764,637 cpu_core/bus-cycles/ (84.64%) 14,683 cpu_core/cache-misses/ (84.87%) 7,277,809 cpu_core/cache-references/ (77.30%) 222,299,439 cpu_core/cpu-cycles/ (77.28%) 63,661,714 cpu_core/instructions/ (84.85%) 0 cpu_core/mem-loads/ (77.29%) 12,271,725 cpu_core/mem-stores/ (77.30%) 542,241,102 cpu_core/ref-cycles/ (84.85%) 8,854 cpu_core/cache-misses/ (76.71%) 7,179,013 cpu_core/cache-references/ (76.31%) 1.003245250 seconds time elapsed A hybrid platform has a different PMU name for the core PMUs, while the current perf hard code the PMU name "cpu". The evsel->pmu_name can be used to replace the "cpu" to fix the issue. For a hybrid platform, the pmu_name must be non-NULL. Because there are at least two core PMUs. The PMU has to be specified. For a non-hybrid platform, the pmu_name may be NULL. Because there is only one core PMU, "cpu". For a NULL pmu_name, we can safely assume that it is a "cpu" PMU. In case other PMUs also define the "slots" event, checking the PMU type as well. With the patch, $ perf stat -e '{cpu_core/slots/,cpu_core/topdown-bad-spec/, cpu_core/topdown-be-bound/,cpu_core/topdown-fe-bound/, cpu_core/topdown-retiring/,cpu_core/branch-instructions/, cpu_core/branch-misses/,cpu_core/bus-cycles/,cpu_core/cache-misses/, cpu_core/cache-references/,cpu_core/cpu-cycles/,cpu_core/instructions/, cpu_core/mem-loads/,cpu_core/mem-stores/,cpu_core/ref-cycles/, cpu_core/cache-misses/,cpu_core/cache-references/}:W' -a sleep 1 Performance counter stats for 'system wide': 766,620,266 cpu_core/slots/ (84.06%) 73,172,129 cpu_core/topdown-bad-spec/ # 9.5% bad speculation (84.06%) 193,443,341 cpu_core/topdown-be-bound/ # 25.0% backend bound (84.06%) 403,940,929 cpu_core/topdown-fe-bound/ # 52.3% frontend bound (84.06%) 102,070,237 cpu_core/topdown-retiring/ # 13.2% retiring (84.06%) 12,364,429 cpu_core/branch-instructions/ (84.03%) 1,080,124 cpu_core/branch-misses/ (84.24%) 564,120,383 cpu_core/bus-cycles/ (84.65%) 36,979 cpu_core/cache-misses/ (84.86%) 7,298,094 cpu_core/cache-references/ (77.30%) 227,174,372 cpu_core/cpu-cycles/ (77.31%) 63,886,523 cpu_core/instructions/ (84.87%) 0 cpu_core/mem-loads/ (77.31%) 12,208,782 cpu_core/mem-stores/ (77.31%) 566,409,738 cpu_core/ref-cycles/ (84.87%) 23,118 cpu_core/cache-misses/ (76.71%) 7,212,602 cpu_core/cache-references/ (76.29%) 1.003228667 seconds time elapsed Signed-off-by: Kan Liang Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220518143900.1493980-2-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 549f39a58acfe4752c02dc3151df79292de1f3df Author: Tetsuo Handa Date: Thu May 5 15:07:25 2022 +0900 IB/isert: Avoid flush_scheduled_work() usage Flushing system-wide workqueues is dangerous and will be forbidden. Replace system_wq with local isert_login_wq. Link: https://lore.kernel.org/r/fbe5e9a8-0110-0c22-b7d6-74d53948d042@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reviewed-by: Sagi Grimberg Signed-off-by: Jason Gunthorpe commit 7b923e67a4a76b8e0d7f5eb7688e4546fd9954bc Author: Andy Shevchenko Date: Fri May 20 00:26:45 2022 +0300 pinctrl: intel: Fix kernel doc format, i.e. add return sections Kernel doc validator is not happy: pinctrl-intel.c:865: warning: No description found for return value of 'intel_gpio_to_pin' pinctrl-intel.c:904: warning: No description found for return value of 'intel_pin_to_gpio' 2 warnings Add return sections to the kernel documentation of the above mentioned functions. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg commit daa986d5f8d8871e6691b0fe54375f263c754d04 Author: Uwe Kleine-König Date: Mon Mar 28 09:34:34 2022 +0200 pwm: samsung: Implement .apply() callback To eventually get rid of all legacy drivers convert this driver to the modern world implementing .apply(). The size check for state->period is moved to .apply() to make sure that the values of state->duty_cycle and state->period are passed to pwm_samsung_config without change while they are discarded to int. Signed-off-by: Uwe Kleine-König Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 762c4e7fce551fbd617ae79e55fc8d9850627b8f Author: Wan Jiabing Date: Fri Apr 8 16:30:07 2022 +0800 pwm: sifive: Simplify if-if to if-else Use if and else instead of if(A) and if (!A). Signed-off-by: Wan Jiabing Signed-off-by: Thierry Reding commit e5cd20e0d6713138444cc3f3f982712cf9a36143 Merge: f7a344468105e 0683532999ab3 Author: Mark Brown Date: Fri May 20 14:56:35 2022 +0100 ASoC: SOF: Introduce generic (in)firmware tracing infrastructure Merge series from Peter Ujfalusi From the kernel point of view there are only few ops that needs to be exposed: Hi, SOF is using dma-trace (or dtrace) as a firmware tracing method, which is only supported with IPC3 and it is not applicable for IPC4. Currently the dtrace is 'open managed' regardless of IPC version (we do force disable it for IPC4, but the dtrace calls remain in place). From the kernel point of view there are only few ops that needs to be exposed by the firmware tracing support and everything else is IPC private, should not be known by the core. This series converts the current dma-trace as ipc3 specific firmware tracing sub-component and moves all private data out from generic code. Regards, Peter --- Peter Ujfalusi (8): ASoC: SOF: Introduce IPC independent ops for firmware tracing support ASoC: SOF: Rename dtrace_is_supported flag to fw_trace_is_supported ASoC: SOF: Clone the trace code to ipc3-dtrace as fw_tracing implementation ASoC: SOF: Switch to IPC generic firmware tracing ASoC: SOF: ipc3-dtrace: Move host ops wrappers from generic header to private ASoC: SOF: Modify the host trace_init parameter list to include dmab ASoC: SOF: Introduce opaque storage of private data for firmware tracing ASoC: SOF: ipc3-dtrace: Move dtrace related variables local from sof_dev sound/soc/sof/Makefile | 1 + sound/soc/sof/amd/acp-trace.c | 4 +- sound/soc/sof/amd/acp.h | 2 +- sound/soc/sof/core.c | 13 +- sound/soc/sof/debug.c | 2 +- sound/soc/sof/intel/hda-dsp.c | 2 +- sound/soc/sof/intel/hda-trace.c | 4 +- sound/soc/sof/intel/hda.h | 2 +- sound/soc/sof/ipc.c | 6 + sound/soc/sof/ipc3-dtrace.c | 649 ++++++++++++++++++++++++++++++++ sound/soc/sof/ipc3-priv.h | 38 ++ sound/soc/sof/ipc3.c | 3 +- sound/soc/sof/ops.c | 2 +- sound/soc/sof/ops.h | 26 -- sound/soc/sof/pm.c | 8 +- sound/soc/sof/sof-priv.h | 53 +-- sound/soc/sof/trace.c | 621 ++---------------------------- 17 files changed, 767 insertions(+), 669 deletions(-) create mode 100644 sound/soc/sof/ipc3-dtrace.c -- 2.36.1 commit af583852d2efcbc76ce68ac8d65126d4b0c65067 Author: Dipen Patel Date: Thu May 12 10:50:11 2022 -0700 dt-bindings: Renamed hte directory to timestamp Renamed hte dt binding directory to timestamp according review comment. Addressed minor comment about having HTE acronym first in the common dt binding document. The change reflects above renaming in MAINTAINERS files too. Signed-off-by: Dipen Patel Reviewed-by: Linus Walleij Acked-by: Rob Herring Signed-off-by: Thierry Reding commit 348b10b075f35828a21bf928edf7f6b1737b1840 Author: Dan Carpenter Date: Fri May 6 17:54:31 2022 +0300 hte: Uninitialized variable in hte_ts_get() The "free_name" variable is sometimes used without being initialized. Fixes: 31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem") Signed-off-by: Dan Carpenter Acked-by: Dipen Patel Signed-off-by: Thierry Reding commit 8ad9f577551f5d5cfbac1ac6b4e85c026ceb024e Merge: da14f237ceef0 78288665b5d01 Author: Jens Axboe Date: Fri May 20 06:56:32 2022 -0600 Merge tag 'nvme-5.19-2022-05-19' of git://git.infradead.org/nvme into for-5.19/drivers Pull NVMe updates from Christoph: "nvme updates for Linux 5.19 - set non-mdts limits in nvme_scan_work (Chaitanya Kulkarni) - add support for TP4084 - Time-to-Ready Enhancements (me)" * tag 'nvme-5.19-2022-05-19' of git://git.infradead.org/nvme: nvme: set non-mdts limits in nvme_scan_work nvme: add support for TP4084 - Time-to-Ready Enhancements commit f7a344468105ef8c54086dfdc800e6f5a8417d3e Author: Alexey Khoroshilov Date: Fri May 20 01:31:26 2022 +0300 ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() Validation of signed input should be done before casting to unsigned int. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexey Khoroshilov Suggested-by: Mark Brown Fixes: 2fbe467bcbfc ("ASoC: max98090: Reject invalid values in custom control put()") Link: https://lore.kernel.org/r/1652999486-29653-1-git-send-email-khoroshilov@ispras.ru Signed-off-by: Mark Brown commit affa9983e7cbac8cbe2596975efacdbdf0eb18e9 Author: Shuming Fan Date: Fri May 20 17:02:05 2022 +0800 ASoC: rt1308-sdw: add the default value of register 0xc320 The driver missed the default value of register 0xc320. This patch adds that default value to avoid the error messages when the driver went to suspend mode already. BugLink: https://github.com/thesofproject/linux/issues/3651 Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20220520090205.25857-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 58e5bdeb9c2b06895e723c0b1e670f54510ff782 Author: Kanchan Joshi Date: Fri May 20 14:36:30 2022 +0530 nvme: enable uring-passthrough for admin commands Add two new opcodes that userspace can use for admin commands: NVME_URING_CMD_ADMIN : non-vectroed NVME_URING_CMD_ADMIN_VEC : vectored variant Wire up support when these are issued on controller node(/dev/nvmeX). Signed-off-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220520090630.70394-3-joshi.k@samsung.com Signed-off-by: Jens Axboe commit 00fc2eeb15acc7f7e8713edc6d4d9855936226cb Author: Kanchan Joshi Date: Fri May 20 14:36:29 2022 +0530 nvme: helper for uring-passthrough checks Factor out a helper consolidating the error checks, and fix typo in a comment too. This is in preparation to support admin commands on this path. Signed-off-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220520090630.70394-2-joshi.k@samsung.com Signed-off-by: Jens Axboe commit 96232c7d4f847a5e597177236159e6b32ccf60e4 Author: Mickaël Salaün Date: Fri May 6 18:01:03 2022 +0200 clang-format: Update to clang-format >= 6 We get new interesting formating with clang-format greater or equal to 6 as stated in the removed comments. Miguel Ojeda suggested to even move the minimal clang-format version to 11, which is the minimum LLVM supported at the moment [1]. Automatically updated with: sed -i 's/^\(\s*\)#\(\S*\s\+\S*\) # Unknown to clang-format.*/\1\2/' .clang-format Link: https://lore.kernel.org/r/CANiq72nLOfmEt-CZBmm2ouEB_x6Jm9ggDVFCVJxYxKw7O0LTzQ@mail.gmail.com [1] Cc: Miguel Ojeda Cc: Tom Rix Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506160106.522341-3-mic@digikod.net Signed-off-by: Miguel Ojeda commit 49bb63a2616a54eac998c1e7e2dc6679a8c2e772 Author: Mickaël Salaün Date: Fri May 6 18:01:02 2022 +0200 clang-format: Extend the for_each list with tools/ Add tools/ to the shell fragment generating the for_each list and update it. This is useful to format files in the tools directory (e.g. selftests) with the same coding style as the kernel. Cc: Miguel Ojeda Cc: Tom Rix Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220506160106.522341-2-mic@digikod.net [Reworded and rebased on top of previous commits] Signed-off-by: Miguel Ojeda commit 6c38ca03406edf905c7b66ffdc8e9ea6d09b2b44 Author: Chris Morgan Date: Thu May 19 11:17:31 2022 -0500 dt-bindings: mfd: rk808: Convert bindings to yaml Convert the rk808 bindings into yaml format. clock-output-names varies in maxItems depending on whether or not the clock-cells is 0 or 1. For the rk805, rk809, and rk817. This preserves behavior with the existing driver handling setting the clock for these specific PMICs. When this driver is corrected and the devicetrees updated this logic can be removed (since the rk805, rk808, and rk817 only have one actual clock). Note this patch was previously sent as a series, all of the patches in the series except this one have been committed to mainline. Signed-off-by: Chris Morgan Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220519161731.1168-1-macroalpha82@gmail.com commit 72e14aa9f884807e7059254a0373929b09ab56ad Author: Miguel Ojeda Date: Fri May 20 14:06:51 2022 +0200 clang-format: Simplify command with `sort -u` Signed-off-by: Miguel Ojeda commit 43120879191cb3b13e30e3fadd424bc5bbcf7846 Author: Miguel Ojeda Date: Fri May 20 13:53:07 2022 +0200 clang-format: Use POSIX locale for `sort` This avoids differences when different people run the command, which is relevant for our use case, e.g.: $ LC_ALL=en_US.UTF-8 sort test ata_for_each_link __ata_qc_for_each ata_qc_for_each $ LC_ALL=C sort test __ata_qc_for_each ata_for_each_link ata_qc_for_each Link: https://lore.kernel.org/lkml/CANiq72=7=ZpAObWRmposOmnyZ8XR_eNHCBtA3bu3fusmcPUwDA@mail.gmail.com/ Signed-off-by: Miguel Ojeda commit 2c51d0d88020b4d3c9bbe7d9df2796b2c2ce05b8 Merge: e6828be5edcfe 6a2277a0ebe71 Author: Miquel Raynal Date: Fri May 20 13:59:25 2022 +0200 Merge tag 'nand/for-5.19' into mtd/next NAND core: * Print offset instead of page number for bad blocks Raw NAND controller drivers: * Cadence: Fix possible null-ptr-deref in cadence_nand_dt_probe() * CS553X: simplify the return expression of cs553x_write_ctrl_byte() * Davinci: Remove redundant unsigned comparison to zero * Denali: Use managed device resources * GPMI: - Add large oob bch setting support - Rename the variable ecc_chunk_size - Uninline the gpmi_check_ecc function - Add strict ecc strength check - Refactor BCH geometry settings function * Intel: Fix possible null-ptr-deref in ebu_nand_probe() * MPC5121: Check before clk_disable_unprepare() not needed * Mtk: - MTD_NAND_ECC_MEDIATEK should depend on ARCH_MEDIATEK - Also parse the default nand-ecc-engine property if available - Make mtk_ecc.c a separated module * OMAP ELM: - Convert the bindings to yaml - Describe the bindings for AM64 ELM - Add support for its compatible * Renesas: Use runtime PM instead of the raw clock API and update the bindings accordingly * Rockchip: Check before clk_disable_unprepare() not needed * TMIO: Check return value after calling platform_get_resource() Raw NAND chip driver: * Kioxia: Add support for TH58NVG3S0HBAI4 and TC58NVG0S3HTA00 SPI-NAND chip drivers: * Gigadevice: - Add support for: - GD5FxGM7xExxG - GD5F{2,4}GQ5xExxG - GD5F1GQ5RExxG - GD5FxGQ4xExxG - Fix Quad IO for GD5F1GQ5UExxG * XTX: Add support for XT26G0xA Signed-off-by: Miquel Raynal commit e6828be5edcfea25cd70a2d1de41085c67ef9fa5 Merge: 1fefc8ecb834c c47452194641b Author: Miquel Raynal Date: Fri May 20 13:58:54 2022 +0200 Merge tag 'spi-nor/for-5.19' into mtd/next SPI NOR core changes: - Read back written SR value to make sure the write was done correctly. - Introduce a common function for Read ID that manufacturer drivers can use to verify the Octal DTR switch worked correctly. - Add helpers for read/write any register commands so manufacturer drivers don't open code it every time. - Clarify rdsr dummy cycles documentation. - Add debugfs entry to expose internal flash parameters and state. SPI NOR manufacturer drivers changes: - Add support for Winbond W25Q512NW-IM, and Eon EN25QH256A. - Move spi_nor_write_ear() to Winbond module since only Winbond flashes use it. - Rework Micron and Cypress Octal DTR enable methods to improve readability. - Use the common Read ID function to verify switch to Octal DTR mode for Micron and Cypress flashes. - Skip polling status on volatile register writes for Micron and Cypress flashes since the operation is instant. Signed-off-by: Miquel Raynal commit 882178947bcae5b5b3a1782fe80095c60276c399 Author: Miguel Ojeda Date: Fri May 20 13:47:23 2022 +0200 clang-format: Update with v5.18-rc7's `for_each` macro list Re-run the shell fragment that generated the original list. This brings it up to date, so that the next patches that tweak it further are more clear on what they change. Signed-off-by: Miguel Ojeda commit b6f21d14f1ac1261579b691673a0c823275cbaf8 Author: Chen Zhongjin Date: Fri May 20 08:49:55 2022 +0100 ARM: 9204/2: module: Add all unwind tables when load module For EABI stack unwinding, when loading .ko module the EXIDX sections will be added to a unwind_table list. However not all EXIDX sections are added because EXIDX sections are searched by hardcoded section names. For functions in other sections such as .ref.text or .kprobes.text, gcc generates seprated EXIDX sections (such as .ARM.exidx.ref.text or .ARM.exidx.kprobes.text). These extra EXIDX sections are not loaded, so when unwinding functions in these sections, we will failed with: unwind: Index not found xxx To fix that, I refactor the code for searching and adding EXIDX sections: - Check section type to search EXIDX tables (0x70000001) instead of strcmp() the hardcoded names. Then find the corresponding text sections by their section names. - Add a unwind_table list in module->arch to save their own unwind_table instead of the fixed-lenth array. - Save .ARM.exidx.init.text section ptr, because it should be cleaned after module init. Now all EXIDX sections of .ko can be added correctly. Signed-off-by: Chen Zhongjin Acked-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 8294fec1cab7ae6153525eb68401ed5905921371 Author: Nick Hawkins Date: Wed May 18 14:38:37 2022 +0100 ARM: 9206/1: A9: Add ARM ERRATA 764319 workaround (Updated) Enable the workaround for the 764319 Cortex A-9 erratum. CP14 read accesses to the DBGPRSR and DBGOSLSR registers generate an unexpected Undefined Instruction exception when the DBGSWENABLE external pin is set to 0, even when the CP14 accesses are performed from a privileged mode. The work around catches the exception in a way the kernel does not stop execution with the use of undef_hook. This has been found to effect the HPE GXP SoC. Signed-off-by: Nick Hawkins Reviewed-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit ad12c2f1587c6ec9b52ff226f438955bfae6ad89 Author: Ard Biesheuvel Date: Wed Apr 20 10:06:50 2022 +0100 ARM: 9201/1: spectre-bhb: rely on linker to emit cross-section literal loads The assembler does not permit 'LDR PC, ' when the symbol lives in a different section, which is why we have been relying on rather fragile open-coded arithmetic to load the address of the vector_swi routine into the program counter using a single LDR instruction in the SWI slot in the vector table. The literal was moved to a different section to in commit 19accfd373847 ("ARM: move vector stubs") to ensure that the vector stubs page does not need to be mapped readable for user space, which is the case for the vector page itself, as it carries the kuser helpers as well. So the cross-section literal load is open-coded, and this relies on the address of vector_swi to be at the very start of the vector stubs page, and we won't notice if we got it wrong until booting the kernel and see it break. Fortunately, it was guaranteed to break, so this was fragile but not problematic. Now that we have added two other variants of the vector table, we have 3 occurrences of the same trick, and so the size of our ISA/compiler/CPU validation space has tripled, in a way that may cause regressions to only be observed once booting the image in question on a CPU that exercises a particular vector table. So let's switch to true cross section references, and let the linker fix them up like it fixes up all the other cross section references in the vector page. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit 1290c70d72b2959ba0a4e029edfcb7afa62a5c73 Author: Ard Biesheuvel Date: Wed Apr 20 10:02:43 2022 +0100 ARM: 9200/1: spectre-bhb: avoid cross-subsection jump using a numbered label In order to minimize potential confusion regarding numbered labels appearing in a different order in the assembler output due to the use of subsections, use a named local label to jump back into the vector handler code from the associated loop8 mitigation sequence. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit 892c608a7d7380b9a7c8f0d6aab99b763fd6fd3f Author: Ard Biesheuvel Date: Wed Apr 20 09:57:45 2022 +0100 ARM: 9199/1: spectre-bhb: use local DSB and elide ISB in loop8 sequence The loop8 mitigation for Spectre-BHB only requires a CPU local DSB rather than a systemwide one, which is much more costly. And by the same reasoning as why it is justified to omit the ISB after BPIALL, we can also elide the ISB and rely on the exception return for the context synchronization. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit c4f486f1e7b34b27ec578494a236061b337d50ae Author: Ard Biesheuvel Date: Wed Apr 20 09:55:35 2022 +0100 ARM: 9198/1: spectre-bhb: simplify BPIALL vector macro The BPIALL mitigation for Spectre-BHB adds a single instruction to the handler sequence that doesn't clobber any registers. Given that these sequences are 10 instructions long, they don't fit neatly into a cacheline anyway, so we can simply move that single instruction to the start of the unmitigated one, and rearrange the symbol names accordingly. Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) commit 508074607c7b95b24f0adf633fdf606761bb7824 Author: Ard Biesheuvel Date: Wed Apr 20 09:41:31 2022 +0100 ARM: 9195/1: entry: avoid explicit literal loads ARMv7 has MOVW/MOVT instruction pairs to load symbol addresses into registers without having to rely on literal loads that go via the D-cache. For older cores, we now support a similar arrangement, based on PC-relative group relocations. This means we can elide most literal loads entirely from the entry path, by switching to the ldr_va macro to emit the appropriate sequence depending on the target architecture revision. While at it, switch to the bl_r macro for invoking the right PABT/DABT helpers instead of setting the LR register explicitly, which does not play well with cores that speculate across function returns. Signed-off-by: Ard Biesheuvel Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 952f03316352c606bebef56ba8f9642edbb8e348 Author: Ard Biesheuvel Date: Wed Apr 20 09:38:27 2022 +0100 ARM: 9194/1: assembler: simplify ldr_this_cpu for !SMP builds When CONFIG_SMP is not defined, the CPU offset is always zero, and so we can simplify the sequence to load a per-CPU variable. Signed-off-by: Ard Biesheuvel Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 7719a68b2fa404fa8af6b0b7119a38c406c74858 Author: Wang Kefeng Date: Mon Apr 18 07:07:14 2022 +0100 ARM: 9192/1: amba: fix memory leak in amba_device_try_add() If amba_device_try_add() return error code (not EPROBE_DEFER), memory leak occurred when amba device fails to read periphid. unreferenced object 0xc1c60800 (size 1024): comm "swapper/0", pid 1, jiffies 4294937333 (age 75.200s) hex dump (first 32 bytes): 40 40 db c1 04 08 c6 c1 04 08 c6 c1 00 00 00 00 @@.............. 00 d9 c1 c1 84 6f 38 c1 00 00 00 00 01 00 00 00 .....o8......... backtrace: [<(ptrval)>] kmem_cache_alloc_trace+0x168/0x2b4 [<(ptrval)>] amba_device_alloc+0x38/0x7c [<(ptrval)>] of_platform_bus_create+0x2f4/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_populate+0x70/0xc4 [<(ptrval)>] of_platform_default_populate_init+0xb4/0xcc [<(ptrval)>] do_one_initcall+0x58/0x218 [<(ptrval)>] kernel_init_freeable+0x250/0x29c [<(ptrval)>] kernel_init+0x24/0x148 [<(ptrval)>] ret_from_fork+0x14/0x1c [<00000000>] 0x0 unreferenced object 0xc1db4040 (size 64): comm "swapper/0", pid 1, jiffies 4294937333 (age 75.200s) hex dump (first 32 bytes): 31 63 30 66 30 30 30 30 2e 77 64 74 00 00 00 00 1c0f0000.wdt.... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(ptrval)>] __kmalloc_track_caller+0x19c/0x2f8 [<(ptrval)>] kvasprintf+0x60/0xcc [<(ptrval)>] kvasprintf_const+0x54/0x78 [<(ptrval)>] kobject_set_name_vargs+0x34/0xa8 [<(ptrval)>] dev_set_name+0x40/0x5c [<(ptrval)>] of_device_make_bus_id+0x128/0x1f8 [<(ptrval)>] of_platform_bus_create+0x4dc/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_bus_create+0x380/0x4e8 [<(ptrval)>] of_platform_populate+0x70/0xc4 [<(ptrval)>] of_platform_default_populate_init+0xb4/0xcc [<(ptrval)>] do_one_initcall+0x58/0x218 [<(ptrval)>] kernel_init_freeable+0x250/0x29c [<(ptrval)>] kernel_init+0x24/0x148 [<(ptrval)>] ret_from_fork+0x14/0x1c Fix them by adding amba_device_put() to release device name and amba device. Signed-off-by: Kefeng Wang Signed-off-by: Russell King (Oracle) commit 1f44de0f5e309e8699b569b49a8e89ef4e7527c7 Author: Wang Kefeng Date: Mon Apr 18 07:07:13 2022 +0100 ARM: 9193/1: amba: Add amba_read_periphid() helper Add new amba_read_periphid() helper to simplify error handling. Signed-off-by: Kefeng Wang Signed-off-by: Russell King (Oracle) commit b4ce6dd4de3f75f6ee1751148198beaf4e37bedb Merge: bb94bb86286b3 3a054f90e9550 Author: Mark Brown Date: Fri May 20 12:17:53 2022 +0100 ASoC: SOF: mediatek: add debug dump Merge series from Pierre-Louis Bossart : Add the ability to generate debug dumps on MediaTek SOF implementations. commit bb94bb86286b3560ebb539a84b299ca03141940f Merge: 80b949f332e33 b390c25c6757b Author: Mark Brown Date: Fri May 20 12:17:51 2022 +0100 ASoC: remove two unnecessary gpiolib dependencies Merge series from Pierre-Louis Bossart : Remove two dependencies - issues reported by Intel kernel test bot. commit c796f02162e428b595ff70196dca161ee46b163b Author: Peter Zijlstra Date: Fri May 20 10:38:39 2022 +0200 x86/tdx: Fix RETs in TDX asm Because build-testing is over-rated, fix a few trivial objtool complaints: vmlinux.o: warning: objtool: __tdx_module_call+0x3e: missing int3 after ret vmlinux.o: warning: objtool: __tdx_hypercall+0x6e: missing int3 after ret Fixes: eb94f1b6a70a ("x86/tdx: Add __tdx_module_call() and __tdx_hypercall() helper functions") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220520083839.GR2578@worktop.programming.kicks-ass.net commit 22682a07acc308ef78681572e19502ce8893c4d4 Author: Mikulas Patocka Date: Mon May 16 11:06:36 2022 -0400 objtool: Fix objtool regression on x32 systems Commit c087c6e7b551 ("objtool: Fix type of reloc::addend") failed to appreciate cross building from ILP32 hosts, where 'int' == 'long' and the issue persists. As such, use s64/int64_t/Elf64_Sxword for this field and suffer the pain that is ISO C99 printf formats for it. Fixes: c087c6e7b551 ("objtool: Fix type of reloc::addend") Signed-off-by: Mikulas Patocka [peterz: reword changelog, s/long long/s64/] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/alpine.LRH.2.02.2205161041260.11556@file01.intranet.prod.int.rdu2.redhat.com commit ead165fa1042247b033afad7be4be9b815d04ade Author: Peter Zijlstra Date: Tue May 17 17:42:04 2022 +0200 objtool: Fix symbol creation Nathan reported objtool failing with the following messages: warning: objtool: no non-local symbols !? warning: objtool: gelf_update_symshndx: invalid section index The problem is due to commit 4abff6d48dbc ("objtool: Fix code relocs vs weak symbols") failing to consider the case where an object would have no non-local symbols. The problem that commit tries to address is adding a STB_LOCAL symbol to the symbol table in light of the ELF spec's requirement that: In each symbol table, all symbols with STB_LOCAL binding preced the weak and global symbols. As ``Sections'' above describes, a symbol table section's sh_info section header member holds the symbol table index for the first non-local symbol. The approach taken is to find this first non-local symbol, move that to the end and then re-use the freed spot to insert a new local symbol and increment sh_info. Except it never considered the case of object files without global symbols and got a whole bunch of details wrong -- so many in fact that it is a wonder it ever worked :/ Specifically: - It failed to re-hash the symbol on the new index, so a subsequent find_symbol_by_index() would not find it at the new location and a query for the old location would now return a non-deterministic choice between the old and new symbol. - It failed to appreciate that the GElf wrappers are not a valid disk format (it works because GElf is basically Elf64 and we only support x86_64 atm.) - It failed to fully appreciate how horrible the libelf API really is and got the gelf_update_symshndx() call pretty much completely wrong; with the direct consequence that if inserting a second STB_LOCAL symbol would require moving the same STB_GLOBAL symbol again it would completely come unstuck. Write a new elf_update_symbol() function that wraps all the magic required to update or create a new symbol at a given index. Specifically, gelf_update_sym*() require an @ndx argument that is relative to the @data argument; this means you have to manually iterate the section data descriptor list and update @ndx. Fixes: 4abff6d48dbc ("objtool: Fix code relocs vs weak symbols") Reported-by: Nathan Chancellor Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor Cc: Link: https://lkml.kernel.org/r/YoPCTEYjoPqE4ZxB@hirez.programming.kicks-ass.net commit d936411dc9caeb3edb992e39c33d4d1d81ca8c08 Author: Borislav Petkov Date: Fri May 20 12:12:30 2022 +0200 x86: Remove empty files Remove empty files which were supposed to get removed with the respective commits removing the functionality in them: $ find arch/x86/ -empty arch/x86/lib/mmx_32.c arch/x86/include/asm/fpu/internal.h arch/x86/include/asm/mmx.h Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220520101723.12006-1-bp@alien8.de commit b0dacee202efbf1a5d9f5cdfd82049e8b5b085d2 Merge: ee5354345242c de78657e16f41 8b9ad480bd1dd b11deb2f250fb cae8d1f5e34e5 0d647b33e74f7 42bb5aa043382 fa7e9ecc5e1c1 Author: Joerg Roedel Date: Fri May 20 12:27:17 2022 +0200 Merge branches 'apple/dart', 'arm/mediatek', 'arm/msm', 'arm/smmu', 'ppc/pamu', 'x86/vt-d', 'x86/amd' and 'vfio-notifier-fix' into next commit b11deb2f250fbf841e578e0f3bea3993fdedd0f7 Merge: e3b9bf145cb6a 42226c989789d Author: Joerg Roedel Date: Fri May 20 12:26:49 2022 +0200 Merge tag 'v5.18-rc7' into arm/smmu Linux 5.18-rc7 commit 42bb5aa043382f09bef2cc33b8431be867c70f8e Author: Joerg Roedel Date: Fri May 20 12:22:14 2022 +0200 iommu/amd: Increase timeout waiting for GA log enablement On some systems it can take a long time for the hardware to enable the GA log of the AMD IOMMU. The current wait time is only 0.1ms, but testing showed that it can take up to 14ms for the GA log to enter running state after it has been enabled. Sometimes the long delay happens when booting the system, sometimes only on resume. Adjust the timeout accordingly to not print a warning when hardware takes a longer than usual. There has already been an attempt to fix this with commit 9b45a7738eec ("iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()") But that commit was based on some wrong math and did not fix the issue in all cases. Cc: "D. Ziegfeld" Cc: Jörg-Volker Peetz Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log") Signed-off-by: Joerg Roedel Link: https://lore.kernel.org/r/20220520102214.12563-1-joro@8bytes.org commit b6d261449e6e4ed69ae654e3b4b41c0c416cf2a9 Merge: 805cb5aadc2a8 660e52d651ab7 Author: David S. Miller Date: Fri May 20 11:12:24 2022 +0100 Merge branch 'net-ipa-next' Alex Elder says: ==================== net: ipa: a mix of patches This series includes a mix of things things that are generally minor. The first four are sort of unrelated fixes, and summarizing them here wouldn't be that helpful. The last three together make it so only the "configuration data" we need after initialization is saved for later use. Most such data is used only during driver initialization. But endpoint configuration is needed later, so the last patch saves a copy of that. Eventually we'll want to support reconfiguring endpoints at runtime as well, and this will facilitate that. ==================== Signed-off-by: David S. Miller commit 660e52d651ab7faa20d1ba08ae90a306b023e395 Author: Alex Elder Date: Thu May 19 10:12:17 2022 -0500 net: ipa: save a copy of endpoint default config All elements of the default endpoint configuration are used in the code when programming an endpoint for use. But none of the other configuration data is ever needed once things are initialized. So rather than saving a pointer to *all* of the configuration data, save a copy of only the endpoint configuration portion. This will eventually allow endpoint configuration to be modifiable at runtime. But even before that it means we won't keep a pointer to configuration data after when no longer needed. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit cf4e73a1667e620ef703ff1f86ae96471ffa80f6 Author: Alex Elder Date: Thu May 19 10:12:16 2022 -0500 net: ipa: rename a few endpoint config data types Rename the just-moved data structure types to drop the "_data" suffix, to make it more obvious they are no longer meant to be used just as read-only initialization data. Rename the fields and variables of these types to use "config" instead of "data" in the name. This is another small step meant to facilitate review. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit f0488c540e8a36e515c744a531f27a6e994888d6 Author: Alex Elder Date: Thu May 19 10:12:15 2022 -0500 net: ipa: move endpoint configuration data definitions Move the definitions of the structures defining endpoint-specific configuration data out of "ipa_data.h" and into "ipa_endpoint.h". This is a trivial movement of code without any other change, to prepare for the next few patches. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 75944b040bbcce0fc1d1432787efe8a96b51b595 Author: Alex Elder Date: Thu May 19 10:12:14 2022 -0500 net: ipa: open-code ether_setup() About half of the fields set by the call in ipa_modem_netdev_setup() are overwritten after the call. Instead, just skip the call, and open-code the (other) assignments it makes to the net_device structure fields. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 332ef7c814bdd60f08d0d9013d0e1104798b2d23 Author: Alex Elder Date: Thu May 19 10:12:13 2022 -0500 net: ipa: ignore endianness if there is no header If we program an RX endpoint to have no header (header length is 0), header-related endpoint configuration values are meaningless and are ignored. The only case we support that defines a header is QMAP endpoints. In ipa_endpoint_init_hdr_ext() we set the endianness mask value unconditionally, but it should not be done if there is no header (meaning it is not configured for QMAP). Set the endianness conditionally, and rearrange the logic in that function slightly to avoid testing the qmap flag twice. Delete an incorrect comment in ipa_endpoint_init_aggr(). Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit c9d92cf28c0cda6e3bd76b75e6e343b86075cd2d Author: Alex Elder Date: Thu May 19 10:12:12 2022 -0500 net: ipa: rename a GSI error code The CHANNEL_NOT_RUNNING error condition has been generalized, so rename it to be INCORRECT_CHANNEL_STATE. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit c15f950d149564989aa5a134b42e83e57511e628 Author: Alex Elder Date: Thu May 19 10:12:11 2022 -0500 net: ipa: drop an unneeded transaction reference In gsi_channel_update(), a reference count is taken on the last completed transaction "to keep it from completing" before we give the event back to the hardware. Completion processing for that transaction (and any other "new" ones) will not occur until after this function returns, so there's no risk it completing early. So there's no need to take and drop the additional transaction reference. Use local variables in the call to gsi_evt_ring_doorbell(). Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit ce6565282b3b16fd850c6a676f78c6bc76d0c235 Author: Peter Zijlstra Date: Fri May 20 10:26:04 2022 +0200 x86/entry: Fixup objtool/ibt validation Commit 47f33de4aafb ("x86/sev: Mark the code returning to user space as syscall gap") added a bunch of text references without annotating them, resulting in a spree of objtool complaints: vmlinux.o: warning: objtool: vc_switch_off_ist+0x77: relocation to !ENDBR: entry_SYSCALL_64+0x15c vmlinux.o: warning: objtool: vc_switch_off_ist+0x8f: relocation to !ENDBR: entry_SYSCALL_compat+0xa5 vmlinux.o: warning: objtool: vc_switch_off_ist+0x97: relocation to !ENDBR: .entry.text+0x21ea vmlinux.o: warning: objtool: vc_switch_off_ist+0xef: relocation to !ENDBR: .entry.text+0x162 vmlinux.o: warning: objtool: __sev_es_ist_enter+0x60: relocation to !ENDBR: entry_SYSCALL_64+0x15c vmlinux.o: warning: objtool: __sev_es_ist_enter+0x6c: relocation to !ENDBR: .entry.text+0x162 vmlinux.o: warning: objtool: __sev_es_ist_enter+0x8a: relocation to !ENDBR: entry_SYSCALL_compat+0xa5 vmlinux.o: warning: objtool: __sev_es_ist_enter+0xc1: relocation to !ENDBR: .entry.text+0x21ea Since these text references are used to compare against IP, and are not an indirect call target, they don't need ENDBR so annotate them away. Fixes: 47f33de4aafb ("x86/sev: Mark the code returning to user space as syscall gap") Reported-by: Stephen Rothwell Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220520082604.GQ2578@worktop.programming.kicks-ass.net commit 9c55d99e099bd7aa6b91fce8718505c35d5dfc65 Author: Borislav Petkov Date: Thu May 19 16:59:13 2022 +0200 x86/microcode: Add explicit CPU vendor dependency Add an explicit dependency to the respective CPU vendor so that the respective microcode support for it gets built only when that support is enabled. Reported-by: Randy Dunlap Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/8ead0da9-9545-b10d-e3db-7df1a1f219e4@infradead.org commit fa7e9ecc5e1c1a1e8aa7014b2749b22edc801dd2 Author: Matthew Rosato Date: Thu May 19 14:29:29 2022 -0400 iommu/s390: Tolerate repeat attach_dev calls Since commit 0286300e6045 ("iommu: iommu_group_claim_dma_owner() must always assign a domain") s390-iommu will get called to allocate multiple unmanaged iommu domains for a vfio-pci device -- however the current s390-iommu logic tolerates only one. Recognize that multiple domains can be allocated and handle switching between DMA or different iommu domain tables during attach_dev. Signed-off-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20220519182929.581898-1-mjrosato@linux.ibm.com Signed-off-by: Joerg Roedel commit b154a017c92011d8f71ce804583e5f9c3d90bb9a Author: Shida Zhang Date: Wed May 18 09:36:47 2022 +0800 cgroup: remove the superfluous judgment Remove the superfluous judgment since the function is never called for a root cgroup, as suggested by Tejun. Suggested-by: Tejun Heo Signed-off-by: Shida Zhang Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit 03536823589a501eb6601a7d09d77f8e1cbbcdd6 Merge: 66ccd1d16e03e 64b22a0da12ad Author: Dave Airlie Date: Fri May 20 16:34:29 2022 +1000 Merge tag 'msm-next-5.19-fixes' of https://gitlab.freedesktop.org/abhinavk/msm into drm-next 5.19 fixes for msm-next - Limiting WB modes to max sspp linewidth - Fixing the supported rotations to add 180 back for IGT - Fix to handle pm_runtime_get_sync() errors to avoid unclocked access in the bind() path for dpu driver - Fix the irq_free() without request issue which was a big-time hitter in the CI-runs. Signed-off-by: Abhinav Kumar Signed-off-by: Dave Airlie From: Abhinav Kumar Link: https://patchwork.freedesktop.org/patch/msgid/b011d51d-d634-123e-bf5f-27219ee33151@quicinc.com commit 66ccd1d16e03e7308629de3c6713930a94729c6e Merge: 00df0514ab138 5ee8c8f930ba7 Author: Dave Airlie Date: Fri May 20 16:33:18 2022 +1000 Merge tag 'drm-misc-next-fixes-2022-05-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-next A device tree binding change for Rockchip VOP2 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220519080556.42p52cya4u6y3kps@houat commit e4e62bbc6aba49a5edb3156ec65f6698ff37d228 Author: Yang Yingliang Date: Sat May 14 16:42:41 2022 +0800 hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() 'ddata->clk' is enabled by clk_prepare_enable(), it should be disabled by clk_disable_unprepare(). Fixes: 8d9d4bdc495f ("hwrng: omap3-rom - Use runtime PM instead of custom functions") Signed-off-by: Yang Yingliang Signed-off-by: Herbert Xu commit 2d33f5771b513f7dfb819563d4b38b687f2a4982 Author: Kai Ye Date: Fri May 13 16:02:44 2022 +0800 crypto: hisilicon/sec - delete the flag CRYPTO_ALG_ALLOCATES_MEMORY Should not to uses the CRYPTO_ALG_ALLOCATES_MEMORY in SEC2. The SEC2 driver uses the pre-allocated buffers, including the src sgl pool, dst sgl pool and other qp ctx resources. (e.g. IV buffer, mac buffer, key buffer). The SEC2 driver doesn't allocate memory during request processing. The driver only maps software sgl to allocated hardware sgl during I/O. So here is fix it. Signed-off-by: Kai Ye Signed-off-by: Herbert Xu commit fbdab61af2d02ebf9c015458c95e34b54dea9027 Author: Giovanni Cabiddu Date: Tue May 10 17:54:19 2022 +0100 crypto: qat - add support for 401xx devices QAT_401xx is a derivative of 4xxx. Add support for that device in the qat_4xxx driver by including the DIDs (both PF and VF), extending the probe and the firmware loader. Signed-off-by: Giovanni Cabiddu Reviewed-by: Srinivas Kerekare Signed-off-by: Herbert Xu commit d09144745959bf7852ccafd73243dd7d1eaeb163 Author: Giovanni Cabiddu Date: Mon May 9 14:34:17 2022 +0100 crypto: qat - re-enable registration of algorithms Re-enable the registration of algorithms after fixes to (1) use pre-allocated buffers in the datapath and (2) support the CRYPTO_TFM_REQ_MAY_BACKLOG flag. This reverts commit 8893d27ffcaf6ec6267038a177cb87bcde4dd3de. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Marco Chiappero Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 8fb203c65a795b96faa1836b5086a5d6eb5c5e99 Author: Giovanni Cabiddu Date: Mon May 9 14:34:16 2022 +0100 crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag If a request has the flag CRYPTO_TFM_REQ_MAY_SLEEP set, allocate memory using the flag GFP_KERNEL otherwise use GFP_ATOMIC. Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b Author: Giovanni Cabiddu Date: Mon May 9 14:34:15 2022 +0100 crypto: qat - add param check for DH Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 9714061423b8b24b8afb31b8eb4df977c63f19c4 Author: Giovanni Cabiddu Date: Mon May 9 14:34:14 2022 +0100 crypto: qat - add param check for RSA Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 029aa4624a7fe35233bdd3d1354dc7be260380bf Author: Giovanni Cabiddu Date: Mon May 9 14:34:13 2022 +0100 crypto: qat - remove dma_free_coherent() for DH The functions qat_dh_compute_value() allocates memory with dma_alloc_coherent() if the source or the destination buffers are made of multiple flat buffers or of a size that is not compatible with the hardware. This memory is then freed with dma_free_coherent() in the context of a tasklet invoked to handle the response for the corresponding request. According to Documentation/core-api/dma-api-howto.rst, the function dma_free_coherent() cannot be called in an interrupt context. Replace allocations with dma_alloc_coherent() in the function qat_dh_compute_value() with kmalloc() + dma_map_single(). Cc: stable@vger.kernel.org Fixes: c9839143ebbf ("crypto: qat - Add DH support") Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 3dfaf0071ed74d7a9c6b3c9ea4df7a6f8e423c2a Author: Giovanni Cabiddu Date: Mon May 9 14:34:12 2022 +0100 crypto: qat - remove dma_free_coherent() for RSA After commit f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA_REMAP"), if the algorithms are enabled, the driver crashes with a BUG_ON while executing vunmap() in the context of a tasklet. This is due to the fact that the function dma_free_coherent() cannot be called in an interrupt context (see Documentation/core-api/dma-api-howto.rst). The functions qat_rsa_enc() and qat_rsa_dec() allocate memory with dma_alloc_coherent() if the source or the destination buffers are made of multiple flat buffers or of a size that is not compatible with the hardware. This memory is then freed with dma_free_coherent() in the context of a tasklet invoked to handle the response for the corresponding request. Replace allocations with dma_alloc_coherent() in the functions qat_rsa_enc() and qat_rsa_dec() with kmalloc() + dma_map_single(). Cc: stable@vger.kernel.org Fixes: a990532023b9 ("crypto: qat - Add support for RSA algorithm") Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 80a52e1ee7757b742f96bfb0d58f0c14eb6583d0 Author: Giovanni Cabiddu Date: Mon May 9 14:34:11 2022 +0100 crypto: qat - fix memory leak in RSA When an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is used, some components of the private key persist even after the TFM is released. Replace the explicit calls to free the buffers in qat_rsa_exit_tfm() with a call to qat_rsa_clear_ctx() which frees all buffers referenced in the TFM context. Cc: stable@vger.kernel.org Fixes: 879f77e9071f ("crypto: qat - Add RSA CRT mode") Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 38682383973280e5be2802ba8a8d4a636d36cb19 Author: Giovanni Cabiddu Date: Mon May 9 14:34:10 2022 +0100 crypto: qat - add backlog mechanism The implementations of the crypto algorithms (aead, skcipher, etc) in the QAT driver do not properly support requests with the CRYPTO_TFM_REQ_MAY_BACKLOG flag set. If the HW queue is full, the driver returns -EBUSY but does not enqueue the request. This can result in applications like dm-crypt waiting indefinitely for the completion of a request that was never submitted to the hardware. Fix this by adding a software backlog queue: if the ring buffer is more than eighty percent full, then the request is enqueued to a backlog list and the error code -EBUSY is returned back to the caller. Requests in the backlog queue are resubmitted at a later time, in the context of the callback of a previously submitted request. The request for which -EBUSY is returned is then marked as -EINPROGRESS once submitted to the HW queues. The submission loop inside the function qat_alg_send_message() has been modified to decide which submission policy to use based on the request flags. If the request does not have the CRYPTO_TFM_REQ_MAY_BACKLOG set, the previous behaviour has been preserved. Based on a patch by Vishnu Das Ramachandran Cc: stable@vger.kernel.org Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface") Reported-by: Mikulas Patocka Reported-by: Kyle Sanderson Signed-off-by: Giovanni Cabiddu Reviewed-by: Marco Chiappero Signed-off-by: Herbert Xu commit af88d3c109aa5edfaa11c9a26d9c0ff21ddf501c Author: Giovanni Cabiddu Date: Mon May 9 14:34:09 2022 +0100 crypto: qat - refactor submission logic All the algorithms in qat_algs.c and qat_asym_algs.c use the same pattern to submit messages to the HW queues. Move the submission loop to a new function, qat_alg_send_message(), and share it between the symmetric and the asymmetric algorithms. As part of this rework, since the number of retries before returning an error is inconsistent between the symmetric and asymmetric implementations, set it to a value that works for both (i.e. 20, was 10 in qat_algs.c and 100 in qat_asym_algs.c) In addition fix the return code reported when the HW queues are full. In that case return -ENOSPC instead of -EBUSY. Including stable in CC since (1) the error code returned if the HW queues are full is incorrect and (2) to facilitate the backport of the next fix "crypto: qat - add backlog mechanism". Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Marco Chiappero Signed-off-by: Herbert Xu commit e0831e7af4e03f2715de102e18e9179ec0a81562 Author: Giovanni Cabiddu Date: Mon May 9 14:34:08 2022 +0100 crypto: qat - use pre-allocated buffers in datapath In order to do DMAs, the QAT device requires that the scatterlist structures are mapped and translated into a format that the firmware can understand. This is defined as the composition of a scatter gather list (SGL) descriptor header, the struct qat_alg_buf_list, plus a variable number of flat buffer descriptors, the struct qat_alg_buf. The allocation and mapping of these data structures is done each time a request is received from the skcipher and aead APIs. In an OOM situation, this behaviour might lead to a dead-lock if an allocation fails. Based on the conversation in [1], increase the size of the aead and skcipher request contexts to include an SGL descriptor that can handle a maximum of 4 flat buffers. If requests exceed 4 entries buffers, memory is allocated dynamically. [1] https://lore.kernel.org/linux-crypto/20200722072932.GA27544@gondor.apana.org.au/ Cc: stable@vger.kernel.org Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface") Reported-by: Mikulas Patocka Signed-off-by: Giovanni Cabiddu Reviewed-by: Marco Chiappero Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 1731160ff7c7bbb11bb1aacb14dd25e18d522779 Author: Giovanni Cabiddu Date: Mon May 9 14:19:27 2022 +0100 crypto: qat - set to zero DH parameters before free Set to zero the context buffers containing the DH key before they are freed. This is a defense in depth measure that avoids keys to be recovered from memory in case the system is compromised between the free of the buffer and when that area of memory (containing keys) gets overwritten. Cc: stable@vger.kernel.org Fixes: c9839143ebbf ("crypto: qat - Add DH support") Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu commit 805cb5aadc2a88c453cfe620b28e12ff2fac27a6 Merge: 16ea52c44e7a5 58a94a62a53ff Author: Jakub Kicinski Date: Thu May 19 16:06:33 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next, misc updates and fallout fixes from recent Florian's code rewritting (from last pull request): 1) Use new flowi4_l3mdev field in ip_route_me_harder(), from Martin Willi. 2) Avoid unnecessary GC with a timestamp in conncount, from William Tu and Yifeng Sun. 3) Remove TCP conntrack debugging, from Florian Westphal. 4) Fix compilation warning in ctnetlink, from Florian. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: ctnetlink: fix up for "netfilter: conntrack: remove unconfirmed list" netfilter: conntrack: remove pr_debug callsites from tcp tracker netfilter: nf_conncount: reduce unnecessary GC netfilter: Use l3mdev flow key when re-routing mangled packets ==================== Link: https://lore.kernel.org/r/20220519220206.722153-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 16ea52c44e7a56c983a2a49e218af5a9dbbd8965 Author: Jakub Kicinski Date: Thu May 19 18:25:55 2022 -0700 eth: mtk_ppe: fix up after merge I missed this in the barrage of GCC 12 warnings. Commit cf2df74e202d ("net: fix dev_fill_forward_path with pppoe + bridge") changed the pointer into an array. Fixes: d7e6f5836038 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net") Link: https://lore.kernel.org/r/20220520012555.2262461-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2fe3ffcf5592f24a9f9131a91727673d19f2b2d9 Author: Darrick J. Wong Date: Fri May 20 14:42:49 2022 +1000 xfs: free xfs_attrd_log_items correctly Technically speaking, objects allocated out of a specific slab cache are supposed to be freed to that slab cache. The popular slab backends will take care of this for us, but SLOB famously doesn't. Fix this, even if slob + xfs are not that common of a combination. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson Signed-off-by: Dave Chinner commit 25b1e9dc32299b98257835910f8e532d805b824f Author: Darrick J. Wong Date: Fri May 20 14:42:36 2022 +1000 xfs: validate xattr name earlier in recovery When we're validating a recovered xattr log item during log recovery, we should check the name before starting to allocate resources. This isn't strictly necessary on its own, but it means that we won't bother with huge memory allocations during recovery if the attr name is garbage, which will simplify the changes in the next patch. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson Signed-off-by: Dave Chinner commit 85d76aec6bbb3dd0131511e73d48b2816e7ab8de Author: Darrick J. Wong Date: Fri May 20 14:42:15 2022 +1000 xfs: reject unknown xattri log item filter flags during recovery Make sure we screen the "attr flags" field of recovered xattr intent log items to reject flag bits that we don't know about. This is really the attr *filter* field from xfs_da_args, so rename the field and create a mask to make checking for invalid bits easier. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Allison Henderson Signed-off-by: Dave Chinner commit 356cb708ea1886d1f7734cc1a8c4708b35ce5d77 Author: Darrick J. Wong Date: Fri May 20 14:41:47 2022 +1000 xfs: reject unknown xattri log item operation flags during recovery Make sure we screen the op flags field of recovered xattr intent log items to reject flag bits that we don't know about. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit a618acab136b1b01a4c10957ce8bae70cc9f7ca4 Author: Darrick J. Wong Date: Fri May 20 14:41:42 2022 +1000 xfs: don't leak the retained da state when doing a leaf to node conversion If a setxattr operation finds an xattr structure in leaf format, adding the attr can fail due to lack of space and hence requires an upgrade to node format. After this happens, we'll roll the transaction and re-enter the state machine, at which time we need to perform a second lookup of the attribute name to find its new location. This lookup attaches a new da state structure to the xfs_attr_item but doesn't free the old one (from the leaf lookup) and leaks it. Fix that. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 309001c22cdd75c62e6c3a217bf6967e178f929a Author: Darrick J. Wong Date: Fri May 20 14:41:34 2022 +1000 xfs: don't leak da state when freeing the attr intent item kmemleak reported that we lost an xfs_da_state while removing xattrs in generic/020: unreferenced object 0xffff88801c0e4b40 (size 480): comm "attr", pid 30515, jiffies 4294931061 (age 5.960s) hex dump (first 32 bytes): 78 bc 65 07 00 c9 ff ff 00 30 60 1c 80 88 ff ff x.e......0`..... 02 00 00 00 00 00 00 00 80 18 83 4e 80 88 ff ff ...........N.... backtrace: [] xfs_da_state_alloc+0x1a/0x30 [xfs] [] xfs_attr_node_hasname+0x23/0x90 [xfs] [] xfs_attr_set_iter+0x441/0xa30 [xfs] [] xfs_xattri_finish_update+0x44/0x80 [xfs] [] xfs_attr_finish_item+0x1e/0x40 [xfs] [] xfs_defer_finish_noroll+0x184/0x740 [xfs] [] __xfs_trans_commit+0x153/0x3e0 [xfs] [] xfs_attr_set+0x469/0x7e0 [xfs] [] xfs_xattr_set+0x89/0xd0 [xfs] [] __vfs_removexattr+0x52/0x70 [] __vfs_removexattr_locked+0xb8/0x150 [] vfs_removexattr+0x56/0x100 [] removexattr+0x58/0x90 [] path_removexattr+0x9e/0xc0 [] __x64_sys_lremovexattr+0x14/0x20 [] do_syscall_64+0x35/0x80 I think this is a consequence of xfs_attr_node_removename_setup attaching a new da(btree) state to xfs_attr_item and never freeing it. I /think/ it's the case that the remove paths could detach the da state earlier in the remove state machine since nothing else accesses the state. However, let's future-proof the new xattr code by adding a catch-all when we free the xfs_attr_item to make sure we never leak the da state. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit fed9b26b2501ea0ce41ae3a788bcc498440589c6 Author: Anup Patel Date: Mon May 9 11:23:16 2022 +0530 MAINTAINERS: Update KVM RISC-V entry to cover selftests support We update KVM RISC-V maintainers entry to include appropriate KVM selftests directories so that RISC-V related KVM selftests patches are CC'ed to KVM RISC-V mailing list. Signed-off-by: Anup Patel commit affa28e4d094b48a7b27dd0c5b8258288b6c4a24 Author: Atish Patra Date: Mon May 9 11:29:37 2022 -0700 RISC-V: KVM: Introduce ISA extension register Currently, there is no provision for vmm (qemu-kvm or kvmtool) to query about multiple-letter ISA extensions. The config register is only used for base single letter ISA extensions. A new ISA extension register is added that will allow the vmm to query about any ISA extension one at a time. It is enabled for both single letter or multi-letter ISA extensions. The ISA extension register is useful to if the vmm requires to retrieve/set single extension while the config register should be used if all the base ISA extension required to retrieve or set. For any multi-letter ISA extensions, the new register interface must be used. Signed-off-by: Atish Patra Signed-off-by: Anup Patel commit 92e450507d5612d399d0abee8447305a43a412cc Author: Anup Patel Date: Mon May 9 10:44:11 2022 +0530 RISC-V: KVM: Cleanup stale TLB entries when host CPU changes On RISC-V platforms with hardware VMID support, we share same VMID for all VCPUs of a particular Guest/VM. This means we might have stale G-stage TLB entries on the current Host CPU due to some other VCPU of the same Guest which ran previously on the current Host CPU. To cleanup stale TLB entries, we simply flush all G-stage TLB entries by VMID whenever underlying Host CPU changes for a VCPU. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 13acfec2dbccfafff3331a3810cd7dde2fb16891 Author: Anup Patel Date: Mon May 9 10:44:05 2022 +0530 RISC-V: KVM: Add remote HFENCE functions based on VCPU requests The generic KVM has support for VCPU requests which can be used to do arch-specific work in the run-loop. We introduce remote HFENCE functions which will internally use VCPU requests instead of host SBI calls. Advantages of doing remote HFENCEs as VCPU requests are: 1) Multiple VCPUs of a Guest may be running on different Host CPUs so it is not always possible to determine the Host CPU mask for doing Host SBI call. For example, when VCPU X wants to do HFENCE on VCPU Y, it is possible that VCPU Y is blocked or in user-space (i.e. vcpu->cpu < 0). 2) To support nested virtualization, we will be having a separate shadow G-stage for each VCPU and a common host G-stage for the entire Guest/VM. The VCPU requests based remote HFENCEs helps us easily synchronize the common host G-stage and shadow G-stage of each VCPU without any additional IPI calls. This is also a preparatory patch for upcoming nested virtualization support where we will be having a shadow G-stage page table for each Guest VCPU. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 486a38429498eef5acac90aeab68a1c3fa653a21 Author: Anup Patel Date: Mon May 9 10:44:00 2022 +0530 RISC-V: KVM: Reduce KVM_MAX_VCPUS value Currently, the KVM_MAX_VCPUS value is 16384 for RV64 and 128 for RV32. The KVM_MAX_VCPUS value is too high for RV64 and too low for RV32 compared to other architectures (e.g. x86 sets it to 1024 and ARM64 sets it to 512). The too high value of KVM_MAX_VCPUS on RV64 also leads to VCPU mask on stack consuming 2KB. We set KVM_MAX_VCPUS to 1024 for both RV64 and RV32 to be aligned other architectures. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 2415e46e3a9a22c80eddc41dc9cb0b06fe0cd5e9 Author: Anup Patel Date: Mon May 9 10:43:52 2022 +0530 RISC-V: KVM: Introduce range based local HFENCE functions Various __kvm_riscv_hfence_xyz() functions implemented in the kvm/tlb.S are equivalent to corresponding HFENCE.GVMA instructions and we don't have range based local HFENCE functions. This patch provides complete set of local HFENCE functions which supports range based TLB invalidation and supports HFENCE.VVMA based functions. This is also a preparatory patch for upcoming Svinval support in KVM RISC-V. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit c7fa3c48de86053b0f1949fa5532082544e30fce Author: Anup Patel Date: Mon May 9 10:43:46 2022 +0530 RISC-V: KVM: Treat SBI HFENCE calls as NOPs We should treat SBI HFENCE calls as NOPs until nested virtualization is supported by KVM RISC-V. This will help us test booting a hypervisor under KVM RISC-V. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit b4bbb95ea6c41a616385902df81a66293f4b744c Author: Anup Patel Date: Mon May 9 10:43:39 2022 +0530 RISC-V: KVM: Add Sv57x4 mode support for G-stage Latest QEMU supports G-stage Sv57x4 mode so this patch extends KVM RISC-V G-stage handling to detect and use Sv57x4 mode when available. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 26708234eb12e73a2a475296f562ba351fb39894 Author: Anup Patel Date: Mon May 9 10:43:30 2022 +0530 RISC-V: KVM: Use G-stage name for hypervisor page table The two-stage address translation defined by the RISC-V privileged specification defines: VS-stage (guest virtual address to guest physical address) programmed by the Guest OS and G-stage (guest physical addree to host physical address) programmed by the hypervisor. To align with above terminology, we replace "stage2" with "gstage" and "Stage2" with "G-stage" name everywhere in KVM RISC-V sources. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit dba90d6fb8b0657d45516bfe1eb8fe83d9e425f8 Author: Jiapeng Chong Date: Fri May 6 17:45:12 2022 +0800 KVM: selftests: riscv: Remove unneeded semicolon Fix the following coccicheck warnings: ./tools/testing/selftests/kvm/lib/riscv/processor.c:353:3-4: Unneeded semicolon. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Anup Patel commit ac6c85e962d4c009c499d93657f25f46fd8212b9 Author: Anup Patel Date: Sat Apr 9 10:02:36 2022 +0530 KVM: selftests: riscv: Improve unexpected guest trap handling Currently, we simply hang using "while (1) ;" upon any unexpected guest traps because the default guest trap handler is guest_hang(). The above approach is not useful to anyone because KVM selftests users will only see a hung application upon any unexpected guest trap. This patch improves unexpected guest trap handling for KVM RISC-V selftests by doing the following: 1) Return to host user-space 2) Dump VCPU registers 3) Die using TEST_ASSERT(0, ...) Signed-off-by: Anup Patel Tested-by: Mayuresh Chitale Signed-off-by: Anup Patel commit 30476f7e6dbcb075850c6e33b15460dd4868c985 Author: Tom Rix Date: Tue Jan 25 05:13:40 2022 -0800 namei: cleanup double word in comment Remove the second 'to'. Signed-off-by: Tom Rix Signed-off-by: Al Viro commit 52dba645ca3a2e8695f14fefb608a3b82a7c8a4e Author: Al Viro Date: Fri Jan 7 12:24:41 2022 -0500 get rid of dead code in legitimize_root() Combination of LOOKUP_IS_SCOPED and NULL nd->root.mnt is impossible after successful path_init(). All places where ->root.mnt might become NULL do that only if LOOKUP_IS_SCOPED is not there and path_init() itself can return success without setting nd->root only if ND_ROOT_PRESET had been set (in which case nd->root had been set by caller and never changed) or if the name had been a relative one *and* none of the bits in LOOKUP_IS_SCOPED had been present. Since all calls of legitimize_root() must be downstream of successful path_init(), the check for !nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED) is pure paranoia. FWIW, it had been discussed (and agreed upon) with Aleksa back when scoped lookups had been merged; looks like that had fallen through the cracks back then. Signed-off-by: Al Viro commit e5ca024e165d952b12da5ea86c36ea70d70bfc98 Author: Al Viro Date: Fri Jan 7 12:20:37 2022 -0500 fs/namei.c:reserve_stack(): tidy up the call of try_to_unlazy() !foo() != 0 is a strange way to spell !foo(); fallout from "fs: make unlazy_walk() error handling consistent"... Signed-off-by: Al Viro commit 70f8d9c5750bbb0ca4ef7e23d6abcb05e6061138 Author: Al Viro Date: Wed Mar 2 17:49:09 2022 -0500 move mount-related externs from fs.h to mount.h Signed-off-by: Al Viro commit 279b192c23d2fc9cb9e8c3851d6cad968f51789f Author: Al Viro Date: Wed Mar 2 16:11:23 2022 -0500 blob_to_mnt(): kern_unmount() is needed to undo kern_mount() plain mntput() won't do. Signed-off-by: Al Viro commit f6957b7191ed8b55c1d2a28fa23c6a7d327b4408 Author: Al Viro Date: Tue Mar 1 20:35:41 2022 -0500 m->mnt_root->d_inode->i_sb is a weird way to spell m->mnt_sb... Signed-off-by: Al Viro commit 59df85d5fbae17175c391d89ad03e9e7a01b7a55 Author: Al Viro Date: Tue Mar 1 19:56:53 2022 -0500 linux/mount.h: trim includes Signed-off-by: Al Viro commit a5f85d7834f7e1456e799c79a2a83fc11b90cfe2 Author: Al Viro Date: Tue Mar 1 00:05:29 2022 -0500 uninline may_mount() and don't opencode it in fspick(2)/fsopen(2) It's done once per (mount-related) syscall and there's no point whatsoever making it inline. Signed-off-by: Al Viro commit 0784c25d21cfe14c128ea5ed3c9ab843fdfac737 Merge: 9ad084d666194 2ba18161d407c Author: Jakub Kicinski Date: Thu May 19 20:05:10 2022 -0700 Merge branch 'mptcp-miscellaneous-fixes-and-a-new-test-case' Mat Martineau says: ==================== mptcp: Miscellaneous fixes and a new test case Patches 1 and 3 remove helpers that were iterating over the subflow connection list without proper locking. Iteration was not needed in either case. Patch 2 fixes handling of MP_FAIL timeout, checking for orphaned subflows instead of using the MPTCP socket data lock and connection state. Patch 4 adds a test for MP_FAIL timeout using tc pedit to induce checksum failures. ==================== Link: https://lore.kernel.org/r/20220518220446.209750-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit 2ba18161d407c596f256f7c4a6447b8588b9eb55 Author: Geliang Tang Date: Wed May 18 15:04:46 2022 -0700 selftests: mptcp: add MP_FAIL reset testcase Add the multiple subflows test case for MP_FAIL, to test the MP_FAIL reset case. Use the test_linkfail value to make 1024KB test files. Invoke reset_with_fail() to use 'iptables' and 'tc action pedit' rules to produce the bit flips to trigger the checksum failures on ns2eth2. Add delays on ns2eth1 to make sure more data can translate on ns2eth2. The check_invert flag is enabled in reset_with_fail(), so this test prints out the inverted bytes, instead of the file mismatch errors. Invoke pedit_action_pkts() to get the numbers of the packets edited by the tc pedit actions, and print this numbers to the output. Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit d9fb797046c596187b97a08ea88b954964cc2d33 Author: Mat Martineau Date: Wed May 18 15:04:45 2022 -0700 mptcp: Do not traverse the subflow connection list without lock The MPTCP socket's conn_list (list of subflows) requires the socket lock to access. The MP_FAIL timeout code added such an access, where it would check the list of subflows both in timer context and (later) in workqueue context where the socket lock is held. Rather than check the list twice, remove the check in the timeout handler and only depend on the check in the workqueue. Also remove the MPTCP_FAIL_NO_RESPONSE flag, since mptcp_mp_fail_no_response() has insignificant overhead and can be checked on each worker run. Fixes: 49fa1919d6bc ("mptcp: reset subflow when MP_FAIL doesn't respond") Reported-by: Paolo Abeni Reviewed-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit d42f9e4e2384febf9cb2d19ffa0cfac96189517a Author: Mat Martineau Date: Wed May 18 15:04:44 2022 -0700 mptcp: Check for orphaned subflow before handling MP_FAIL timer MP_FAIL timeout (waiting for a peer to respond to an MP_FAIL with another MP_FAIL) is implemented using the MPTCP socket's sk_timer. That timer is also used at MPTCP socket close, so it's important to not have the two timer users interfere with each other. At MPTCP socket close, all subflows are orphaned before sk_timer is manipulated. By checking the SOCK_DEAD flag on the subflows, each subflow can determine if the timer is safe to alter without acquiring any MPTCP-level lock. This replaces code that was using the mptcp_data_lock and MPTCP-level socket state checks that did not correctly protect the timer. Fixes: 49fa1919d6bc ("mptcp: reset subflow when MP_FAIL doesn't respond") Reviewed-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 7b16871f9932d8a371488d2967b033387870a747 Author: Paolo Abeni Date: Wed May 18 15:04:43 2022 -0700 mptcp: stop using the mptcp_has_another_subflow() helper The mentioned helper requires the msk socket lock, and the current callers don't own it nor can't acquire it, so the access is racy. All the current callers are really checking for infinite mapping fallback, and the latter condition is explicitly tracked by the relevant msk variable: we can safely remove the caller usage - and the caller itself. The issue is present since MP_FAIL implementation, but the fix only applies since the infinite fallback support, ence the somewhat unexpected fixes tag. Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status") Acked-and-tested-by: Geliang Tang Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 9ad084d666194c20a30e3589cbfaf971dae55c24 Author: Yuchung Cheng Date: Wed May 18 17:34:10 2022 -0700 tcp: improve PRR loss recovery This patch improves TCP PRR loss recovery behavior for a corner case. Previously during PRR conservation-bound mode, it strictly sends the amount equals to the amount newly acked or s/acked. The patch changes s.t. PRR may send additional amount that was banked previously (e.g. application-limited) in the conservation-bound mode, similar to the slow-start mode. This unifies and simplifies the algorithm further and may improve the recovery latency. This change still follow the general packet conservation design principle and always keep inflight/cwnd below the slow start threshold set by the congestion control module. PRR is described in RFC 6937. We'll include this change in the latest revision rfc6937-bis as well. Reported-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20220519003410.2531936-1-ycheng@google.com Signed-off-by: Jakub Kicinski commit 9b80ccda233fa6c59de411bf889cc4d0e028f2c7 Author: Hangbin Liu Date: Thu May 19 10:01:48 2022 +0800 bonding: fix missed rcu protection When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed: stack backtrace: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39 Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist. [1] https://lore.kernel.org/netdev/27565.1642742439@famine/ Reported-by: syzbot+92beb3d46aab498710fa@syzkaller.appspotmail.com Fixes: aa6034678e87 ("bonding: use rcu_dereference_rtnl when get bonding active slave") Suggested-by: Vladimir Oltean Suggested-by: Jakub Kicinski Signed-off-by: Hangbin Liu Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220519020148.1058344-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 7ebe52f555de21a1f239b963aa49972a6916a49a Author: Jakub Kicinski Date: Wed May 18 16:43:46 2022 -0700 docs: change the title of networking docs The current title of our section of the documentation is Linux Networking Documentation. Since we're describing a section of Linux Documentation repeating those two words seems redundant. Link: https://lore.kernel.org/r/20220518234346.2088436-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1172aa6e4a195aaf5941ae89a93068cb9dd07b47 Author: Jakub Kicinski Date: Wed May 18 17:44:17 2022 -0700 net: ipa: don't proceed to out-of-bound write GCC 12 seems upset that we check ipa_irq against array bound but then proceed, anyway: drivers/net/ipa/ipa_interrupt.c: In function ‘ipa_interrupt_add’: drivers/net/ipa/ipa_interrupt.c:196:27: warning: array subscript 30 is above array bounds of ‘void (*[30])(struct ipa *, enum ipa_irq_id)’ [-Warray-bounds] 196 | interrupt->handler[ipa_irq] = handler; | ~~~~~~~~~~~~~~~~~~^~~~~~~~~ drivers/net/ipa/ipa_interrupt.c:42:27: note: while referencing ‘handler’ 42 | ipa_irq_handler_t handler[IPA_IRQ_COUNT]; | ^~~~~~~ Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/20220519004417.2109886-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit dbbc7d04c549a43ad343c69e17b27a57e2102041 Author: Jakub Kicinski Date: Wed May 18 17:43:42 2022 -0700 net: wwan: iosm: remove pointless null check GCC 12 warns: drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c: In function ‘ipc_protocol_dl_td_process’: drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c:406:13: warning: the comparison will always evaluate as ‘true’ for the address of ‘cb’ will never be NULL [-Waddress] 406 | if (!IPC_CB(skb)) { | ^ Indeed the check seems entirely pointless. Hopefully the other validation checks will catch if the cb is bad, but it can't be NULL. Reviewed-by: M Chetan Kumar Link: https://lore.kernel.org/r/20220519004342.2109832-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 53332f845194b8dedf213c5bf51c2d4af88364ee Merge: 86afd5a0e78eb 4951995dbe9dd Author: Jakub Kicinski Date: Thu May 19 18:40:56 2022 -0700 Merge branch 'lantiq_gswip-two-small-fixes' Martin Blumenstingl says: ==================== lantiq_gswip: Two small fixes While updating the Lantiq target in OpenWrt to Linux 5.15 I came across an FDB related error message. While that still needs to be solved I found two other small issues on the way. This series fixes the two minor issues found while revisiting the FDB code in the lantiq_gswip driver: - The first patch fixes the start index used in gswip_port_fdb() to find the entry with the matching bridge. The updated logic is now consistent with the rest of the driver. - The second patch fixes a typo in a dev_err() message. [0] https://lore.kernel.org/netdev/20220517194015.1081632-1-martin.blumenstingl@googlemail.com/ ==================== Link: https://lore.kernel.org/r/20220518220051.1520023-1-martin.blumenstingl@googlemail.com Signed-off-by: Jakub Kicinski commit 4951995dbe9dd0c3fbe1fbfdb760b05a797700f1 Author: Martin Blumenstingl Date: Thu May 19 00:00:51 2022 +0200 net: dsa: lantiq_gswip: Fix typo in gswip_port_fdb_dump() error print gswip_port_fdb_dump() reads the MAC bridge entries. The error message should say "failed to read mac bridge entry". While here, also add the index to the error print so humans can get to the cause of the problem easier. Acked-by: Hauke Mehrtens Reviewed-by: Vladimir Oltean Signed-off-by: Martin Blumenstingl Signed-off-by: Jakub Kicinski commit 7b4149bdee6a6363cb4eca3599296d41a7b3700d Author: Martin Blumenstingl Date: Thu May 19 00:00:50 2022 +0200 net: dsa: lantiq_gswip: Fix start index in gswip_port_fdb() The first N entries in priv->vlans are reserved for managing ports which are not part of a bridge. Use priv->hw_info->max_ports to consistently access per-bridge entries at index 7. Starting at priv->hw_info->cpu_port (6) is harmless in this case because priv->vlan[6].bridge is always NULL so the comparison result is always false (which results in this entry being skipped). Acked-by: Hauke Mehrtens Signed-off-by: Martin Blumenstingl Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 86afd5a0e78eb9b84b158b33d85f711c5f748fd1 Author: Ricardo Martinez Date: Wed May 18 12:55:29 2022 -0700 net: wwan: t7xx: Fix smatch errors t7xx_request_irq() error: uninitialized symbol 'ret'. t7xx_core_hk_handler() error: potentially dereferencing uninitialized 'event'. If the condition to enter the loop that waits for the handshake event is false on the first iteration then the uninitialized 'event' will be dereferenced, fix this by initializing 'event' to NULL. t7xx_port_proxy_recv_skb() warn: variable dereferenced before check 'skb'. No need to check skb at t7xx_port_proxy_recv_skb() since we know it is always called with a valid skb by t7xx_cldma_gpd_rx_from_q(). Reported-by: Dan Carpenter Signed-off-by: Ricardo Martinez Link: https://lore.kernel.org/r/20220518195529.126246-1-ricardo.martinez@linux.intel.com Signed-off-by: Jakub Kicinski commit cb89580ed8965fe317025d1da1a05b6b5aae1646 Merge: 1c2133114d2d1 14a44ab0330d2 Author: Jakub Kicinski Date: Thu May 19 18:14:34 2022 -0700 Merge branch 'mtk_eth_soc-phylink-updates' Russell King says: ==================== mtk_eth_soc phylink updates This series ultimately updates mtk_eth_soc to use phylink_pcs, with some fixes along the way. Previous attempts to update this driver (which is now marked as legacy) have failed due to lack of testing. I am hoping that this time will be different; Marek can test RGMII modes, but not SGMII. So all that we know is that this patch series probably doesn't break RGMII. 1) remove unused mac_mode and sgmii flags members from structures. 2) remove unnecessary interpretation of speed when configuring 1000 and 2500 Base-X 3) move configuration of SGMII duplex setting from mac_config() to link_up() 4) only pass in interface mode to mtk_sgmii_setup_mode_force() 5) move decision about which mtk_sgmii_setup_mode_*() function to call into mtk_sgmii.c 6) add a fixme comment for RGMII explaning why the call to mtk_gmac0_rgmii_adjust() is completely wrong - this needs to be addressed by someone who has the hardware and can test an appropriate fix. This fixme means that the driver still can't become non-legacy. 7) move gmac setup from mac_config() to mac_finish() - this preserves the order that we write to the hardware when we eventually convert to phylink_pcs() 8) move configuration of syscfg0 in SGMII/802.3z mode to mac_finish() for the same reasons as (7). 9) convert mtk_sgmii.c code structure and the mtk_sgmii structure to suit conversion to phylink_pcs 10) finally convert to phylink_pcs As there has been no feedback from mtk_eth_soc maintainers to my RFC on April 6th, not my reminder on April 11th, so it's now time to merge this anyway. Mediatek code seems to be submitted to the kernel and then the maintainers scarper... ==================== Link: https://lore.kernel.org/r/YoUIX+BN/ZbyXzTT@shell.armlinux.org.uk Tested-by: Marek Behún Signed-off-by: Jakub Kicinski commit 14a44ab0330d290fade1403a920e299cc56d7300 Author: Russell King (Oracle) Date: Wed May 18 15:55:28 2022 +0100 net: mtk_eth_soc: partially convert to phylink_pcs Partially convert mtk_eth_soc to phylink_pcs, moving the configuration, link up and AN restart over. However, it seems mac_pcs_get_state() doesn't actually get the state from the PCS, so we can't convert that over without a better understanding of the hardware. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 901f3fbe13c3e56f0742e02717ccbfabbc95c463 Author: Russell King (Oracle) Date: Wed May 18 15:55:22 2022 +0100 net: mtk_eth_soc: convert code structure to suit split PCS support Provide a mtk_pcs structure which encapsulates everything that the PCS functions need (the regmap and ana_rgc3 offset), and use this in the PCS functions. Provide shim functions to convert from the existing "mtk_sgmii_*" interface to the converted PCS functions. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 21089867278deb2a110b685e3cd33f64f9ce41e2 Author: Russell King (Oracle) Date: Wed May 18 15:55:17 2022 +0100 net: mtk_eth_soc: move restoration of SYSCFG0 to mac_finish() The SGMIISYS configuration is performed while ETHSYS_SYSCFG0 is in a disabled state. In order to preserve this when we switch to phylink_pcs we need to move the restoration of this register to the mac_finish() callback. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 0e37ad71b2ff772009595002da2860999e98e14e Author: Russell King (Oracle) Date: Wed May 18 15:55:12 2022 +0100 net: mtk_eth_soc: move MAC_MCR setting to mac_finish() Move the setting of the MTK_MAC_MCR register from the end of mac_config into the phylink mac_finish() method, to keep it as the very last write that is done during configuration. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 650a49bc65df6b0e0051a8f62d7c22d95a8f350d Author: Russell King (Oracle) Date: Wed May 18 15:55:07 2022 +0100 net: mtk_eth_soc: add fixme comment for state->speed use Add a fixme comment for the last remaining incorrect usage of state->speed in the mac_config() method, which is strangely in a code path which is only run when the PHY interface mode changes. This means if we are in RGMII mode, changes in state->speed will not cause the INTF_MODE, TRGMII_RCK_CTRL and TRGMII_TCK_CTRL registers to be set according to the speed, nor will the TRGPLL clock be set to the correct value. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 1ec619ee4a052fb9ac48b57554ac2722a0bfe73c Author: Russell King (Oracle) Date: Wed May 18 15:55:02 2022 +0100 net: mtk_eth_soc: provide mtk_sgmii_config() Provide mtk_sgmii_config() to wrap up the decisions about which SGMII configuration will be called. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 4ce5a0bd3958ed248f0325bfcb95339f7c74feb2 Author: Russell King (Oracle) Date: Wed May 18 15:54:57 2022 +0100 net: mtk_eth_soc: stop passing phylink state to sgmii setup Now that mtk_sgmii_setup_mode_force() only uses the interface mode from the phylink state, pass just the interface mode into this function. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit a459187390bb221827f9c07866c3a5ffbdf9622b Author: Russell King Date: Wed May 18 15:54:52 2022 +0100 net: mtk_eth_soc: correct 802.3z duplex setting Phylink does not guarantee that state->duplex will be set correctly in the mac_config() call, so it's a bug that the driver makes use of it. Move the 802.3z PCS duplex configuration to mac_link_up(). Signed-off-by: Russell King Signed-off-by: Jakub Kicinski commit 7da3f901f8ecb425105fad39a0f5de73306abe52 Author: Russell King (Oracle) Date: Wed May 18 15:54:47 2022 +0100 net: mtk_eth_soc: correct 802.3z speed setting Phylink does not guarantee that state->speed will be set correctly in the mac_config() call, so it's a bug that the driver makes use of it. Moreover, it is making use of it in a function that is only ever called for 1000BASE-X and 2500BASE-X which operate at a fixed speed which happens to be the same setting irrespective of the interface mode. We can simply remove the switch statement and just set the SGMII interface speed. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit bc5e93e0cd22e360eda23859b939280205567580 Author: Russell King (Oracle) Date: Wed May 18 15:54:42 2022 +0100 net: mtk_eth_soc: add mask and update PCS speed definitions The PCS speed setting is a two bit field, but it is defined as two separate bits. Add a bitfield mask for the speed definitions, an use the FIELD_PREP() macro to define each PCS speed. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 5a7a2f4b29d7546244da7d8bbc1962fce5b230f2 Author: Russell King (Oracle) Date: Wed May 18 15:54:36 2022 +0100 net: mtk_eth_soc: remove unused sgmii flags The "flags" member of struct mtk_sgmii appears to be unused, as are the MTK_SGMII_PHYSPEED_* and MTK_HAS_FLAGS() macros. Remove them. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 0600bdde1fae75fb9bad72033d28edddc72b44b2 Author: Russell King (Oracle) Date: Wed May 18 15:54:31 2022 +0100 net: mtk_eth_soc: remove unused mac->mode mac->mode is only ever written to in one location, and is thus superflous. Remove it. Signed-off-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 1c2133114d2d11c10ffb0da4e12904bde0478beb Author: Jakub Kicinski Date: Wed May 18 13:56:44 2022 -0700 net: tls: fix messing up lists when bpf enabled Artem points out that skb may try to take over the skb and queue it to its own list. Unlink the skb before calling out. Fixes: b1a2c1786330 ("tls: rx: clear ctx->recv_pkt earlier") Reported-by: Artem Savkov Tested-by: Artem Savkov Link: https://lore.kernel.org/r/20220518205644.2059468-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b413b0cb008646e9f24ce5253cb3cf7ee217aff6 Author: Duoming Zhou Date: Wed May 18 19:57:33 2022 +0800 NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx There are sleep in atomic context bugs when the request to secure element of st21nfca is timeout. The root cause is that kzalloc and alloc_skb with GFP_KERNEL parameter and mutex_lock are called in st21nfca_se_wt_timeout which is a timer handler. The call tree shows the execution paths that could lead to bugs: (Interrupt context) st21nfca_se_wt_timeout nfc_hci_send_event nfc_hci_hcp_message_tx kzalloc(..., GFP_KERNEL) //may sleep alloc_skb(..., GFP_KERNEL) //may sleep mutex_lock() //may sleep This patch moves the operations that may sleep into a work item. The work item will run in another kernel thread which is in process context to execute the bottom half of the interrupt. So it could prevent atomic context from sleeping. Fixes: 2130fb97fecf ("NFC: st21nfca: Adding support for secure element") Signed-off-by: Duoming Zhou Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220518115733.62111-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit df98714e432abf5cbdac3e4c1a13f94c65ddb8d3 Author: Dan Carpenter Date: Wed May 18 20:37:15 2022 +0300 net: ethernet: SP7021: fix a use after free of skb->len The netif_receive_skb() function frees "skb" so store skb->len before it is freed. Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YoUuy4iTjFAcSn03@kili Signed-off-by: Jakub Kicinski commit 582a2dbc72ac5dd2b3ae4f75bccd4b4c73bb0e1f Author: Xin Long Date: Wed May 18 12:09:15 2022 -0400 Documentation: add description for net.core.gro_normal_batch Describe it in admin-guide/sysctl/net.rst like other Network core options. Users need to know gro_normal_batch for performance tuning. Fixes: 323ebb61e32b ("net: use listified RX for handling GRO_NORMAL skbs") Reported-by: Prijesh Patel Signed-off-by: Xin Long Reviewed-by: Edward Cree Link: https://lore.kernel.org/r/acf8a2c03b91bcde11f67ff89b6050089c0712a3.1652888963.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit dd11376b9f1b73aca3f8c6eb541486bbb6996f05 Author: Bart Van Assche Date: Wed May 11 14:25:52 2022 -0700 scsi: ufs: Split the drivers/scsi/ufs directory Split the drivers/scsi/ufs directory into 'core' and 'host' directories under the drivers/ufs/ directory. Move shared header files into the include/ufs/ directory. This separation makes it clear which header files UFS drivers are allowed to include (include/ufs/*.h) and which header files UFS drivers are not allowed to include (drivers/ufs/core/*.h). Update the MAINTAINERS file. Add myself as a UFS reviewer. Link: https://lore.kernel.org/r/20220511212552.655341-1-bvanassche@acm.org Cc: Adrian Hunter Cc: Avri Altman Cc: Bean Huo Cc: Bjorn Andersson Cc: Keoseong Park Tested-by: Bean Huo Tested-by: Adrian Hunter Reviewed-by: Bean Huo Acked-by: Avri Altman Acked-by: Adrian Hunter Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit c10ba0c961d3e3c05c0e13bb15a9e630fd208579 Author: Colin Ian King Date: Wed May 18 11:21:03 2022 +0100 scsi: qla1280: Remove redundant variable Variable toke is being assigned a value that is never read. The variable is redundant, remove it. Cleans up clang scan build warning: warning: Although the value stored to 'toke' is used in the enclosing expression, the value is never actually read from 'toke' [deadcode.DeadStores] Link: https://lore.kernel.org/r/20220518102103.514701-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 896325a8b1650e45e7626079170c56313057eefa Author: James Smart Date: Thu May 19 05:31:10 2022 -0700 scsi: lpfc: Add support for VMID tagging of NVMe I/Os Modify the NVMe I/O path to look for VMID support and call the transport to obtain the I/O's appid value. Link: https://lore.kernel.org/r/20220519123110.17361-5-jsmart2021@gmail.com Reviewed-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Co-developed-by: Gaurav Srivastava Signed-off-by: Gaurav Srivastava Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 348efeca74878dc6af688486267b862460a96040 Author: James Smart Date: Thu May 19 05:31:09 2022 -0700 scsi: lpfc: Rework lpfc_vmid_get_appid() to be protocol independent Rework lpfc_vmid_get_appid() arguments to remove scsi_cmnd dependency. The function is now callable by the NVMe I/O path. Fix up SCSI call path to accommodate the arg change. Link: https://lore.kernel.org/r/20220519123110.17361-4-jsmart2021@gmail.com Reviewed-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Co-developed-by: Gaurav Srivastava Signed-off-by: Gaurav Srivastava Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit ed913cf4a5334427f40d1a09450368b2af6edd89 Author: James Smart Date: Thu May 19 05:31:08 2022 -0700 scsi: lpfc: Commonize VMID code location Remove VMID code from its SCSI-specific location and move to a new file solely for VMID code. Link: https://lore.kernel.org/r/20220519123110.17361-3-jsmart2021@gmail.com Reviewed-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Co-developed-by: Gaurav Srivastava Signed-off-by: Gaurav Srivastava Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 827fc630e4c8087df5a8e8ee013b686bd6f13736 Author: Muneendra Kumar Date: Thu May 19 05:31:07 2022 -0700 scsi: nvme-fc: Add new routine nvme_fc_io_getuuid() Add nvme_fc_io_getuuid() to the nvme-fc transport. The routine is invoked by the FC LLDD on a per-I/O request basis. The routine translates from the FC-specific request structure to the bio and the cgroup structure in order to obtain the FC appid stored in the cgroup structure. If a value is not set or a bio is not found, a NULL appid (aka uuid) will be returned to the LLDD. Link: https://lore.kernel.org/r/20220519123110.17361-2-jsmart2021@gmail.com Reviewed-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Acked-by: Christoph Hellwig Signed-off-by: Muneendra Kumar Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit d9c454ab2293f6b143d3d1be2bf54d766ed8bfc5 Author: Chao Liu Date: Thu May 19 18:40:10 2022 +0800 f2fs: make f2fs_read_inline_data() more readable In f2fs_read_inline_data(), it is confused with checking of inline_data flag, as we checked it before calling. So this patch add some comments for f2fs_has_inline_data(). Signed-off-by: Chao Liu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f01cdcf891a569dee187a5de0c25cd5766151524 Author: David Ober Date: Tue May 17 14:05:39 2022 -0400 net: usb: r8152: Add in new Devices that are supported for Mac-Passthru Lenovo Thunderbolt 4 Dock, and other Lenovo USB Docks are using the original Realtek USB ethernet Vendor and Product IDs If the Network device is Realtek verify that it is on a Lenovo USB hub before enabling the passthru feature This also adds in the device IDs for the Lenovo USB Dongle and one other USB-C dock V2 fix formating of code V3 remove Generic define for Device ID 0x8153 and change it to use value V4 rearrange defines and case statement to put them in better order v5 create helper function to do the testing work as suggested Signed-off-by: David Ober Link: https://lore.kernel.org/r/20220517180539.25839-1-dober6023@gmail.com Signed-off-by: Jakub Kicinski commit 325d5c5fb216674296f3902a8902b942da3adc5b Author: Bodo Stroesser Date: Tue May 17 21:29:13 2022 +0200 scsi: target: tcmu: Avoid holding XArray lock when calling lock_page In tcmu_blocks_release(), lock_page() is called to prevent a race causing possible data corruption. Since lock_page() might sleep, calling it while holding XArray lock is a bug. To fix this, replace the xas_for_each() call with xa_for_each_range(). Since the latter does its own handling of XArray locking, the xas_lock() and xas_unlock() calls around the original loop are no longer necessary. The switch to xa_for_each_range() slows down the loop slightly. This is acceptable since tcmu_blocks_release() is not relevant for performance. Link: https://lore.kernel.org/r/20220517192913.21405-1-bostroesser@gmail.com Fixes: bb9b9eb0ae2e ("scsi: target: tcmu: Fix possible data corruption") Reported-by: Dan Carpenter Signed-off-by: Bodo Stroesser Signed-off-by: Martin K. Petersen commit d627660c22b51121262c03dfa1a51bf54361f5a9 Author: Haowen Bai Date: Tue May 17 09:25:36 2022 +0800 scsi: elx: efct: Remove NULL check after calling container_of() container_of() will never return NULL. Link: https://lore.kernel.org/r/1652750737-22673-1-git-send-email-baihaowen@meizu.com Signed-off-by: Haowen Bai Signed-off-by: Martin K. Petersen commit 91fdd0788878862581128c86025c8a6262aeb868 Author: Haowen Bai Date: Tue May 10 17:47:03 2022 +0800 scsi: dpt_i2o: Drop redundant spinlock initialization adpt_post_wait_lock was declared and initialized by DEFINE_SPINLOCK so we don't need to call spin_lock_init(). Drop the call. Link: https://lore.kernel.org/r/1652176024-3981-1-git-send-email-baihaowen@meizu.com Signed-off-by: Haowen Bai Signed-off-by: Martin K. Petersen commit fc65df48c88ea0b7d4bcbccdc59ffeedc64222c2 Author: Colin Ian King Date: Tue May 17 10:25:18 2022 +0100 scsi: qedf: Remove redundant variable op The variable 'op' is assigned a value and is never read. The variable is not used and is redundant, remove it. Link: https://lore.kernel.org/r/20220517092518.93159-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 6c6ac8b7773f05f93dc4e4044686e059d1f78dea Author: John Garry Date: Tue May 17 16:04:21 2022 +0800 scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver() The memories for the slot should be observed to be written prior to observing the slot as ready. Prior to commit 26fc0ea74fcb ("scsi: libsas: Drop SAS_TASK_AT_INITIATOR"), we had a spin_lock() + spin_unlock() immediately before marking the slot as ready. The spin_unlock() - with release semantics - caused the slot memory to be observed to be written. Now that the spin_lock() + spin_unlock() is gone, use a smp_wmb(). Link: https://lore.kernel.org/r/1652774661-12935-1-git-send-email-john.garry@huawei.com Fixes: 26fc0ea74fcb ("scsi: libsas: Drop SAS_TASK_AT_INITIATOR") Reported-by: Yihang Li Tested-by: Yihang Li Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit b559b99a5c08194c14dc271e69ca786771b353dc Author: Karan Tilak Kumar Date: Fri May 13 13:56:05 2022 -0700 scsi: fnic: Replace DMA mask of 64 bits with 47 bits Cisco VIC supports only 47 bits. If the host sends DMA addresses that are greater than 47 bits, it causes work queue (WQ) errors in the VIC. Link: https://lore.kernel.org/r/20220513205605.81788-1-kartilak@cisco.com Tested-by: Karan Tilak Kumar Co-developed-by: Dhanraj Jhawar Signed-off-by: Dhanraj Jhawar Co-developed-by: Sesidhar Baddela Signed-off-by: Sesidhar Baddela Signed-off-by: Arulprabhu Ponnusamy Signed-off-by: Karan Tilak Kumar Signed-off-by: Martin K. Petersen commit 9feb5c4c3f95ec42fc12dc92f7216c2603b1a571 Author: Sreekanth Reddy Date: Tue May 17 17:23:10 2022 +0530 scsi: mpi3mr: Add target device related sysfs attributes Add sysfs attributes for exposing target device details such as SAS address, firmware device handle, and persistent ID for the controller-attached devices and RAID volumes. Link: https://lore.kernel.org/r/20220517115310.13062-3-sreekanth.reddy@broadcom.com Reviewed-by: Himanshu Madhani Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit e51e76edddb10867f95df0c24a9769d6d97afeb0 Author: Sreekanth Reddy Date: Tue May 17 17:23:09 2022 +0530 scsi: mpi3mr: Add shost related sysfs attributes Add shost related sysfs attributes to display the controller's firmware version, queue depth, number of requests, and number of reply queues. Also add an attribute to set & get the logging_level. Link: https://lore.kernel.org/r/20220517115310.13062-2-sreekanth.reddy@broadcom.com Reviewed-by: Himanshu Madhani Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit e79aaa9cc02dd39061eb4e2c7d156532a31da975 Author: Harshit Mogalapalli Date: Thu May 5 07:36:57 2022 -0700 scsi: elx: efct: Remove redundant memset() statement As memset() of bmbx is immediately followed by a memcpy() where bmbx is the destination, the memset() is redundant. Link: https://lore.kernel.org/r/20220505143703.45441-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli Signed-off-by: Martin K. Petersen commit 2f9e9a7b0ce38471c6f22a762adca6a977edfa7d Author: Harshit Mogalapalli Date: Thu May 5 07:32:13 2022 -0700 scsi: megaraid_sas: Remove redundant memset() statement As memset() of scmd->sense_buffer is immediately followed by a memcpy() where scmd->sense_buffer is the destination. The memset() is redundant. Link: https://lore.kernel.org/r/20220505143214.44908-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli Signed-off-by: Martin K. Petersen commit bc7896d31a922ee9caabb10dc07509f65d41dc0e Author: Dan Carpenter Date: Thu May 5 13:25:52 2022 +0300 scsi: mpi3mr: Return error if dma_alloc_coherent() fails Return -ENOMEM instead of success if dma_alloc_coherent() fails. Link: https://lore.kernel.org/r/YnOmMGHqCOtUCYQ1@kili Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit e9dedc13bb11bc553754abecb322e5e41d1b4fef Author: John Garry Date: Thu May 12 19:15:34 2022 +0800 scsi: hisi_sas: Fix rescan after deleting a disk Removing an ATA device via sysfs means that the device may not be found through re-scanning: root@ubuntu:/home/john# lsscsi [0:0:0:0] disk SanDisk LT0200MO P404 /dev/sda [0:0:1:0] disk ATA HGST HUS724040AL A8B0 /dev/sdb [0:0:8:0] enclosu 12G SAS Expander RevB - root@ubuntu:/home/john# echo 1 > /sys/block/sdb/device/delete root@ubuntu:/home/john# echo "- - -" > /sys/class/scsi_host/host0/scan root@ubuntu:/home/john# lsscsi [0:0:0:0] disk SanDisk LT0200MO P404 /dev/sda [0:0:8:0] enclosu 12G SAS Expander RevB - root@ubuntu:/home/john# The problem is that the rescan of the device may conflict with the device in being re-initialized, as follows: - In the rescan we call hisi_sas_slave_alloc() in store_scan() -> sas_user_scan() -> [__]scsi_scan_target() -> scsi_probe_and_add_lunc() -> scsi_alloc_sdev() -> hisi_sas_slave_alloc() -> hisi_sas_init_device() In hisi_sas_init_device() we issue an IT nexus reset for ATA devices - That IT nexus causes the remote PHY to go down and this triggers a bcast event - In parallel libsas processes the bcast event, finds that the phy is down and marks the device as gone The hard reset issued in hisi_sas_init_device() is unncessary - as described in the code comment - so remove it. Also set dev status as HISI_SAS_DEV_NORMAL as the hisi_sas_init_device() call. Link: https://lore.kernel.org/r/1652354134-171343-4-git-send-email-john.garry@huawei.com Fixes: 36c6b7613ef1 ("scsi: hisi_sas: Initialise devices in .slave_alloc callback") Tested-by: Yihang Li Reviewed-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 71453bd9d1bfa2a75f742ac8ad75c084097e9a50 Author: John Garry Date: Thu May 12 19:15:33 2022 +0800 scsi: hisi_sas: Use sas_ata_wait_after_reset() in IT nexus reset We have seen errors like this when a SATA device is probed: [524.566298] hisi_sas_v3_hw 0000L74:02.0: erroneous completion iptt=4096 ... [524.582827] sas: TMF task open reject failed 500e004aaaaaaaa00 Since commit 21c7e972475e ("scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure"), we issue an ATA softreset to disks after a phy reset to ensure that they are in sound working order. If the softreset is issued before the remote phy has come back up then the softreset will fail (errors as above). Remedy this by waiting for the phy to come back up after the reset. Link: https://lore.kernel.org/r/1652354134-171343-3-git-send-email-john.garry@huawei.com Tested-by: Yihang Li Reviewed-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 057e5fc03369f8f2ed9b2ca884754b1d80b83620 Author: John Garry Date: Thu May 12 19:15:32 2022 +0800 scsi: libsas: Refactor sas_ata_hard_reset() Create function sas_ata_wait_after_reset() from sas_ata_hard_reset() as some LLDDs may want to check for a remote ATA phy is up after reset. Link: https://lore.kernel.org/r/1652354134-171343-2-git-send-email-john.garry@huawei.com Tested-by: Yihang Li Reviewed-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 53d5088deff64c526ac52b39ce1244ce10372367 Author: Sreekanth Reddy Date: Wed May 11 12:56:21 2022 +0530 scsi: mpt3sas: Update driver version to 42.100.00.00 Update driver version to 42.100.00.00. Link: https://lore.kernel.org/r/20220511072621.30657-2-sreekanth.reddy@broadcom.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 8e129add48e0c35a8f1bf5df91f50a438dd75ba6 Author: Sreekanth Reddy Date: Wed May 11 12:56:20 2022 +0530 scsi: mpt3sas: Fix junk chars displayed while printing ChipName Terminate string after copying 16 bytes of ChipName data from Manufacturing Page0 to prevent %s from printing junk characters. Link: https://lore.kernel.org/r/20220511072621.30657-1-sreekanth.reddy@broadcom.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 5cebb40bc9554aafcc492431181f43c6231b0459 Author: Harini Katakam Date: Wed May 18 22:37:56 2022 +0530 net: macb: Fix PTP one step sync support PTP one step sync packets cannot have CSUM padding and insertion in SW since time stamp is inserted on the fly by HW. In addition, ptp4l version 3.0 and above report an error when skb timestamps are reported for packets that not processed for TX TS after transmission. Add a helper to identify PTP one step sync and fix the above two errors. Add a common mask for PTP header flag field "twoStepflag". Also reset ptp OSS bit when one step is not selected. Fixes: ab91f0a9b5f4 ("net: macb: Add hardware PTP support") Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") Signed-off-by: Harini Katakam Reviewed-by: Radhey Shyam Pandey Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220518170756.7752-1-harini.katakam@xilinx.com Signed-off-by: Jakub Kicinski commit 5876ee756c8169241d43f6bf769ac1e2fc186094 Author: Chen-Yu Tsai Date: Thu May 19 15:16:10 2022 +0800 clk: mediatek: mt8173: Switch to clk_hw provider APIs As part of the effort to improve the MediaTek clk drivers, the next step is to switch from the old 'struct clk' clk prodivder APIs to the new 'struct clk_hw' ones. The MT8173 clk driver has one clk that is registered directly with the clk provider APIs, instead of going through the MediaTek clk library. Switch this instance to use the clk_hw provider API. Signed-off-by: Chen-Yu Tsai Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Miles Chen Link: https://lore.kernel.org/r/20220519071610.423372-6-wenst@chromium.org Signed-off-by: Stephen Boyd commit 6f691a58629659577d98f0364b573c3dd11a3356 Author: Chen-Yu Tsai Date: Thu May 19 15:16:09 2022 +0800 clk: mediatek: Switch to clk_hw provider APIs As part of the effort to improve the MediaTek clk drivers, the next step is to switch from the old 'struct clk' clk prodivder APIs to the new 'struct clk_hw' ones. In a previous patch, 'struct clk_onecell_data' was replaced with 'struct clk_hw_onecell_data', with (struct clk_hw *)->clk and __clk_get_hw() bridging the new data structures and old code. Now switch from the old 'clk_(un)?register*()' APIs to the new 'clk_hw_(un)?register*()' ones. This is done with the coccinelle script below. Unfortunately this also leaves clk-mt8173.c with a compile error that would need a coccinelle script longer than the actual diff to fix. This last part is fixed up by hand. // Fix prototypes @@ identifier F =~ "^mtk_clk_register_"; @@ - struct clk * + struct clk_hw * F(...); // Fix calls to mtk_clk_register_ @ reg @ identifier F =~ "^mtk_clk_register_"; identifier FS =~ "^mtk_clk_register_[a-z_]*s"; identifier I; expression clk_data; expression E; @@ FS(...) { ... - struct clk *I; + struct clk_hw *hw; ... for (...;...;...) { ... ( - I + hw = - clk_register_fixed_rate( + clk_hw_register_fixed_rate( ... ); | - I + hw = - clk_register_fixed_factor( + clk_hw_register_fixed_factor( ... ); | - I + hw = - clk_register_divider( + clk_hw_register_divider( ... ); | - I + hw = F(...); ) ... if ( - IS_ERR(I) + IS_ERR(hw) ) { pr_err(..., - I + hw ,...); ... } - clk_data->hws[E] = __clk_get_hw(I); + clk_data->hws[E] = hw; } ... } @ depends on reg @ identifier reg.I; @@ return PTR_ERR( - I + hw ); // Fix mtk_clk_register_composite to return clk_hw instead of clk @@ identifier I, R; expression E; @@ - struct clk * + struct clk_hw * mtk_clk_register_composite(...) { ... - struct clk *I; + struct clk_hw *hw; ... - I = clk_register_composite( + hw = clk_hw_register_composite( ...); if (IS_ERR( - I + hw )) { ... R = PTR_ERR( - I + hw ); ... } return - I + hw ; ... } // Fix other mtk_clk_register_ to return clk_hw instead of clk @@ identifier F =~ "^mtk_clk_register_"; identifier I, D, C; expression E; @@ - struct clk * + struct clk_hw * F(...) { ... - struct clk *I; + int ret; ... - I = clk_register(D, E); + ret = clk_hw_register(D, E); ... ( - if (IS_ERR(I)) + if (ret) { kfree(C); + return ERR_PTR(ret); + } | - if (IS_ERR(I)) + if (ret) { kfree(C); - return I; + return ERR_PTR(ret); } ) - return I; + return E; } // Fix mtk_clk_unregister_ to take clk_hw instead of clk @@ identifier F =~ "^mtk_clk_unregister_"; identifier I, I2; @@ static void F( - struct clk *I + struct clk_hw *I2 ) { ... - struct clk_hw *I2; ... - I2 = __clk_get_hw(I); ... ( - clk_unregister(I); + clk_hw_unregister(I2); | - clk_unregister_composite(I); + clk_hw_unregister_composite(I2); ) ... } // Fix calls to mtk_clk_unregister_*() @@ identifier F =~ "^mtk_clk_unregister_"; expression I; expression E; @@ - F(I->hws[E]->clk); + F(I->hws[E]); Signed-off-by: Chen-Yu Tsai Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Miles Chen Link: https://lore.kernel.org/r/20220519071610.423372-5-wenst@chromium.org Signed-off-by: Stephen Boyd commit 609cc5e1a82394e0b704fd41439fa751f8a9edf2 Author: Chen-Yu Tsai Date: Thu May 19 15:16:08 2022 +0800 clk: mediatek: Replace 'struct clk' with 'struct clk_hw' As part of the effort to improve the MediaTek clk drivers, the next step is to switch from the old 'struct clk' clk prodivder APIs to the new 'struct clk_hw' ones. Instead of adding new APIs to the MediaTek clk driver library mirroring the existing ones, moving all drivers to the new APIs, and then removing the old ones, just migrate everything at the same time. This involves replacing 'struct clk' with 'struct clk_hw', and 'struct clk_onecell_data' with 'struct clk_hw_onecell_data', and fixing up all usages. For now, the clk_register() and co. usage is retained, with __clk_get_hw() and (struct clk_hw *)->clk used to bridge the difference between the APIs. These will be replaced in subsequent patches. Fix up mtk_{alloc,free}_clk_data to use 'struct clk_hw' by hand. Fix up all other affected call sites with the following coccinelle script. // Replace type @@ @@ - struct clk_onecell_data + struct clk_hw_onecell_data // Replace of_clk_add_provider() & of_clk_src_simple_get() @@ expression NP, DATA; symbol of_clk_src_onecell_get; @@ - of_clk_add_provider( + of_clk_add_hw_provider( NP, - of_clk_src_onecell_get, + of_clk_hw_onecell_get, DATA ) // Fix register/unregister @@ identifier CD; expression E; identifier fn =~ "unregister"; @@ fn(..., - CD->clks[E] + CD->hws[E]->clk ,... ); // Fix calls to clk_prepare_enable() @@ identifier CD; expression E; @@ clk_prepare_enable( - CD->clks[E] + CD->hws[E]->clk ); // Fix pointer assignment @@ identifier CD; identifier CLK; expression E; @@ - CD->clks[E] + CD->hws[E] = ( - CLK + __clk_get_hw(CLK) | ERR_PTR(...) ) ; // Fix pointer usage @@ identifier CD; expression E; @@ - CD->clks[E] + CD->hws[E] // Fix mtk_clk_pll_get_base() @@ symbol clk, hw, data; @@ mtk_clk_pll_get_base( - struct clk *clk, + struct clk_hw *hw, const struct mtk_pll_data *data ) { - struct clk_hw *hw = __clk_get_hw(clk); ... } // Fix mtk_clk_pll_get_base() usage @@ identifier CD; expression E; @@ mtk_clk_pll_get_base( - CD->clks[E] + CD->hws[E]->clk ,... ); Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Miles Chen Tested-by: AngeloGioacchino Del Regno Tested-by: Miles Chen Link: https://lore.kernel.org/r/20220519071610.423372-4-wenst@chromium.org Signed-off-by: Stephen Boyd commit 012715ad7cc44b70d29a8dfa87448ecddba608d0 Author: Chen-Yu Tsai Date: Thu May 19 15:16:07 2022 +0800 clk: mediatek: apmixed: Drop error message from clk_register() failure mtk_clk_register_ref2usb_tx() prints an error message if clk_register() fails. It doesn't if kzalloc() fails though. The caller would then tack on its own error message to handle this. Also, All other clk registration functions in the MediaTek clk library leave the error message printing to the bulk registration functions, while the helpers that register individual clks just return error codes. Drop the error message that is printed when clk_register() fails in mtk_clk_register_ref2usb_tx() to make its behavior consistent both across its failure modes, and with the rest of the driver library. Signed-off-by: Chen-Yu Tsai Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Miles Chen Link: https://lore.kernel.org/r/20220519071610.423372-3-wenst@chromium.org Signed-off-by: Stephen Boyd commit f247c17d03e476c47c3de9dab41f0e89391a1e0b Author: Chen-Yu Tsai Date: Thu May 19 15:16:06 2022 +0800 clk: mediatek: Make mtk_clk_register_composite() static mtk_clk_register_composite() is not used anywhere outside of the file it is defined. Make it static. Fixes: 9741b1a68035 ("clk: mediatek: Add initial common clock support for Mediatek SoCs.") Signed-off-by: Chen-Yu Tsai Reviewed-by: Miles Chen Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Miles Chen Link: https://lore.kernel.org/r/20220519071610.423372-2-wenst@chromium.org Signed-off-by: Stephen Boyd commit af629ec8ec31fa250251f940f2d21a742b3d9e0a Merge: 3123109284176 b35f27fe73d8c Author: Stephen Boyd Date: Thu May 19 16:54:31 2022 -0700 Merge tag 'clk-v5.19-samsung' of https://git.kernel.org/pub/scm/linux/kernel/git/snawrocki/clk into clk-samsung Pull Samsung clk driver updates from Sylwester Nawrocki: - clock driver for exynosautov9 SoC * tag 'clk-v5.19-samsung' of https://git.kernel.org/pub/scm/linux/kernel/git/snawrocki/clk: clk: samsung: exynosautov9: add cmu_peric1 clock support clk: samsung: exynosautov9: add cmu_peric0 clock support clk: samsung: exynosautov9: add cmu_fsys2 clock support clk: samsung: exynosautov9: add cmu_busmc clock support clk: samsung: exynosautov9: add cmu_peris clock support clk: samsung: exynosautov9: add cmu_core clock support clk: samsung: add top clock support for Exynos Auto v9 SoC dt-bindings: clock: add Exynos Auto v9 SoC CMU bindings dt-bindings: clock: add clock binding definitions for Exynos Auto v9 commit fcf8962827b4fb224a10c786b0f048f444b76384 Merge: d353e1a3bafd4 1a6dd99966998 Author: Jakub Kicinski Date: Thu May 19 16:49:05 2022 -0700 Merge tag 'linux-can-next-for-5.19-20220519' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2022-05-19 Oliver Hartkopp contributes a patch for the ISO-TP CAN protocol to update the validation of address information during bind. The next patch is by Jakub Kicinski and converts the CAN network drivers from netif_napi_add() to the netif_napi_add_weight() function. Another patch by Oliver Hartkopp removes obsolete CAN specific LED support. Vincent Mailhol's patch for the mcp251xfd driver fixes a -Wunaligned-access warning by clang-14. * tag 'linux-can-next-for-5.19-20220519' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: mcp251xfd: silence clang's -Wunaligned-access warning can: can-dev: remove obsolete CAN LED support can: can-dev: move to netif_napi_add_weight() can: isotp: isotp_bind(): do not validate unused address information ==================== Link: https://lore.kernel.org/r/20220519202308.1435903-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 83a7a614ce584c469bf8abfc2cd539701bd7d4e9 Merge: 7eb6369d7acfe 838b3e28488f7 Author: Palmer Dabbelt Date: Thu May 19 15:18:47 2022 -0700 riscv: kexec: add kexec_file_load() support This patch set implements kexec_file_load() for RISC-V, which is currently only allowed on rv64 due to some minor build issues on 32-bit platforms in the generic code. This allows users to kexec() using an FD as opposed to a buffer. Link: https://lore.kernel.org/all/20220408100914.150110-1-lizhengyu3@huawei.com/ * palmer/riscv-kexec_file: RISC-V: Load purgatory in kexec_file RISC-V: Add purgatory RISC-V: Support for kexec_file on panic RISC-V: Add kexec_file support RISC-V: use memcpy for kexec_file mode kexec_file: Fix kexec_file.c build error for riscv platform commit 6a31a95135da0bb2c5349e49e37d76e9909ab7ea Author: Phillip Potter Date: Thu May 19 23:10:47 2022 +0100 staging: r8188eu: remove include/rtw_debug.h Remove include/rtw_debug.h, as all it now has are: (1) A load of unused preprocessor definitions that expand to BIT(x) variants. (2) A preprocessor definition that expands to the name of the driver and is only used in one place inside a pr_info_once call in core/rtw_fw.c. It is now surplus to requirements after fixing up the few places that include the file. Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220519221047.6940-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit f538ce1123856422be2e2f2bad9b51cf39ca94c1 Author: Rob Herring Date: Thu Apr 28 10:41:54 2022 -0500 dt-bindings: clock: Replace common binding with link to schema The contents of the clock binding have been moved to the clock binding schema in the dtschema repository. The desire is for common bindings to be hosted in the dtschema repository. Replace the contents with a link to the clock binding schema as there are still many references to clock-bindings.txt in the tree. This will prevent additions without a schema. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220428154154.2284317-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 22511e665eadc2c49021886d07aaef39db90ca82 Author: Matthew Gerlach Date: Sun May 8 07:26:24 2022 -0700 arm64: dts: intel: add device tree for n6000 Add a device tree for the n6000 instantiation of Agilex Hard Processor System (HPS). Signed-off-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit af657d7f40423bac0c898e0d89a3539ea0d1043a Author: Matthew Gerlach Date: Sun May 8 07:26:23 2022 -0700 dt-bindings: intel: add binding for Intel n6000 Add the binding string for the Agilex based Intel n6000 board. Signed-off-by: Matthew Gerlach Acked-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 79af73b31ab281277cec8f5d102364b9c64588c1 Author: Matthew Gerlach Date: Sun May 8 07:26:22 2022 -0700 dt-bindings: soc: add bindings for Intel HPS Copy Engine Add device tree bindings documentation for the Intel Hard Processor System (HPS) Copy Engine. Signed-off-by: Matthew Gerlach Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 0ae084d5a6744b1318407d8e20fb88ac0fd85d47 Author: Hans de Goede Date: Thu May 19 17:21:50 2022 +0200 x86/PCI: Disable E820 reserved region clipping starting in 2023 Some firmware includes unusable space (host bridge registers, hidden PCI device BARs, etc) in PCI host bridge _CRS. As far as we know, there's nothing in the ACPI, UEFI, or PCI Firmware spec that requires the OS to remove E820 reserved regions from _CRS, so this seems like a firmware defect. As a workaround, 4dc2287c1805 ("x86: avoid E820 regions when allocating address space") has clipped out the unusable space in the past. This is required for machines like the following: - Dell Precision T3500 (the original motivator for 4dc2287c1805); see https://bugzilla.kernel.org/show_bug.cgi?id=16228 - Asus C523NA (Coral) Chromebook; see https://lore.kernel.org/all/4e9fca2f-0af1-3684-6c97-4c35befd5019@redhat.com/ - Lenovo ThinkPad X1 Gen 2; see: https://bugzilla.redhat.com/show_bug.cgi?id=2029207 But other firmware supplies E820 reserved regions that cover entire _CRS windows, and clipping throws away the entire window, leaving none for hot-added or uninitialized devices. This clipping breaks a whole range of Lenovo IdeaPads, Yogas, Yoga Slims, and notebooks, as well as Acer Spin 5 and Clevo X170KM-G Barebone machines. E820 reserved entries that cover a memory-mapped PCI host bridge, including its registers and memory/IO windows, are probably *not* a firmware defect. Per ACPI v5.4, sec 15.2, the E820 memory map may include: Address ranges defined for baseboard memory-mapped I/O devices, such as APICs, are returned as reserved. Disable the E820 clipping by default for all post-2022 machines. We already have quirks to disable clipping for pre-2023 machines, and we'll likely need quirks to *enable* clipping for post-2022 machines that incorrectly include unusable space in _CRS, including Chromebooks and Lenovo ThinkPads. Here's the rationale for doing this. If we do nothing, and continue clipping by default: - Future systems like the Lenovo IdeaPads, Yogas, etc, Acer Spin, and Clevo Barebones will require new quirks to disable clipping. - The problem here is E820 entries that cover entire _CRS windows that should not be clipped out. - I think these E820 entries are legal per spec, and it would be hard to get BIOS vendors to change them. - We will discover new systems that need clipping disabled piecemeal as they are released. - Future systems like Lenovo X1 Carbon and the Chromebooks (probably anything using coreboot) will just work, even though their _CRS is incorrect, so we will not notice new ones that rely on the clipping. - BIOS updates will not require new quirks unless they change the DMI model string. If we add the date check in this commit that disables clipping, e.g., "no clipping when date >= 2023": - Future systems like Lenovo *IIL*, Acer Spin, and Clevo Barebones will just work without new quirks. - Future systems like Lenovo X1 Carbon and the Chromebooks will require new quirks to *enable* clipping. - The problem here is that _CRS contains regions that are not usable by PCI devices, and we rely on the E820 kludge to clip them out. - I think this use of E820 is clearly a firmware bug, so we have a fighting chance of getting it changed eventually. - BIOS updates after the cutoff date *will* require quirks, but only for systems like Lenovo X1 Carbon and Chromebooks that we already think have broken firmware. It seems to me like it's better to add quirks for firmware that we think is broken than for firmware that seems unusual but correct. [bhelgaas: comment and commit log] Link: https://lore.kernel.org/linux-pci/20220518220754.GA7911@bhelgaas/ Link: https://lore.kernel.org/r/20220519152150.6135-4-hdegoede@redhat.com Signed-off-by: Hans de Goede Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: Benoit Grégoire Cc: Hui Wang commit d341838d776abadb3ac48abdd2f1f40df5a4fc10 Author: Hans de Goede Date: Thu May 19 17:21:49 2022 +0200 x86/PCI: Disable E820 reserved region clipping via quirks To avoid unusable space that some firmware includes in PCI host bridge _CRS, Linux currently excludes E820 reserved regions from _CRS windows; see 4dc2287c1805 ("x86: avoid E820 regions when allocating address space"). However, some systems supply E820 reserved regions that cover the entire memory window from _CRS, so clipping them out leaves no space for hot-added or uninitialized PCI devices. For example, from a Lenovo IdeaPad 3 15IIL 81WE: BIOS-e820: [mem 0x4bc50000-0xcfffffff] reserved pci_bus 0000:00: root bus resource [mem 0x65400000-0xbfffffff window] pci 0000:00:15.0: BAR 0: [mem 0x00000000-0x00000fff 64bit] pci 0000:00:15.0: BAR 0: no space for [mem size 0x00001000 64bit] Add quirks to disable the E820 clipping for machines known to do this. A single DMI_PRODUCT_VERSION "IIL" quirk matches all the below: Lenovo IdeaPad 3 14IIL05 Lenovo IdeaPad 3 15IIL05 Lenovo IdeaPad 3 17IIL05 Lenovo IdeaPad 5 14IIL05 Lenovo IdeaPad 5 15IIL05 Lenovo IdeaPad Slim 7 14IIL05 Lenovo IdeaPad Slim 7 15IIL05 Lenovo IdeaPad S145-15IIL Lenovo IdeaPad S340-14IIL Lenovo IdeaPad S340-15IIL Lenovo IdeaPad C340-15IIL Lenovo BS145-15IIL Lenovo V14-IIL Lenovo V15-IIL Lenovo V17-IIL Lenovo Yoga C940-14IIL Lenovo Yoga S740-14IIL Lenovo Yoga Slim 7 14IIL05 Lenovo Yoga Slim 7 15IIL05 in addition to the following that don't actually need it because they have no E820 reserved regions that overlap _CRS windows: Lenovo IdeaPad Flex 5 14IIL05 Lenovo IdeaPad Flex 5 15IIL05 Lenovo ThinkBook 14-IIL Lenovo ThinkBook 15-IIL Lenovo Yoga S940-14IIL Other quirks match these: Acer Spin 5 (SP513-54N) Clevo X170KM-G Barebone Link: https://bugzilla.kernel.org/show_bug.cgi?id=206459 Lenovo Yoga C940-14IIL Link: https://bugzilla.kernel.org/show_bug.cgi?id=214259 Clevo X170KM Barebone Link: https://bugzilla.redhat.com/show_bug.cgi?id=1868899 Lenovo IdeaPad 3 15IIL05 Link: https://bugzilla.redhat.com/show_bug.cgi?id=1871793 Lenovo IdeaPad 5 14IIL05 Link: https://bugs.launchpad.net/bugs/1878279 Lenovo IdeaPad 5 14IIL05 Link: https://bugs.launchpad.net/bugs/1880172 Lenovo IdeaPad 3 14IIL05 Link: https://bugs.launchpad.net/bugs/1884232 Acer Spin SP513-54N Link: https://bugs.launchpad.net/bugs/1921649 Lenovo IdeaPad S145 Link: https://bugs.launchpad.net/bugs/1931715 Lenovo IdeaPad S145 Link: https://bugs.launchpad.net/bugs/1932069 Lenovo BS145-15IIL Link: https://lore.kernel.org/r/20220519152150.6135-3-hdegoede@redhat.com Signed-off-by: Hans de Goede Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: Benoit Grégoire Cc: Hui Wang commit bae19fdd7e9e759580ac4693d2df3bc23ab415d7 Author: Sandipan Das Date: Wed May 18 14:13:27 2022 +0530 perf/x86/amd/core: Fix reloading events for SVM Commit 1018faa6cf23 ("perf/x86/kvm: Fix Host-Only/Guest-Only counting with SVM disabled") addresses an issue in which the Host-Only bit in the counter control registers needs to be masked off when SVM is not enabled. The events need to be reloaded whenever SVM is enabled or disabled for a CPU and this requires the PERF_CTL registers to be reprogrammed using {enable,disable}_all(). However, PerfMonV2 variants of these functions do not reprogram the PERF_CTL registers. Hence, the legacy enable_all() function should also be called. Fixes: 9622e67e3980 ("perf/x86/amd/core: Add PerfMonV2 counter control") Reported-by: Like Xu Signed-off-by: Sandipan Das Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220518084327.464005-1-sandipan.das@amd.com commit 991d8d8142cad94f9c5c05db25e67fa83d6f772a Author: Dietmar Eggemann Date: Fri May 13 11:34:33 2022 +0200 topology: Remove unused cpu_cluster_mask() default_topology[] uses cpu_clustergroup_mask() for the CLS level (guarded by CONFIG_SCHED_CLUSTER) which is currently provided by x86 (arch/x86/kernel/smpboot.c) and arm64 (drivers/base/arch_topology.c). Fixes: 778c558f49a2c ("sched: Add cluster scheduler level in core and related Kconfig for ARM64") Signed-off-by: Dietmar Eggemann Signed-off-by: Peter Zijlstra (Intel) Acked-by: Barry Song Link: https://lore.kernel.org/r/20220513093433.425163-1-dietmar.eggemann@arm.com commit 546a3fee174969ff323d70ff27b1ef181f0d7ceb Author: Peter Zijlstra Date: Tue May 17 13:46:54 2022 +0200 sched: Reverse sched_class layout Because GCC-12 is fully stupid about array bounds and it's just really hard to get a solid array definition from a linker script, flip the array order to avoid needing negative offsets :-/ This makes the whole relational pointer magic a little less obvious, but alas. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Link: https://lkml.kernel.org/r/YoOLLmLG7HRTXeEm@hirez.programming.kicks-ass.net commit 69505e3d9a39a988aaed9b58aa6b3482238f6516 Author: Josh Poimboeuf Date: Thu May 12 06:56:23 2022 -0700 bug: Use normal relative pointers in 'struct bug_entry' With CONFIG_GENERIC_BUG_RELATIVE_POINTERS, the addr/file relative pointers are calculated weirdly: based on the beginning of the bug_entry struct address, rather than their respective pointer addresses. Make the relative pointers less surprising to both humans and tools by calculating them the normal way. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mark Rutland Acked-by: Peter Zijlstra (Intel) Acked-by: Sven Schnelle # s390 Acked-by: Michael Ellerman (powerpc) Acked-by: Catalin Marinas Tested-by: Mark Rutland [arm64] Link: https://lkml.kernel.org/r/f0e05be797a16f4fc2401eeb88c8450dcbe61df6.1652362951.git.jpoimboe@kernel.org commit 8491d1bdf5de152f27fc941e2dcdc4e66c950542 Author: Uros Bizjak Date: Wed May 18 20:49:53 2022 +0200 sched/clock: Use try_cmpxchg64 in sched_clock_{local,remote} Use try_cmpxchg64 instead of cmpxchg64 (*ptr, old, new) != old in sched_clock_{local,remote}. x86 cmpxchg returns success in ZF flag, so this change saves a compare after cmpxchg (and related move instruction in front of cmpxchg). Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220518184953.3446778-1-ubizjak@gmail.com commit 036c07c0c3b8a57d5c96e1f2aab62da0056f8f21 Author: Josh Poimboeuf Date: Thu May 19 11:46:58 2022 -0700 x86/entry: Fix register corruption in compat syscall A panic was reported in the init process on AMD: Run /sbin/init as init process init[1]: segfault at f7fd5ca0 ip 00000000f7f5bbc7 sp 00000000ffa06aa0 error 7 in libc.so[f7f51000+4e000] Code: 8a 44 24 10 88 41 ff 8b 44 24 10 83 c4 2c 5b 5e 5f 5d c3 53 83 ec 08 8b 5c 24 10 81 fb 00 f0 ff ff 76 0c e8 ba dc ff ff f7 db <89> 18 83 cb ff 83 c4 08 89 d8 5b c3 e8 81 60 ff ff 05 28 84 07 00 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 1 PID: 1 Comm: init Tainted: G W 5.18.0-rc7-next-20220519 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x57/0x7d panic+0x10f/0x28d do_exit.cold+0x18/0x48 do_group_exit+0x2e/0xb0 get_signal+0xb6d/0xb80 arch_do_signal_or_restart+0x31/0x760 ? show_opcodes.cold+0x1c/0x21 ? force_sig_fault+0x49/0x70 exit_to_user_mode_prepare+0x131/0x1a0 irqentry_exit_to_user_mode+0x5/0x30 asm_exc_page_fault+0x27/0x30 RIP: 0023:0xf7f5bbc7 Code: 8a 44 24 10 88 41 ff 8b 44 24 10 83 c4 2c 5b 5e 5f 5d c3 53 83 ec 08 8b 5c 24 10 81 fb 00 f0 ff ff 76 0c e8 ba dc ff ff f7 db <89> 18 83 cb ff 83 c4 08 89 d8 5b c3 e8 81 60 ff ff 05 28 84 07 00 RSP: 002b:00000000ffa06aa0 EFLAGS: 00000217 RAX: 00000000f7fd5ca0 RBX: 000000000000000c RCX: 0000000000001000 RDX: 0000000000000001 RSI: 00000000f7fd5b60 RDI: 00000000f7fd5b60 RBP: 00000000f7fd1c1c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The task's CX register got corrupted by commit 8c42819b61b8 ("x86/entry: Use PUSH_AND_CLEAR_REGS for compat"), which overlooked the fact that compat SYSCALL apparently stores the user's CX value in BP. Before that commit, CX was saved from its stashed value in BP: pushq %rbp /* pt_regs->cx (stashed in bp) */ But then it got changed to: pushq %rcx /* pt_regs->cx */ So the wrong value got saved and later restored back to the user. Fix it by pushing the correct value again (BP) for regs->cx. Fixes: 8c42819b61b8 ("x86/entry: Use PUSH_AND_CLEAR_REGS for compat") Reported-by: Guenter Roeck Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Tested-by: Guenter Roeck Link: https://lkml.kernel.org/r/b5a26592c9dd60bbacdf97974a7433fd802a5593.1652985970.git.jpoimboe@kernel.org commit 703db1f5da1e3a62b84356a29c150efa24a2377d Author: Bjorn Andersson Date: Tue Apr 26 14:21:36 2022 -0700 clk: qcom: rcg2: Cache CFG register updates for parked RCGs As GDSCs are turned on and off some associated clocks are momentarily enabled for house keeping purposes. For this, and similar, purposes the "shared RCGs" will park the RCG on a source clock which is known to be available. When the RCG is parked, a safe clock source will be selected and committed, then the original source would be written back and upon enable the change back to the unparked source would be committed. But starting with SM8350 this fails, as the value in CFG is committed by the GDSC handshake and without a ticking parent the GDSC enablement will time out. This becomes a concrete problem if the runtime supended state of a device includes disabling such rcg's parent clock. As the device attempts to power up the domain again the rcg will fail to enable and hence the GDSC enablement will fail, preventing the device from returning from the suspended state. This can be seen in e.g. the display stack during probe on SM8350. To avoid this problem, the software needs to ensure that the RCG is configured to a active parent clock while it is disabled. This is done by caching the CFG register content while the shared RCG is parked on this safe source. Writes to M, N and D registers are committed as they are requested. New helpers for get_parent() and recalc_rate() are extracted from their previous implementations and __clk_rcg2_configure() is modified to allow it to operate on the cached value. Fixes: 7ef6f11887bd ("clk: qcom: Configure the RCGs to a safe source as needed") Signed-off-by: Bjorn Andersson Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20220426212136.1543984-1-bjorn.andersson@linaro.org commit d65d005f9a6cffb1efb205f3af4d0de8f1e3b352 Author: Bjorn Andersson Date: Wed May 4 19:54:57 2022 -0700 clk: qcom: add sc8280xp GCC driver Add support for the Global Clock Controller found in the Qualcomm SC8280XP platform. Signed-off-by: Bjorn Andersson Reviewed-by: Vinod Koul Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20220505025457.1693716-3-bjorn.andersson@linaro.org commit a66a82f2a55ef1f47daeb45e0b4074d88ce5ca99 Author: Bjorn Andersson Date: Wed May 4 19:54:56 2022 -0700 dt-bindings: clock: Add Qualcomm SC8280XP GCC bindings Add binding for the Qualcomm SC8280XP Global Clock controller. The clock-names property is purposefully omitted, to clearly communicate to the writer (and reader) of the DeviceTree source based on this binding that the order of "clocks" is significant, in contrast to previous GCC bindings. Signed-off-by: Bjorn Andersson Reviewed-by: Stephen Boyd Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220505025457.1693716-2-bjorn.andersson@linaro.org commit 69bc169ec33f101fe6d296976aaa34f51edbaa9e Author: Colin Ian King Date: Tue May 17 10:36:46 2022 +0100 fs/ntfs: remove redundant variable idx The variable idx is assigned a value and is never read. The variable is not used and is redundant, remove it. Cleans up clang scan build warning: warning: Although the value stored to 'idx' is used in the enclosing expression, the value is never actually read from 'idx' [deadcode.DeadStores] Link: https://lkml.kernel.org/r/20220517093646.93628-2-colin.i.king@gmail.com Signed-off-by: Colin Ian King Reviewed-by: Anton Altaparmakov Signed-off-by: Andrew Morton commit 1213375077451337c2381a8b5b88502a3fc394a2 Author: Chung-Chiang Cheng Date: Tue May 3 23:25:36 2022 +0800 fat: remove time truncations in vfat_create/vfat_mkdir All the timestamps in vfat_create() and vfat_mkdir() come from fat_time_fat2unix() which ensures time granularity. We don't need to truncate them to fit FAT's format. Moreover, fat_truncate_crtime() and fat_timespec64_trunc_10ms() are also removed because there is no caller anymore. Link: https://lkml.kernel.org/r/20220503152536.2503003-4-cccheng@synology.com Signed-off-by: Chung-Chiang Cheng Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton commit 30abce053f811f52688a5b739c3e4ba98d34070d Author: Chung-Chiang Cheng Date: Tue May 3 23:25:35 2022 +0800 fat: report creation time in statx creation time is no longer mixed with change time. Add an in-memory field for it, and report it in statx if supported. Link: https://lkml.kernel.org/r/20220503152536.2503003-3-cccheng@synology.com Signed-off-by: Chung-Chiang Cheng Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton commit 0f9d148167c53a7029aba29cdc45072027033b72 Author: Chung-Chiang Cheng Date: Tue May 3 23:25:34 2022 +0800 fat: ignore ctime updates, and keep ctime identical to mtime in memory FAT supports creation time but not change time, and there was no corresponding timestamp for creation time in previous VFS. The original implementation took the compromise of saving the in-memory change time into the on-disk creation time field, but this would lead to compatibility issues with non-linux systems. To address this issue, this patch changes the behavior of ctime. It will no longer be loaded and stored from the creation time on disk. Instead of that, it'll be consistent with the in-memory mtime and share the same on-disk field. All updates to mtime will also be applied to ctime in memory, while all updates to ctime will be ignored. Link: https://lkml.kernel.org/r/20220503152536.2503003-2-cccheng@synology.com Signed-off-by: Chung-Chiang Cheng Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton commit 4dcc3f96e7439f9a3a6e47d7fc147aad1338ddc4 Author: Chung-Chiang Cheng Date: Tue May 3 23:25:33 2022 +0800 fat: split fat_truncate_time() into separate functions Separate fat_truncate_time() to each timestamps for later creation time work. This patch does not introduce any functional changes, it's merely refactoring change. Link: https://lkml.kernel.org/r/20220503152536.2503003-1-cccheng@synology.com Signed-off-by: Chung-Chiang Cheng Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton commit 504ed164d7cd858d25ed5e3413928e1397f4c567 Author: Muchun Song Date: Tue May 17 22:33:20 2022 +0800 MAINTAINERS: add Muchun as a memcg reviewer I have been focusing on mm for the past two years. e.g. developing, fixing bugs, reviewing. I have fixed lots of races (including memcg). I would like to help people working on memcg or related by reviewing their work. Let me be Cc'd on patches related to memcg. Link: https://lkml.kernel.org/r/20220517143320.99649-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: Shakeel Butt Acked-by: Michal Hocko Acked-by: Johannes Weiner Acked-by: Roman Gushchin Acked-by: FanJun Kong Signed-off-by: Andrew Morton commit 02e34fff195d3a5f67cbb553795dc109a37d1dcf Author: Kefeng Wang Date: Tue May 17 22:51:20 2022 +0800 mm: damon: use HPAGE_PMD_SIZE Use HPAGE_PMD_SIZE instead of open coding. Link: https://lkml.kernel.org/r/20220517145120.118523-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 2b132903de7124dd9a758be0c27562e91a510848 Author: Vasily Averin Date: Wed May 11 12:46:53 2022 +0300 tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Fixes following sparse warnings: CHECK mm/vmscan.c mm/vmscan.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/vmscan.h): ./include/trace/events/vmscan.h:281:1: sparse: warning: cast to restricted isolate_mode_t ./include/trace/events/vmscan.h:281:1: sparse: warning: restricted isolate_mode_t degrades to integer Link: https://lkml.kernel.org/r/e85d7ff2-fd10-53f8-c24e-ba0458439c1b@openvz.org Signed-off-by: Vasily Averin Acked-by: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 37462a920392cb86541650a6f4121155f11f1199 Author: Christophe de Dinechin Date: Thu Apr 14 17:08:54 2022 +0200 nodemask.h: fix compilation error with GCC12 With gcc version 12.0.1 20220401 (Red Hat 12.0.1-0), building with defconfig results in the following compilation error: | CC mm/swapfile.o | mm/swapfile.c: In function `setup_swap_info': | mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds | of `struct plist_node[]' [-Werror=array-bounds] | 2291 | p->avail_lists[i].prio = 1; | | ~~~~~~~~~~~~~~^~~ | In file included from mm/swapfile.c:16: | ./include/linux/swap.h:292:27: note: while referencing `avail_lists' | 292 | struct plist_node avail_lists[]; /* | | ^~~~~~~~~~~ This is due to the compiler detecting that the mask in node_states[__state] could theoretically be zero, which would lead to first_node() returning -1 through find_first_bit. I believe that the warning/error is legitimate. I first tried adding a test to check that the node mask is not emtpy, since a similar test exists in the case where MAX_NUMNODES == 1. However, adding the if statement causes other warnings to appear in for_each_cpu_node_but, because it introduces a dangling else ambiguity. And unfortunately, GCC is not smart enough to detect that the added test makes the case where (node) == -1 impossible, so it still complains with the same message. This is why I settled on replacing that with a harmless, but relatively useless (node) >= 0 test. Based on the warning for the dangling else, I also decided to fix the case where MAX_NUMNODES == 1 by moving the condition inside the for loop. It will still only be tested once. This ensures that the meaning of an else following for_each_node_mask or derivatives would not silently have a different meaning depending on the configuration. Link: https://lkml.kernel.org/r/20220414150855.2407137-3-dinechin@redhat.com Signed-off-by: Christophe de Dinechin Signed-off-by: Christophe de Dinechin Reviewed-by: Andrew Morton Cc: Ben Segall Cc: "Michael S. Tsirkin" Cc: Steven Rostedt Cc: Ingo Molnar Cc: Mel Gorman Cc: Dietmar Eggemann Cc: Vincent Guittot Cc: Paolo Bonzini Cc: Daniel Bristot de Oliveira Cc: Jason Wang Cc: Zhen Lei Cc: Juri Lelli Cc: Peter Zijlstra Cc: Signed-off-by: Andrew Morton commit 3f913fc5f9745613088d3c569778c9813ab9c129 Author: Qi Zheng Date: Thu May 19 14:08:55 2022 -0700 mm: fix missing handler for __GFP_NOWARN We expect no warnings to be issued when we specify __GFP_NOWARN, but currently in paths like alloc_pages() and kmalloc(), there are still some warnings printed, fix it. But for some warnings that report usage problems, we don't deal with them. If such warnings are printed, then we should fix the usage problems. Such as the following case: WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1)); [zhengqi.arch@bytedance.com: v2] Link: https://lkml.kernel.org/r/20220511061951.1114-1-zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/20220510113809.80626-1-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Cc: Akinobu Mita Cc: Vlastimil Babka Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 10e0f7530205799e7e971aba699a7cb3a47456de Author: Wonhyuk Yang Date: Thu May 19 14:08:54 2022 -0700 mm/page_alloc: fix tracepoint mm_page_alloc_zone_locked() Currently, trace point mm_page_alloc_zone_locked() doesn't show correct information. First, when alloc_flag has ALLOC_HARDER/ALLOC_CMA, page can be allocated from MIGRATE_HIGHATOMIC/MIGRATE_CMA. Nevertheless, tracepoint use requested migration type not MIGRATE_HIGHATOMIC and MIGRATE_CMA. Second, after commit 44042b4498728 ("mm/page_alloc: allow high-order pages to be stored on the per-cpu lists") percpu-list can store high order pages. But trace point determine whether it is a refiil of percpu-list by comparing requested order and 0. To handle these problems, make mm_page_alloc_zone_locked() only be called by __rmqueue_smallest with correct migration type. With a new argument called percpu_refill, it can show roughly whether it is a refill of percpu-list. Link: https://lkml.kernel.org/r/20220512025307.57924-1-vvghjk1234@gmail.com Signed-off-by: Wonhyuk Yang Acked-by: Mel Gorman Cc: Baik Song An Cc: Hong Yeon Kim Cc: Taeung Song Cc: Cc: Steven Rostedt Cc: Ingo Molnar Signed-off-by: Andrew Morton commit 3645b5ec0ad644942e363c9a695a6f4c783c0a43 Author: Fanjun Kong Date: Mon May 16 11:00:42 2022 +0800 mm/page_owner.c: add missing __initdata attribute This patch fixes two issues: 1. Add __initdata attribute according to include/linux/init.h: For initialized data: You should insert __initdata between the variable name and equal sign followed by value 2. Fix below error reported by checkpatch.pl: ERROR: do not initialise statics to false Special thanks to Muchun Song :) Link: https://lkml.kernel.org/r/20220516030039.1487005-1-bh1scw@gmail.com Signed-off-by: Fanjun Kong Suggested-by: Muchun Song Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit d14f5efadd846dbde561bd734318de6a9e6b26e6 Author: Luo Meng Date: Fri May 13 10:52:25 2022 +0800 tmpfs: fix undefined-behaviour in shmem_reconfigure() When shmem_reconfigure() calls __percpu_counter_compare(), the second parameter is unsigned long long. But in the definition of __percpu_counter_compare(), the second parameter is s64. So when __percpu_counter_compare() executes abs(count - rhs), UBSAN shows the following warning: ================================================================================ UBSAN: Undefined behaviour in lib/percpu_counter.c:209:6 signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long long int' CPU: 1 PID: 9636 Comm: syz-executor.2 Tainted: G ---------r- - 4.18.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack home/install/linux-rh-3-10/lib/dump_stack.c:77 [inline] dump_stack+0x125/0x1ae home/install/linux-rh-3-10/lib/dump_stack.c:117 ubsan_epilogue+0xe/0x81 home/install/linux-rh-3-10/lib/ubsan.c:159 handle_overflow+0x19d/0x1ec home/install/linux-rh-3-10/lib/ubsan.c:190 __percpu_counter_compare+0x124/0x140 home/install/linux-rh-3-10/lib/percpu_counter.c:209 percpu_counter_compare home/install/linux-rh-3-10/./include/linux/percpu_counter.h:50 [inline] shmem_remount_fs+0x1ce/0x6b0 home/install/linux-rh-3-10/mm/shmem.c:3530 do_remount_sb+0x11b/0x530 home/install/linux-rh-3-10/fs/super.c:888 do_remount home/install/linux-rh-3-10/fs/namespace.c:2344 [inline] do_mount+0xf8d/0x26b0 home/install/linux-rh-3-10/fs/namespace.c:2844 ksys_mount+0xad/0x120 home/install/linux-rh-3-10/fs/namespace.c:3075 __do_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3089 [inline] __se_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3086 [inline] __x64_sys_mount+0xbf/0x160 home/install/linux-rh-3-10/fs/namespace.c:3086 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf RIP: 0033:0x46b5e9 Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f54d5f22c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046b5e9 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 000000000077bf60 R08: 0000000020000140 R09: 0000000000000000 R10: 00000000026740a4 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd1fb1592f R14: 00007f54d5f239c0 R15: 000000000077bf6c ================================================================================ [akpm@linux-foundation.org: tweak error message text] Link: https://lkml.kernel.org/r/20220513025225.2678727-1-luomeng12@huawei.com Signed-off-by: Luo Meng Cc: Hugh Dickins Cc: Yu Kuai Signed-off-by: Andrew Morton commit 018160ad314d75b1409129b2247b614a9f35894c Author: Wang Cheng Date: Thu May 19 14:08:54 2022 -0700 mm/mempolicy: fix uninit-value in mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). Link: https://lkml.kernel.org/r/20220512123428.fq3wofedp6oiotd4@ppc.localdomain Signed-off-by: Wang Cheng Reported-by: Tested-by: Cc: David Rientjes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6d4675e601357834dadd2ba1d803f6484596015c Author: Minchan Kim Date: Thu May 19 14:08:54 2022 -0700 mm: don't be stuck to rmap lock on reclaim path The rmap locks(i_mmap_rwsem and anon_vma->root->rwsem) could be contended under memory pressure if processes keep working on their vmas(e.g., fork, mmap, munmap). It makes reclaim path stuck. In our real workload traces, we see kswapd is waiting the lock for 300ms+(worst case, a sec) and it makes other processes entering direct reclaim, which were also stuck on the lock. This patch makes lru aging path try_lock mode like shink_page_list so the reclaim context will keep working with next lru pages without being stuck. if it found the rmap lock contended, it rotates the page back to head of lru in both active/inactive lrus to make them consistent behavior, which is basic starting point rather than adding more heristic. Since this patch introduces a new "contended" field as out-param along with try_lock in-param in rmap_walk_control, it's not immutable any longer if the try_lock is set so remove const keywords on rmap related functions. Since rmap walking is already expensive operation, I doubt the const would help sizable benefit( And we didn't have it until 5.17). In a heavy app workload in Android, trace shows following statistics. It almost removes rmap lock contention from reclaim path. Martin Liu reported: Before: max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function 1632 0 1631 151.542173 31672 209 page_lock_anon_vma_read 601 0 601 145.544681 28817 198 rmap_walk_file After: max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function NaN NaN NaN NaN NaN 0.0 NaN 0 0 0 0.127645 1 12 rmap_walk_file [minchan@kernel.org: add comment, per Matthew] Link: https://lkml.kernel.org/r/YnNqeB5tUf6LZ57b@google.com Link: https://lkml.kernel.org/r/20220510215423.164547-1-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Johannes Weiner Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: John Dias Cc: Tim Murray Cc: Matthew Wilcox Cc: Vladimir Davydov Cc: Martin Liu Cc: Minchan Kim Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit f4840ccfca25db225b3371a8f7b5770febee87c5 Author: Johannes Weiner Date: Thu May 19 14:08:53 2022 -0700 zswap: memcg accounting Applications can currently escape their cgroup memory containment when zswap is enabled. This patch adds per-cgroup tracking and limiting of zswap backend memory to rectify this. The existing cgroup2 memory.stat file is extended to show zswap statistics analogous to what's in meminfo and vmstat. Furthermore, two new control files, memory.zswap.current and memory.zswap.max, are added to allow tuning zswap usage on a per-workload basis. This is important since not all workloads benefit from zswap equally; some even suffer compared to disk swap when memory contents don't compress well. The optimal size of the zswap pool, and the threshold for writeback, also depends on the size of the workload's warm set. The implementation doesn't use a traditional page_counter transaction. zswap is unconventional as a memory consumer in that we only know the amount of memory to charge once expensive compression has occurred. If zwap is disabled or the limit is already exceeded we obviously don't want to compress page upon page only to reject them all. Instead, the limit is checked against current usage, then we compress and charge. This allows some limit overrun, but not enough to matter in practice. [hannes@cmpxchg.org: fix for CONFIG_SLOB builds] Link: https://lkml.kernel.org/r/YnwD14zxYjUJPc2w@cmpxchg.org [hannes@cmpxchg.org: opt out of cgroups v1] Link: https://lkml.kernel.org/r/Yn6it9mBYFA+/lTb@cmpxchg.org Link: https://lkml.kernel.org/r/20220510152847.230957-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Shakeel Butt Cc: Seth Jennings Cc: Dan Streetman Cc: Minchan Kim Signed-off-by: Andrew Morton commit f6498b776d280b30a4614d8261840961e993c2c8 Author: Johannes Weiner Date: Thu May 19 14:08:53 2022 -0700 mm: zswap: add basic meminfo and vmstat coverage Currently it requires poking at debugfs to figure out the size and population of the zswap cache on a host. There are no counters for reads and writes against the cache. As a result, it's difficult to understand zswap behavior on production systems. Print zswap memory consumption and how many pages are zswapped out in /proc/meminfo. Count zswapouts and zswapins in /proc/vmstat. Link: https://lkml.kernel.org/r/20220510152847.230957-6-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: David Hildenbrand Cc: Dan Streetman Cc: Michal Hocko Cc: Minchan Kim Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Signed-off-by: Andrew Morton commit b3fbd58fcbb10725a1314688e03b1af6827c42f9 Author: Johannes Weiner Date: Thu May 19 14:08:53 2022 -0700 mm: Kconfig: simplify zswap configuration - CONFIG_ZRAM: Zram is a user-facing feature, whereas zsmalloc is not. Don't make the user chase down a technical dependency like that, just select it in automatically when zram is requested. The CONFIG_CRYPTO dependency is redundant due to more specific deps. - CONFIG_ZPOOL: This is not a user-facing feature. Hide the symbol and have it selected in as needed. - CONFIG_ZSWAP: Select CRYPTO instead of depend. Common pattern. - Make the ZSWAP suboptions and their descriptions (compression, allocation backend) a bit more straight-forward for the user. Link: https://lkml.kernel.org/r/20220510152847.230957-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Dan Streetman Cc: Michal Hocko Cc: Minchan Kim Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 519bcb797907dd0d1db4e71adb6f610aee80941e Author: Johannes Weiner Date: Thu May 19 14:08:53 2022 -0700 mm: Kconfig: group swap, slab, hotplug and thp options into submenus There are several clusters of related config options spread throughout the mostly flat MM submenu. Group them together and put specialization options into further subdirectories to make the MM submenu a bit more organized and easier to navigate. [hannes@cmpxchg.org: fix kbuild warnings] Link: https://lkml.kernel.org/r/YnvkSVivfnT57Vwh@cmpxchg.org [hannes@cmpxchg.org: fix more kbuild warnings] Link: https://lkml.kernel.org/r/Ynz8NusTdEGcCnJN@cmpxchg.org Link: https://lkml.kernel.org/r/20220510152847.230957-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Dan Streetman Cc: Michal Hocko Cc: Minchan Kim Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 7b42f1041c98f5d7da74da8d1653a4b2c380e49d Author: Johannes Weiner Date: Thu May 19 14:08:53 2022 -0700 mm: Kconfig: move swap and slab config options to the MM section These are currently under General Setup. MM seems like a better fit. Link: https://lkml.kernel.org/r/20220510152847.230957-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Dan Streetman Cc: Michal Hocko Cc: Minchan Kim Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 39799b6409febf628337bd7804c3861a9f7f7e8a Author: Johannes Weiner Date: Thu May 19 14:08:52 2022 -0700 Documentation: filesystems: proc: update meminfo section Patch series "zswap: accounting & cgroup control", v2. Zswap can consume nearly a quarter of RAM in the default configuration, yet it's neither listed in /proc/meminfo, nor is it accounted and manageable on a per-cgroup basis. This makes reasoning about the memory situation on a host in general rather difficult. On shared/cgrouped hosts, the consequences are worse. First, workloads can escape memory containment and cause resource priority inversions: a lo-pri group can fill the global zswap pool and force a hi-pri group out to disk. Second, not all workloads benefit from zswap equally. Some even suffer when memory contents compress poorly, and are better off going to disk swap directly. On a host with mixed workloads, it's currently not possible to enable zswap for one workload but not for the other. This series implements the missing global accounting as well as cgroup tracking & control for zswap backing memory: - Patch 1 refreshes the very out-of-date meminfo documentation in Documentation/filesystems/proc.rst. - Patches 2-4 clean up related and adjacent options in Kconfig. Not actual dependencies, just things I noticed during development. - Patch 5 adds meminfo and vmstat coverage for zswap consumption and activity. - Patch 6 implements per-cgroup tracking & control of zswap memory. This patch (of 6): Add new entries. Minor corrections and cleanups. [hannes@cmpxchg.org: fix htmldocs warnings] Link: https://lkml.kernel.org/r/Ynve8dg4zJyhH2gW@cmpxchg.org [hannes@cmpxchg.org: change `Unevictable' wording, per David] Link: https://lkml.kernel.org/r/YnwFraZlVWQoCjz3@cmpxchg.org Link: https://lkml.kernel.org/r/20220510152847.230957-1-hannes@cmpxchg.org Link: https://lkml.kernel.org/r/20220510152847.230957-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: David Hildenbrand Cc: Dan Streetman Cc: Michal Hocko Cc: Minchan Kim Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Signed-off-by: Andrew Morton commit ff351f4bb9606a6c9a1f3fcdd918635b51514779 Author: Miaohe Lin Date: Thu May 19 14:08:52 2022 -0700 mm/swap: fix comment about swap extent Since commit 4efaceb1c5f8 ("mm, swap: use rbtree for swap_extent"), rbtree is used for swap extent. Also curr_swap_extent is removed at that time. Update the corresponding comment. Link: https://lkml.kernel.org/r/20220509131416.17553-16-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Alistair Popple Cc: David Hildenbrand Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 133d2743ef93ea8a979832d2ac72fb9d331045f3 Author: Miaohe Lin Date: Thu May 19 14:08:52 2022 -0700 mm/swap: fix the comment of get_kernel_pages If no pages were pinned, 0 is returned in fact. Fix the corresponding comment. [akpm@linux-foundation.org: s/nr_pages/nr_segs/ also, per David, reflow comment] Link: https://lkml.kernel.org/r/20220509131416.17553-15-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 3c3115ad6baddbf526521231ea43d9fff34dfa11 Author: Miaohe Lin Date: Thu May 19 14:08:52 2022 -0700 mm/swap: clean up the comment of find_next_to_unuse Since commit 10a9c496789f ("mm: simplify try_to_unuse"), frontswap parameter is removed. Update the corresponding comment. Link: https://lkml.kernel.org/r/20220509131416.17553-14-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit a930c210c42dec32b031ad7645bd6904701b5297 Author: Miaohe Lin Date: Thu May 19 14:08:52 2022 -0700 mm/swap: fix the obsolete comment for SWP_TYPE_SHIFT Since commit 3159f943aafd ("xarray: Replace exceptional entries"), there is only one bit of 'type' can be shifted up. Update the corresponding comment. Link: https://lkml.kernel.org/r/20220509131416.17553-13-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 4b9ae8426cb4a9160ae41bc968391f499feece7e Author: Miaohe Lin Date: Thu May 19 14:08:52 2022 -0700 mm/swap: add helper swap_offset_available() Add helper swap_offset_available() to remove some duplicated codes. Minor readability improvement. [akpm@linux-foundation.org: s/swap_offset_available/swap_offset_available_and_locked/, per Neil] Link: https://lkml.kernel.org/r/20220509131416.17553-12-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Alistair Popple Cc: David Hildenbrand Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit eacde32757c7566d3aa760609585c78909532e40 Author: Miaohe Lin Date: Thu May 19 14:08:51 2022 -0700 mm/swap: avoid calling swp_swap_info when try to check SWP_STABLE_WRITES Use flags of si directly to check SWP_STABLE_WRITES to avoid possible READ_ONCE and thus save some cpu cycles. [akpm@linux-foundation.org: use data_race() on si->flags, per Neil] Link: https://lkml.kernel.org/r/20220509131416.17553-10-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Alistair Popple Cc: David Hildenbrand Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 3db3264d8a5f4816c022eb9052694ce51e657bfc Author: Miaohe Lin Date: Thu May 19 14:08:51 2022 -0700 mm/swap: make page_swapcount and __lru_add_drain_all static Make page_swapcount and __lru_add_drain_all static. They are only used within the file now. Link: https://lkml.kernel.org/r/20220509131416.17553-9-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton commit dab8dfff49a673a4b070ad3f44534b3c0e88a189 Author: Miaohe Lin Date: Thu May 19 14:08:51 2022 -0700 mm/swap: remove unneeded p != NULL check in __swap_duplicate If p is NULL, __swap_duplicate will already return -EINVAL. So if we reach here, p must be non-NULL. Link: https://lkml.kernel.org/r/20220509131416.17553-8-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f19c25684c3e19b329e0498dd6d601df13c33223 Author: Miaohe Lin Date: Thu May 19 14:08:51 2022 -0700 mm/swap: remove buggy cache->nr check in refill_swap_slots_cache refill_swap_slots_cache is always called when cache->nr is 0. So remove such buggy and confusing check. Link: https://lkml.kernel.org/r/20220509131416.17553-7-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 23b230ba8ac30d334afd249c9763e0d0ca583e43 Author: Miaohe Lin Date: Thu May 19 14:08:51 2022 -0700 mm/swap: print bad swap offset entry in get_swap_device If offset exceeds the si->max, print bad swap offset entry to help debug the unexpected case. Link: https://lkml.kernel.org/r/20220509131416.17553-6-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bc4a68adb151f08b50822158c7767f5726346370 Author: Miaohe Lin Date: Thu May 19 14:08:50 2022 -0700 mm/swap: remove unneeded return value of free_swap_slot The return value of free_swap_slot is always 0 and also ignored now. Remove it to clean up the code. Link: https://lkml.kernel.org/r/20220509131416.17553-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit afba72b17139057aedf7eb2dfe5f6ea6700ab998 Author: Miaohe Lin Date: Thu May 19 14:08:50 2022 -0700 mm/swap: fold __swap_info_get() into its sole caller Fold __swap_info_get() into its sole caller to make code more clear. Minor readability improvement. Link: https://lkml.kernel.org/r/20220509131416.17553-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6106b93efad1ea14d428558c2e4efc5f76874c23 Author: Miaohe Lin Date: Thu May 19 14:08:50 2022 -0700 mm/swap: use helper macro __ATTR_RW Use helper macro __ATTR_RW to define vma_ra_enabled_attr to make code more clear. Minor readability improvement. Link: https://lkml.kernel.org/r/20220509131416.17553-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: David Howells Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: NeilBrown Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 92bafb20b2edd1ab5022a9bce6fb73ed9a749453 Author: Miaohe Lin Date: Thu May 19 14:08:50 2022 -0700 mm/swap: use helper is_swap_pte() in swap_vma_readahead Patch series "A few cleanup patches for swap". This series contains a few patches to fix the comment, remove unneeded return value, use some helpers and so on. More details can be found in the respective changelogs. This patch (of 14): Use helper is_swap_pte() to check whether pte is swap entry to make code more clear. Minor readability improvement. Link: https://lkml.kernel.org/r/20220509131416.17553-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220509131416.17553-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: David Howells Cc: NeilBrown Cc: Alistair Popple Cc: Suren Baghdasaryan Cc: Peter Xu Cc: Naoya Horiguchi Signed-off-by: Andrew Morton commit 613bec092fe78307a8b130353ce1ef340915587f Author: Yang Shi Date: Thu May 19 14:08:50 2022 -0700 mm: mmap: register suitable readonly file vmas for khugepaged The readonly FS THP relies on khugepaged to collapse THP for suitable vmas. But the behavior is inconsistent for "always" mode (https://lore.kernel.org/linux-mm/00f195d4-d039-3cf2-d3a1-a2c88de397a0@suse.cz/). The "always" mode means THP allocation should be tried all the time and khugepaged should try to collapse THP all the time. Of course the allocation and collapse may fail due to other factors and conditions. Currently file THP may not be collapsed by khugepaged even though all the conditions are met. That does break the semantics of "always" mode. So make sure readonly FS vmas are registered to khugepaged to fix the break. Register suitable vmas in common mmap path, that could cover both readonly FS vmas and shmem vmas, so remove the khugepaged calls in shmem.c. Still need to keep the khugepaged call in vma_merge() since vma_merge() is called in a lot of places, for example, madvise, mprotect, etc. Link: https://lkml.kernel.org/r/20220510203222.24246-9-shy828301@gmail.com Signed-off-by: Yang Shi Reported-by: Vlastimil Babka Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Miaohe Lin Cc: Song Liu Cc: Rik van Riel Cc: Matthew Wilcox (Oracle) Cc: Zi Yan Cc: Theodore Ts'o Cc: Song Liu Signed-off-by: Andrew Morton commit c791576c60288c89b351ea2d2098f6a872d78fa7 Author: Yang Shi Date: Thu May 19 14:08:50 2022 -0700 mm: khugepaged: introduce khugepaged_enter_vma() helper The khugepaged_enter_vma_merge() actually does as the same thing as the khugepaged_enter() section called by shmem_mmap(), so consolidate them into one helper and rename it to khugepaged_enter_vma(). Link: https://lkml.kernel.org/r/20220510203222.24246-8-shy828301@gmail.com Signed-off-by: Yang Shi Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Rik van Riel Cc: Song Liu Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit 2647d11b9e71d495b2d4985ebaf7a734373a4b80 Author: Yang Shi Date: Thu May 19 14:08:49 2022 -0700 mm: khugepaged: make hugepage_vma_check() non-static The hugepage_vma_check() could be reused by khugepaged_enter() and khugepaged_enter_vma_merge(), but it is static in khugepaged.c. Make it non-static and declare it in khugepaged.h. Link: https://lkml.kernel.org/r/20220510203222.24246-7-shy828301@gmail.com Signed-off-by: Yang Shi Suggested-by: Vlastimil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Rik van Riel Cc: Song Liu Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit d2081b2bf8195b8239c67fdd61518e077da7cbec Author: Yang Shi Date: Thu May 19 14:08:49 2022 -0700 mm: khugepaged: make khugepaged_enter() void function The most callers of khugepaged_enter() don't care about the return value. Only dup_mmap(), anonymous THP page fault and MADV_HUGEPAGE handle the error by returning -ENOMEM. Actually it is not harmful for them to ignore the error case either. It also sounds overkilling to fail fork() and page fault early due to khugepaged_enter() error, and MADV_HUGEPAGE does set VM_HUGEPAGE flag regardless of the error. Link: https://lkml.kernel.org/r/20220510203222.24246-6-shy828301@gmail.com Signed-off-by: Yang Shi Acked-by: Song Liu Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Rik van Riel Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit 78d12c19e02d8151b1c82228ae6bb10f174a68e2 Author: Yang Shi Date: Thu May 19 14:08:49 2022 -0700 mm: thp: only regular file could be THP eligible Since commit a4aeaa06d45e ("mm: khugepaged: skip huge page collapse for special files"), khugepaged just collapses THP for regular file which is the intended usecase for readonly fs THP. Only show regular file as THP eligible accordingly. And make file_thp_enabled() available for khugepaged too in order to remove duplicate code. Link: https://lkml.kernel.org/r/20220510203222.24246-5-shy828301@gmail.com Signed-off-by: Yang Shi Acked-by: Song Liu Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Rik van Riel Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit 52b52bf15b67213c631dc8bee2a1854dd8811110 Author: Yang Shi Date: Thu May 19 14:08:49 2022 -0700 mm: khugepaged: skip DAX vma The DAX vma may be seen by khugepaged when the mm has other khugepaged suitable vmas. So khugepaged may try to collapse THP for DAX vma, but it will fail due to page sanity check, for example, page is not on LRU. So it is not harmful, but it is definitely pointless to run khugepaged against DAX vma, so skip it in early check. Link: https://lkml.kernel.org/r/20220510203222.24246-4-shy828301@gmail.com Signed-off-by: Yang Shi Reviewed-by: Miaohe Lin Acked-by: Song Liu Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Rik van Riel Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit cb648754a1d0dbac7cbcfe8d42cb27fa6063547d Author: Yang Shi Date: Thu May 19 14:08:49 2022 -0700 mm: khugepaged: remove redundant check for VM_NO_KHUGEPAGED The hugepage_vma_check() called by khugepaged_enter_vma_merge() does check VM_NO_KHUGEPAGED. Remove the check from caller and move the check in hugepage_vma_check() up. More checks may be run for VM_NO_KHUGEPAGED vmas, but MADV_HUGEPAGE is definitely not a hot path, so cleaner code does outweigh. Link: https://lkml.kernel.org/r/20220510203222.24246-3-shy828301@gmail.com Signed-off-by: Yang Shi Reviewed-by: Miaohe Lin Acked-by: Song Liu Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Rik van Riel Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit b265cdebdfefbee4ef1ae2972af36f7a7cac5148 Author: Yang Shi Date: Thu May 19 14:08:48 2022 -0700 sched: coredump.h: clarify the use of MMF_VM_HUGEPAGE Patch series "Make khugepaged collapse readonly FS THP more consistent", v4. The readonly FS THP relies on khugepaged to collapse THP for suitable vmas. But the behavior is inconsistent for "always" mode (https://lore.kernel.org/linux-mm/00f195d4-d039-3cf2-d3a1-a2c88de397a0@suse.cz/). The "always" mode means THP allocation should be tried all the time and khugepaged should try to collapse THP all the time. Of course the allocation and collapse may fail due to other factors and conditions. Currently file THP may not be collapsed by khugepaged even though all the conditions are met. That does break the semantics of "always" mode. So make sure readonly FS vmas are registered to khugepaged to fix the break. Register suitable vmas in common mmap path, that could cover both readonly FS vmas and shmem vmas, so remove the khugepaged calls in shmem.c. The patch 1-7 are minor bug fixes, clean up and preparation patches. Patch 8 is the real meat. Tested with khugepaged test in selftests and the testcase provided by Vlastimil Babka in https://lore.kernel.org/lkml/df3b5d1c-a36b-2c73-3e27-99e74983de3a@suse.cz/ by commenting out MADV_HUGEPAGE call. This patch (of 8): MMF_VM_HUGEPAGE is set as long as the mm is available for khugepaged by khugepaged_enter(), not only when VM_HUGEPAGE is set on vma. Correct the comment to avoid confusion. Link: https://lkml.kernel.org/r/20220510203222.24246-1-shy828301@gmail.com Link: https://lkml.kernel.org/r/20220510203222.24246-2-shy828301@gmail.com Signed-off-by: Yang Shi Reviewed-by: Miaohe Lin Acked-by: Song Liu Acked-by: Vlastmil Babka Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: Rik van Riel Cc: Song Liu Cc: Theodore Ts'o Cc: Zi Yan Signed-off-by: Andrew Morton commit ed928a3402d8a24a70c242c63109c069a7b1f3ab Author: Tong Tiangen Date: Tue May 17 07:45:48 2022 +0000 arm64/mm: fix page table check compile error for CONFIG_PGTABLE_LEVELS=2 If CONFIG_PGTABLE_LEVELS=2 and CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y, then we trigger a compile error: error: implicit declaration of function 'pte_user_accessible_page' Move the definition of page table check helper out of branch CONFIG_PGTABLE_LEVELS > 2 Link: https://lkml.kernel.org/r/20220517074548.2227779-3-tongtiangen@huawei.com Fixes: daf214c14dbe ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Signed-off-by: Tong Tiangen Acked-by: Catalin Marinas Cc: Anshuman Khandual Cc: Pasha Tatashin Cc: Anshuman Khandual Cc: Will Deacon Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Arnd Bergmann Cc: Guohanjun Cc: Xie XiuQi Cc: kernel test robot Signed-off-by: Andrew Morton commit 2c8a81dc0cc533c666c64f4139a608b0ae55d96f Author: Tong Tiangen Date: Tue May 17 07:45:47 2022 +0000 riscv/mm: fix two page table check related issues Two page table check related issues have been fixed here. 1. Open CONFIG_PAGE_TABLE_CHECK in riscv32, we got a compile error[1]: error: implicit declaration of function 'pud_leaf' Add pud_leaf() definition to incluce/asm-generic/pgtable-nopmd.h to fix this issue. 2. Keep consistent with other pud_xxx() helpers, move pud_user() to pgtable-64.h and add pud_user() to pgtable-nopmd.h. [1]https://lore.kernel.org/linux-mm/202205161811.2nLxmN2O-lkp@intel.com/T/ Link: https://lkml.kernel.org/r/20220517074548.2227779-2-tongtiangen@huawei.com Fixes: 856eed79f8d3 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Signed-off-by: Tong Tiangen Reported-by: kernel test robot Cc: Anshuman Khandual Cc: Pasha Tatashin Cc: Anshuman Khandual Cc: Albert Ou Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Guohanjun Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Will Deacon Cc: Xie XiuQi Signed-off-by: Andrew Morton commit 644291ebecd1355363f4b7a39dc115828643b901 Author: Geert Uytterhoeven Date: Fri Dec 3 14:58:26 2021 +0100 dt-bindings: input: touchscreen: ilitek_ts_i2c: Absorb ili2xxx bindings While Linux uses a different driver, the Ilitek ILI210x/ILI2117/ILI2120/ILI251x touchscreen controller Device Tree binding documentation is very similar. - Drop the fixed reg value, as some controllers use a different address, - Make reset-gpios optional, as it is not always wired. Signed-off-by: Geert Uytterhoeven Reviewed-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/0c5f06c9d262c1720b40d068b6eefe58ca406601.1638539806.git.geert+renesas@glider.be commit ee77ef0d09e3ca0509833f6fbd49d925630a27f4 Author: Krzysztof Kozlowski Date: Sun Apr 24 17:03:33 2022 +0200 dt-bindings: timer: samsung,exynos4210-mct: define strict clock order The DTS should always have fixed clock order, even if it comes with clock-names property. Drop the pattern to make the order strict. Existing DTS already match this. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Acked-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220424150333.75172-3-krzysztof.kozlowski@linaro.org commit 60854ba8e338228f8a8296e812e4b8f0dd42191a Author: Krzysztof Kozlowski Date: Sun Apr 24 17:03:32 2022 +0200 dt-bindings: timer: samsung,exynos4210-mct: drop unneeded minItems There is no need to add minItems when it is equal to maxItems. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Alim Akhtar Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220424150333.75172-2-krzysztof.kozlowski@linaro.org commit 1084ab9e3bf0e291f97fc8f11bf9ab548ce6bb64 Author: Krzysztof Kozlowski Date: Sun Apr 24 17:03:31 2022 +0200 dt-bindings: timer: cdns,ttc: drop unneeded minItems There is no need to add minItems when it is equal to maxItems. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Alim Akhtar Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220424150333.75172-1-krzysztof.kozlowski@linaro.org commit 1a6dd9996699889313327be03981716a8337656b Author: Vincent Mailhol Date: Wed May 18 20:43:57 2022 +0900 can: mcp251xfd: silence clang's -Wunaligned-access warning clang emits a -Wunaligned-access warning on union mcp251xfd_tx_ojb_load_buf. The reason is that field hw_tx_obj (not declared as packed) is being packed right after a 16 bits field inside a packed struct: | union mcp251xfd_tx_obj_load_buf { | struct __packed { | struct mcp251xfd_buf_cmd cmd; | /* ^ 16 bits fields */ | struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; | /* ^ not declared as packed */ | } nocrc; | struct __packed { | struct mcp251xfd_buf_cmd_crc cmd; | struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; | __be16 crc; | } crc; | } ____cacheline_aligned; Starting from LLVM 14, having an unpacked struct nested in a packed struct triggers a warning. c.f. [1]. This is a false positive because the field is always being accessed with the relevant put_unaligned_*() function. Adding __packed to the structure declaration silences the warning. [1] https://github.com/llvm/llvm-project/issues/55520 Link: https://lore.kernel.org/all/20220518114357.55452-1-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol Reported-by: kernel test robot Tested-by: Nathan Chancellor # build Signed-off-by: Marc Kleine-Budde commit 6c1e423a3c84953edcf91ff03ab97829b287184a Author: Oliver Hartkopp Date: Wed May 18 17:45:27 2022 +0200 can: can-dev: remove obsolete CAN LED support Since commit 30f3b42147ba6f ("can: mark led trigger as broken") the CAN specific LED support was disabled and marked as BROKEN. As the common LED support with CONFIG_LEDS_TRIGGER_NETDEV should do this work now the code can be removed as preparation for a CAN netdevice Kconfig rework. Link: https://lore.kernel.org/all/20220518154527.29046-1-socketcan@hartkopp.net Suggested-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp [mkl: remove led.h from MAINTAINERS] Signed-off-by: Marc Kleine-Budde commit caf6b7f81e053dfdc5f16e943b355bc954e0de34 Author: Jakub Kicinski Date: Mon May 16 17:23:45 2022 -0700 can: can-dev: move to netif_napi_add_weight() We want to remove the weight argument from the basic version of the netif_napi_add() call. Move all the callers in drivers/net/can that pass a custom weight (i.e. not NAPI_POLL_WEIGHT or 64) to the netif_napi_add_weight() API. Link: https://lore.kernel.org/all/20220517002345.1812104-1-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Marc Kleine-Budde commit b76b163f46b661499921a0049982764a6659bfe7 Author: Oliver Hartkopp Date: Tue May 17 16:56:53 2022 +0200 can: isotp: isotp_bind(): do not validate unused address information With commit 2aa39889c463 ("can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting") the bind() syscall returns -EINVAL when the given CAN ID needed to be sanitized. But in the case of an unconfirmed broadcast mode the rx CAN ID is not needed and may be uninitialized from the caller - which is ok. This patch makes sure the result of an inproper CAN ID format is only provided when the address information is needed. Link: https://lore.kernel.org/all/20220517145653.2556-1-socketcan@hartkopp.net Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit d353e1a3bafd468941d42f6aa59bbd8ac42959b6 Merge: d7e6f5836038e 78488a64aea94 Author: Jakub Kicinski Date: Thu May 19 13:01:07 2022 -0700 Merge tag 'wireless-next-2022-05-19' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v5.19 Second set of patches for v5.19 and most likely the last one. rtw89 got support for 8852ce devices and mt76 now supports Wireless Ethernet Dispatch. Major changes: cfg80211/mac80211 - support disabling EHT mode rtw89 - add support for Realtek 8852ce devices mt76 - Wireless Ethernet Dispatch support for flow offload - non-standard VHT MCS10-11 support - mt7921 AP mode support - mt7921 ipv6 NS offload support ath11k - enable keepalive during WoWLAN suspend - implement remain-on-channel support * tag 'wireless-next-2022-05-19' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (135 commits) iwlwifi: mei: fix potential NULL-ptr deref iwlwifi: mei: clear the sap data header before sending iwlwifi: mvm: remove vif_count iwlwifi: mvm: always tell the firmware to accept MCAST frames in BSS iwlwifi: mvm: add OTP info in case of init failure iwlwifi: mvm: fix assert 1F04 upon reconfig iwlwifi: fw: init SAR GEO table only if data is present iwlwifi: mvm: clean up authorized condition iwlwifi: mvm: use NULL instead of ERR_PTR when parsing wowlan status iwlwifi: pcie: simplify MSI-X cause mapping rtw89: pci: only mask out INT indicator register for disable interrupt v1 rtw89: convert rtw89_band to nl80211_band precisely rtw89: 8852c: update txpwr tables to HALRF_027_00_052 rtw89: cfo: check mac_id to avoid out-of-bounds rtw89: 8852c: set TX antenna path rtw89: add ieee80211::sta_rc_update ops wireless: Fix Makefile to be in alphabetical order mac80211: refactor freeing the next_beacon cfg80211: fix kernel-doc for cfg80211_beacon_data mac80211: minstrel_ht: support ieee80211_rate_status ... ==================== Link: https://lore.kernel.org/r/20220519153334.8D051C385AA@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 78288665b5d0154978fed431985310cb4f166836 Author: Chaitanya Kulkarni Date: Wed May 18 08:51:38 2022 -0700 nvme: set non-mdts limits in nvme_scan_work In current implementation we set the non-mdts limits by calling nvme_init_non_mdts_limits() from nvme_init_ctrl_finish(). This also tries to set the limits for the discovery controller which has no I/O queues resulting in the warning message reported by the nvme_log_error() when running blktest nvme/002: - [ 2005.155946] run blktests nvme/002 at 2022-04-09 16:57:47 [ 2005.192223] loop: module loaded [ 2005.196429] nvmet: adding nsid 1 to subsystem blktests-subsystem-0 [ 2005.200334] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 <------------------------------SNIP----------------------------------> [ 2008.958108] nvmet: adding nsid 1 to subsystem blktests-subsystem-997 [ 2008.962082] nvmet: adding nsid 1 to subsystem blktests-subsystem-998 [ 2008.966102] nvmet: adding nsid 1 to subsystem blktests-subsystem-999 [ 2008.973132] nvmet: creating discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN testhostnqn. *[ 2008.973196] nvme1: Identify(0x6), Invalid Field in Command (sct 0x0 / sc 0x2) MORE DNR* [ 2008.974595] nvme nvme1: new ctrl: "nqn.2014-08.org.nvmexpress.discovery" [ 2009.103248] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" Move the call of nvme_init_non_mdts_limits() to nvme_scan_work() after we verify that I/O queues are created since that is a converging point for each transport where these limits are actually used. 1. FC : nvme_fc_create_association() ... nvme_fc_create_io_queues(ctrl); ... nvme_start_ctrl() nvme_scan_queue() nvme_scan_work() 2. PCIe:- nvme_reset_work() ... nvme_setup_io_queues() nvme_create_io_queues() nvme_alloc_queue() ... nvme_start_ctrl() nvme_scan_queue() nvme_scan_work() 3. RDMA :- nvme_rdma_setup_ctrl ... nvme_rdma_configure_io_queues ... nvme_start_ctrl() nvme_scan_queue() nvme_scan_work() 4. TCP :- nvme_tcp_setup_ctrl ... nvme_tcp_configure_io_queues ... nvme_start_ctrl() nvme_scan_queue() nvme_scan_work() * nvme_scan_work() ... nvme_validate_or_alloc_ns() nvme_alloc_ns() nvme_update_ns_info() nvme_update_disk_info() nvme_config_discard() <--- blk_queue_max_write_zeroes_sectors() <--- Signed-off-by: Chaitanya Kulkarni Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit fa6dae5d82081e8d9f8e6a2baf7149442a6c1ba5 Author: Hans de Goede Date: Thu May 19 17:21:48 2022 +0200 x86/PCI: Add kernel cmdline options to use/ignore E820 reserved regions Some firmware supplies PCI host bridge _CRS that includes address space unusable by PCI devices, e.g., space occupied by host bridge registers or used by hidden PCI devices. To avoid this unusable space, Linux currently excludes E820 reserved regions from _CRS windows; see 4dc2287c1805 ("x86: avoid E820 regions when allocating address space"). However, this use of E820 reserved regions to clip things out of _CRS is not supported by ACPI, UEFI, or PCI Firmware specs, and some systems have E820 reserved regions that cover the entire memory window from _CRS. 4dc2287c1805 clips the entire window, leaving no space for hot-added or uninitialized PCI devices. For example, from a Lenovo IdeaPad 3 15IIL 81WE: BIOS-e820: [mem 0x4bc50000-0xcfffffff] reserved pci_bus 0000:00: root bus resource [mem 0x65400000-0xbfffffff window] pci 0000:00:15.0: BAR 0: [mem 0x00000000-0x00000fff 64bit] pci 0000:00:15.0: BAR 0: no space for [mem size 0x00001000 64bit] Future patches will add quirks to enable/disable E820 clipping automatically. Add a "pci=no_e820" kernel command line option to disable clipping with E820 reserved regions. Also add a matching "pci=use_e820" option to enable clipping with E820 reserved regions if that has been disabled by default by further patches in this patch-set. Both options taint the kernel because they are intended for debugging and workaround purposes until a quirk can set them automatically. [bhelgaas: commit log, add printk] Link: https://bugzilla.redhat.com/show_bug.cgi?id=1868899 Lenovo IdeaPad 3 Link: https://lore.kernel.org/r/20220519152150.6135-2-hdegoede@redhat.com Signed-off-by: Hans de Goede Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: Benoit Grégoire Cc: Hui Wang commit 838b3e28488f702e2b5477b393f009b2639d2b1a Author: Li Zhengyu Date: Fri Apr 8 18:09:14 2022 +0800 RISC-V: Load purgatory in kexec_file This patch supports kexec_file to load and relocate purgatory. It works well on riscv64 QEMU, being tested with devmem. Signed-off-by: Li Zhengyu Link: https://lore.kernel.org/r/20220408100914.150110-7-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt commit 736e30af583fb6e0e2b8211b894ff99dea0f1ee7 Author: Li Zhengyu Date: Fri Apr 8 18:09:13 2022 +0800 RISC-V: Add purgatory This patch adds purgatory, the name and concept have been taken from kexec-tools. Purgatory runs between two kernels, and do verify sha256 hash to ensure the kernel to jump to is fine and has not been corrupted after loading. Makefile is modified based on x86 platform. Signed-off-by: Li Zhengyu Link: https://lore.kernel.org/r/20220408100914.150110-6-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt commit 8acea455fafaf2620b247de6c00774828b618a82 Author: Li Zhengyu Date: Fri Apr 8 18:09:12 2022 +0800 RISC-V: Support for kexec_file on panic This patch adds support for loading a kexec on panic (kdump) kernel. It has been tested with vmcore-dmesg on riscv64 QEMU on both an smp and a non-smp system. Signed-off-by: Li Zhengyu Link: https://lore.kernel.org/r/20220408100914.150110-5-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt commit 6261586e0c91db14c34f894f4bc48f2300cff1d4 Author: Liao Chang Date: Fri Apr 8 18:09:11 2022 +0800 RISC-V: Add kexec_file support This patch adds support for kexec_file on RISC-V. I tested it on riscv64 QEMU with busybear-linux and single core along with the OpenSBI firmware fw_jump.bin for generic platform. On SMP system, it depends on CONFIG_{HOTPLUG_CPU, RISCV_SBI} to resume/stop hart through OpenSBI firmware, it also needs a OpenSBI that support the HSM extension. Signed-off-by: Liao Chang Signed-off-by: Li Zhengyu Link: https://lore.kernel.org/r/20220408100914.150110-4-lizhengyu3@huawei.com [Palmer: Make 64-bit only] Signed-off-by: Palmer Dabbelt commit 988d74deaa46a9c63d2061c270692d6e6192c6c1 Author: Daisuke Matsuda Date: Wed May 18 04:49:14 2022 +0000 RDMA/mlx5: Remove duplicate pointer assignment in mlx5_ib_alloc_implicit_mr() The pointer imr->umem is assigned twice. Fix this by removing the redundant one. Link: https://lore.kernel.org/r/20220518044914.1903125-1-matsuda-daisuke@fujitsu.com Signed-off-by: Daisuke Matsuda Signed-off-by: Jason Gunthorpe commit b7fb4d78a6ade6026d9e5cf438c2a46ab962e032 Author: Liao Chang Date: Fri Apr 8 18:09:10 2022 +0800 RISC-V: use memcpy for kexec_file mode The pointer to buffer loading kernel binaries is in kernel space for kexec_fil mode, When copy_from_user copies data from pointer to a block of memory, it checkes that the pointer is in the user space range, on RISCV-V that is: static inline bool __access_ok(unsigned long addr, unsigned long size) { return size <= TASK_SIZE && addr <= TASK_SIZE - size; } and TASK_SIZE is 0x4000000000 for 64-bits, which now causes copy_from_user to reject the access of the field 'buf' of struct kexec_segment that is in range [CONFIG_PAGE_OFFSET - VMALLOC_SIZE, CONFIG_PAGE_OFFSET), is invalid user space pointer. This patch fixes this issue by skipping access_ok(), use mempcy() instead. Signed-off-by: Liao Chang Link: https://lore.kernel.org/r/20220408100914.150110-3-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt commit 4853f68d158ac59b05985a6af5b7da7ccdbc14c8 Author: Liao Chang Date: Fri Apr 8 18:09:09 2022 +0800 kexec_file: Fix kexec_file.c build error for riscv platform When CONFIG_KEXEC_FILE is set for riscv platform, the compilation of kernel/kexec_file.c generate build error: kernel/kexec_file.c: In function 'crash_prepare_elf64_headers': ./arch/riscv/include/asm/page.h:110:71: error: request for member 'virt_addr' in something not a structure or union 110 | ((x) >= PAGE_OFFSET && (!IS_ENABLED(CONFIG_64BIT) || (x) < kernel_map.virt_addr)) | ^ ./arch/riscv/include/asm/page.h:131:2: note: in expansion of macro 'is_linear_mapping' 131 | is_linear_mapping(_x) ? \ | ^~~~~~~~~~~~~~~~~ ./arch/riscv/include/asm/page.h:140:31: note: in expansion of macro '__va_to_pa_nodebug' 140 | #define __phys_addr_symbol(x) __va_to_pa_nodebug(x) | ^~~~~~~~~~~~~~~~~~ ./arch/riscv/include/asm/page.h:143:24: note: in expansion of macro '__phys_addr_symbol' 143 | #define __pa_symbol(x) __phys_addr_symbol(RELOC_HIDE((unsigned long)(x), 0)) | ^~~~~~~~~~~~~~~~~~ kernel/kexec_file.c:1327:36: note: in expansion of macro '__pa_symbol' 1327 | phdr->p_offset = phdr->p_paddr = __pa_symbol(_text); This occurs is because the "kernel_map" referenced in macro is_linear_mapping() is suppose to be the one of struct kernel_mapping defined in arch/riscv/mm/init.c, but the 2nd argument of crash_prepare_elf64_header() has same symbol name, in expansion of macro is_linear_mapping in function crash_prepare_elf64_header(), "kernel_map" actually is the local variable. Signed-off-by: Liao Chang Link: https://lore.kernel.org/r/20220408100914.150110-2-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt commit 0e7579ca732a39cc377e17509dda9bfc4f6ba78e Author: Vasily Averin Date: Thu May 19 17:30:49 2022 +0300 io_uring: fix incorrect __kernel_rwf_t cast Currently 'make C=1 fs/io_uring.o' generates sparse warning: CHECK fs/io_uring.c fs/io_uring.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, i nclude/trace/events/io_uring.h): ./include/trace/events/io_uring.h:488:1: warning: incorrect type in assignment (different base types) expected unsigned int [usertype] op_flags got restricted __kernel_rwf_t const [usertype] rw_flags This happen on cast of sqe->rw_flags which is defined as __kernel_rwf_t, this type is bitwise and requires __force attribute for any casts. However rw_flags is a member of the union, and its access can be safely replaced by using of its neighbours, so let's use poll32_events to fix the sparse warning. Signed-off-by: Vasily Averin Link: https://lore.kernel.org/r/6f009241-a63f-ae43-a04b-62841aaef293@openvz.org Signed-off-by: Jens Axboe commit d7e6f5836038eeac561411ed7a74e2a225a6c138 Merge: c1318b39c7d36 d904c8cc03023 Author: Jakub Kicinski Date: Thu May 19 11:23:59 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net drivers/net/ethernet/mellanox/mlx5/core/main.c b33886971dbc ("net/mlx5: Initialize flow steering during driver probe") 40379a0084c2 ("net/mlx5_fpga: Drop INNOVA TLS support") f2b41b32cde8 ("net/mlx5: Remove ipsec_ops function table") https://lore.kernel.org/all/20220519040345.6yrjromcdistu7vh@sx1/ 16d42d313350 ("net/mlx5: Drain fw_reset when removing device") 8324a02c342a ("net/mlx5: Add exit route when waiting for FW") https://lore.kernel.org/all/20220519114119.060ce014@canb.auug.org.au/ tools/testing/selftests/net/mptcp/mptcp_join.sh e274f7154008 ("selftests: mptcp: add subflow limits test-cases") b6e074e171bc ("selftests: mptcp: add infinite map testcase") 5ac1d2d63451 ("selftests: mptcp: Add tests for userspace PM type") https://lore.kernel.org/all/20220516111918.366d747f@canb.auug.org.au/ net/mptcp/options.c ba2c89e0ea74 ("mptcp: fix checksum byte order") 1e39e5a32ad7 ("mptcp: infinite mapping sending") ea66758c1795 ("tcp: allow MPTCP to update the announced window") https://lore.kernel.org/all/20220519115146.751c3a37@canb.auug.org.au/ net/mptcp/pm.c 95d686517884 ("mptcp: fix subflow accounting on close") 4d25247d3ae4 ("mptcp: bypass in-kernel PM restrictions for non-kernel PMs") https://lore.kernel.org/all/20220516111435.72f35dca@canb.auug.org.au/ net/mptcp/subflow.c ae66fb2ba6c3 ("mptcp: Do TCP fallback on early DSS checksum failure") 0348c690ed37 ("mptcp: add the fallback check") f8d4bcacff3b ("mptcp: infinite mapping receiving") https://lore.kernel.org/all/20220519115837.380bb8d4@canb.auug.org.au/ Signed-off-by: Jakub Kicinski commit 1a5409facf9ceba401f83925c6d15bae2121d29c Merge: 947a844bb3ebf 64b22a0da12ad Author: Rob Clark Date: Thu May 19 11:19:30 2022 -0700 Merge tag 'msm-next-5.19-fixes' of https://gitlab.freedesktop.org/abhinavk/msm into msm-fixes-staging 5.19 fixes for msm-next - Limiting WB modes to max sspp linewidth - Fixing the supported rotations to add 180 back for IGT - Fix to handle pm_runtime_get_sync() errors to avoid unclocked access in the bind() path for dpu driver - Fix the irq_free() without request issue which was a big-time hitter in the CI-runs. Signed-off-by: Abhinav Kumar Signed-off-by: Rob Clark commit b2a92f354c5a9436f1f4ac8f6485a3ce1c941b29 Author: Ulf Hansson Date: Wed May 11 16:57:04 2022 +0200 PM: domains: Trust domain-idle-states from DT to be correct by genpd If genpd has parsed the domain-idle-states from DT, it's reasonable to believe that the parsed data should be correct for the HW in question. Based upon this, it seem superfluous to let genpd measure the corresponding power-on/off latencies for these states. Therefore, let's improve the behaviour in genpd by avoiding the measurements for the domain-idle-states that have been parsed from DT. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 6961795f0d0a9c424915b3d73198c18b3dbd5e85 Author: Ulf Hansson Date: Wed May 11 16:57:03 2022 +0200 PM: domains: Measure power-on/off latencies in genpd based on a governor The measurements of the power-on|off latencies in genpd for a PM domain are superfluous, unless the corresponding genpd has a governor assigned to it, which would make use of the data. Therefore, let's improve the behaviour in genpd by making the measurements conditional, based upon if there's a governor assigned. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit f38d1a6d002526a4e8840e9bb19733e9d4ce1a67 Author: Ulf Hansson Date: Wed May 11 16:57:02 2022 +0200 PM: domains: Allocate governor data dynamically based on a genpd governor If a genpd doesn't have an associated governor assigned, several variables in the struct generic_pm_domain becomes superfluous. Rather than wasting memory in allocated genpds, let's move the variables from the struct generic_pm_domain into a new separate struct. In this way, we can instead dynamically decide when we need to allocate the corresponding data for it. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit ba43d6db6e5c6d0b5f58d6487285ed58ba94c5df Author: Ulf Hansson Date: Wed May 11 16:57:01 2022 +0200 PM: domains: Clean up some code in pm_genpd_init() and genpd_remove() To improve the readability of the code, let's move the parts that deals with allocation/freeing of data, into two separate functions. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 622d9b5577f19a6472db21df042fea8f5fefe244 Author: Ulf Hansson Date: Wed May 11 16:57:00 2022 +0200 PM: domains: Fix initialization of genpd's next_wakeup In the genpd governor we walk the list of child-domains to take into account their next_wakeup. If the child-domain itself, doesn't have a governor assigned to it, we can end up using the next_wakeup value before it has been properly initialized. To prevent a possible incorrect behaviour in the governor, let's initialize next_wakeup to KTIME_MAX. Fixes: c79aa080fb0f ("PM: domains: use device's next wakeup to determine domain idle state") Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit a294237aea122daa646f02e461877d553439c529 Author: Ulf Hansson Date: Wed May 11 16:56:59 2022 +0200 PM: domains: Fixup QoS latency measurements for IRQ safe devices in genpd When an IRQ safe device is attached to a non-IRQ safe PM domain, genpd needs to prevent the PM domain from being powered off. However, genpd still allows the device to be runtime suspended/resumed, hence it's also reasonable to think that a governor may be used to validate the QoS latency constraints. Unfortunately, genpd_runtime_resume() treats the configuration above, as a reason to skip measuring the QoS resume latency for the device. This is a legacy behaviour that was earlier correct, but should have been changed when genpd was transformed into its current behaviour around how it manages IRQ safe devices. Luckily, there's no report about problems, so let's just fixup the behaviour. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 3b84bf3ce94dea82a9451a4c9c2cda37e334333c Author: Ulf Hansson Date: Wed May 11 16:56:58 2022 +0200 PM: domains: Measure suspend/resume latencies in genpd based on governor The QoS latency measurements for devices in genpd_runtime_suspend|resume() are superfluous, unless the corresponding genpd has a governor assigned to it, which would make use of the data. Therefore, let's improve the behaviour in genpd by making the measurements conditional, based upon if there's a governor assigned. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 9c74f2ac4801473d03b0e29fab74eb94a9944521 Author: Ulf Hansson Date: Wed May 11 16:56:57 2022 +0200 PM: domains: Move the next_wakeup variable into the struct gpd_timing_data If the corresponding genpd for the device doesn't use a governor, the variable next_wakeup within the struct generic_pm_domain_data becomes superfluous. To avoid wasting memory, let's move it into the struct gpd_timing_data, which is already being allocated based upon if there is governor assigned. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 66d29d802ef3bf55a49b07568b0048823d4a72a6 Author: Ulf Hansson Date: Wed May 11 16:56:56 2022 +0200 PM: domains: Allocate gpd_timing_data dynamically based on governor If a genpd doesn't have an associated governor assigned, there's really no point to allocate the per device gpd_timing_data, as the data isn't being used by a governor anyway. To avoid wasting memory, let's therefore convert the corresponding td variable in the struct generic_pm_domain_data into a pointer and manage the allocation of its data dynamically. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit bcc19f69f72ab7e3db581b993d6a9fc1bad5ddf4 Author: Ulf Hansson Date: Wed May 11 16:56:55 2022 +0200 PM: domains: Skip another warning in irq_safe_dev_in_sleep_domain() In irq_safe_dev_in_sleep_domain() we correctly skip the dev_warn_once() if the corresponding genpd for the device, has the GENPD_FLAG_ALWAYS_ON flag being set. For the same reason (the genpd is always-on in runtime), let's also skip the warning if the GENPD_FLAG_RPM_ALWAYS_ON flag is set for the genpd. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 7a02444b8fc25ac16f90c1e498aeb672651d6f4b Author: Ulf Hansson Date: Wed May 11 16:56:54 2022 +0200 PM: domains: Rename irq_safe_dev_in_no_sleep_domain() in genpd The name "irq_safe_dev_in_no_sleep_domain", doesn't really match the conditions that are being checked in the function, hence the code becomes a bit confusing to read. Let's clarify this by renaming it into "irq_safe_dev_in_sleep_domain" and let's also take the opportunity to clarify a corresponding comment in the code. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 3f9ee7da724a57d808b52e6e9f53517ef3b00db6 Author: Ulf Hansson Date: Wed May 11 16:56:53 2022 +0200 PM: domains: Don't check PM_QOS_FLAG_NO_POWER_OFF in genpd Back in the days when genpd supported intermediate power states of its devices, it made sense to check the PM_QOS_FLAG_NO_POWER_OFF in genpd_power_off(). This because the attached devices were all being put into low power state together when the PM domain was also being powered off. At this point, the flag PM_QOS_FLAG_NO_POWER_OFF is better checked by drivers from their ->runtime_suspend() callbacks, like in the usb_port_runtime_suspend(), for example. Or perhaps an even better option is to set the QoS resume latency constraint for the device to zero, which informs the runtime PM core to prevent the device from being runtime suspended. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit fabb1c20b96217e8d0ebb1307985da5599885d6c Author: Ulf Hansson Date: Wed May 11 16:56:52 2022 +0200 PM: domains: Drop redundant code for genpd always-on governor Due to recent changes, the always-on governor is always used with a genpd that has the GENPD_FLAG_RPM_ALWAYS_ON flag being set. This means genpd, doesn't invoke the governor's ->power_down_ok() callback, which makes the code in the governor redundant, so let's drop it. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 27656dcd55f8065aa80dd1f9d948d7d39866a65a Author: Ulf Hansson Date: Wed May 11 16:56:51 2022 +0200 PM: domains: Add GENPD_FLAG_RPM_ALWAYS_ON for the always-on governor Rather than relying on the genpd provider to set the corresponding flag, GENPD_FLAG_RPM_ALWAYS_ON, when the always-on governor is being used, let's add it in pm_genpd_init(). In this way, it starts to benefits all genpd providers immediately. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit d1a28597808268b87f156138aad3104aa255e62b Author: Dave Jiang Date: Mon Apr 25 11:03:29 2022 -0700 dmaengine: idxd: make idxd_wq_enable() return 0 if wq is already enabled When calling idxd_wq_enable() and wq is already enabled, code should return 0 and indicate function is successful instead of return error code and fail. This should also put idxd_wq_enable() in sync with idxd_wq_disable() where it returns 0 if wq is already disabled. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/165090980906.1378449.1939401700832432886.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 8292a15597db6f97dddd2afff98095a4722d0303 Author: Samuel Holland Date: Sun Apr 24 12:27:58 2022 -0500 dmaengine: sun6i: Add support for the D1 variant So far it appears to match the configuration of the A100 variant. Since D1 is a RISC-V chip, it does not meet any of the existing dependencies for this driver, so relax the dependency somewhat. Acked-by: Maxime Ripard Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20220424172759.33383-5-samuel@sholland.org Signed-off-by: Vinod Koul commit ec31c5c594927556ae74f6617fe4969568d8dcc5 Author: Samuel Holland Date: Sun Apr 24 12:27:57 2022 -0500 dmaengine: sun6i: Add support for 34-bit physical addresses Recent Allwinner SoCs support >4 GiB of DRAM, so those variants of the DMA engine support >32 bit physical addresses. This is accomplished by placing the high bits in the "para" word in the DMA descriptor. DMA descriptors themselves can be located at >32 bit addresses by putting the high bits in the LSBs of the descriptor address register, taking advantage of the required DMA descriptor alignment. However, support for this is not really necessary, so we can avoid the complication by allocating them from the DMA_32 zone. Signed-off-by: Samuel Holland Acked-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220424172759.33383-4-samuel@sholland.org Signed-off-by: Vinod Koul commit 9aa48806edb8c37e82532dbc6098b03f6bd4245e Author: Samuel Holland Date: Sun Apr 24 12:27:56 2022 -0500 dmaengine: sun6i: Do not use virt_to_phys This breaks on RISC-V, because dma_pool_alloc returns addresses which are not in the linear map. Instead, plumb through the physical address which is already known anyway. Acked-by: Maxime Ripard Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20220424172759.33383-3-samuel@sholland.org Signed-off-by: Vinod Koul commit 59e477763d092923f567051e1bbfbb4e04d0dfbf Author: Samuel Holland Date: Sun Apr 24 12:27:55 2022 -0500 dt-bindings: dma: sun50i-a64: Add compatible for D1 D1 has a DMA controller similar to the one in other Allwinner SoCs. Add its compatible, and include it in the list of variants with a separate MBUS clock gate. Acked-by: Rob Herring Acked-by: Maxime Ripard Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20220424172759.33383-2-samuel@sholland.org Signed-off-by: Vinod Koul commit 360e4f4e3fcceb9c24ee509f9eb4ed48759b3918 Author: Akhil R Date: Tue Apr 26 15:49:13 2022 +0530 dmaengine: tegra: Remove unused switch case Remove unused switch case in get_transfer_param() function. The function is not called for MEM_TO_MEM transfers. Signed-off-by: Akhil R Link: https://lore.kernel.org/r/20220426101913.43335-3-akhilrajeev@nvidia.com Signed-off-by: Vinod Koul commit 39b930bec80e7af4faae4caf4a36464a6d003bed Author: Akhil R Date: Tue Apr 26 15:49:12 2022 +0530 dmaengine: tegra: Fix uninitialized variable usage Initialize slave_bw in dma_prep*() functions as the parameter is not set for DMA_MEM_TO_MEM case in get_transfer_param(). Though the case may never occur, initializing it avoids warning from certain static checkers Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") Reported-by: Dan Carpenter Signed-off-by: Akhil R Link: https://lore.kernel.org/r/20220426101913.43335-2-akhilrajeev@nvidia.com Signed-off-by: Vinod Koul commit 099a9a94be0e1c7fa45410deb2bff640320c3819 Author: Amelie Delaunay Date: Thu May 5 13:56:11 2022 +0200 dmaengine: stm32-dma: add device_pause/device_resume support At any time, a DMA transfer can be suspended to be restarted later before the end of the DMA transfer. In order to restart from the point where the transfer was stopped, DMA_SxNDTR has to be read after disabling the channel by clearing the EN bit in DMA_SxCR register, to know the number of data items already collected. Peripheral and/or memory addresses have to be updated in order to adjust the address pointers. SxNDTR register has to be updated with the remaining number of data items to be transferred (the value read when the channel was disabled). Then the channel can be re-enabled to resume the transfer from the point it was suspended. If the channel was configured in circular or double-buffer mode, the circular or double-buffer mode must be disabled before re-enabling the channel to be able to reconfigure SxNDTR register and re-activate circular or double-buffer mode on next Transfer Complete interrupt where channel will be disabled by HW. This is due to the fact that on resume, re-writing SxNDTR register value updates internal HW auto-reload data counter, and then it truncates all next transfers after a pause/resume sequence. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220505115611.38845-5-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit baa1424314f8e4bb5b266aaf9cc7fb7a9e65901b Author: Amelie Delaunay Date: Thu May 5 13:56:10 2022 +0200 dmaengine: stm32-dma: rename pm ops before dma pause/resume introduction dmaengine framework offers device_pause and device_resume ops to pause an on-going transfer and resume it later. To avoid any misunderstanding with system sleep pm ops, rename pm ops into stm32_dma_pm_suspend and stm32_dma_pm_resume. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220505115611.38845-4-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit ded6230691e00b0f31afc8aa18f26c57072ff58f Author: Amelie Delaunay Date: Thu May 5 13:56:09 2022 +0200 dmaengine: stm32-dma: pass DMA_SxSCR value to stm32_dma_handle_chan_done() stm32_dma_handle_chan_done() is called on Transfer Complete interrupt. As DMA_SxSCR register is read in interrupt handler, pass the value as parameter of stm32_dma_handle_chan_done(). Also return directly if chan->desc is null to remove one ident level. Then, stm32_dma_configure_next_sg() is doing something only if Double-Buffer Mode (DBM) is enabled, so, check it is enabled prior calling stm32_dma_configure_next_sg(), to remove one ident level in stm32_dma_configure_next_sg(). Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220505115611.38845-3-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit db60a63eb6850fce081c1a22e7318e5d37f4dcf5 Author: Amelie Delaunay Date: Thu May 5 13:56:08 2022 +0200 dmaengine: stm32-dma: introduce stm32_dma_sg_inc to manage chan->next_sg chan->next_sg is used to know which transfer will start after the ongoing one. It is incremented for each new transfer, either on transfer start for non-cyclic transfers, or on transfer complete interrupt for cyclic transfers. For cyclic transfer, when the last item is reached, chan->next_sg must be reinitialized to the first item. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220505115611.38845-2-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit d0b360e3c164be7ccc8eb2bfc341287959e27040 Author: Amelie Delaunay Date: Wed May 4 18:17:24 2022 +0200 dmaengine: stm32-dmamux: avoid reset of dmamux if used by coprocessor One of the two DMA controllers managed by the DMAMUX can be used by the coprocessor. It is defined in the device tree with dma-masters. When the two DMA controllers are used by the main CPU, dma-masters = <&dma1, &dma2>; is specified in the device tree. When one of the controllers is used by coprocessor (so not managed by Linux), dma-masters = <&dma1>; is specified in the device tree. In this case, Linux driver must not reset the DMAMUX, because it could have been configured by the coprocessor to use the second DMA controller. count is the number of DMA controllers defined in dma-masters property. Reset only if resets property is found and valid in device tree, and if the two DMA controllers are under Linux control. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220504161724.123180-1-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit c7399e6d3b18dc17974bc44e2e178664f1bd1bec Author: Vinod Koul Date: Thu Apr 21 17:47:33 2022 +0530 dmaengine: qcom: gpi: Add support for sc7280 Add compatible and driver_data for GPI DMA engines found in Qualcomm SC7280. The driver_data contains ee_offset of 0x10000. Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20220421121733.1829350-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 8f9ae5b3ae80f168a6224529e3787f4fb27f299a Author: Luiz Augusto von Dentz Date: Wed May 4 17:06:28 2022 -0700 Bluetooth: eir: Add helpers for managing service data This adds helpers for accessing and appending service data (0x16) ad type. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann commit 1934fee67593c561ef883761bf2ddee82f908ed9 Author: Zhang Rui Date: Thu May 19 22:37:32 2022 +0800 ACPI: video: improve PM notifer callback PM notifier callbacks should check for supported events rather than filter out the unsupported events. So that it won't break when a new event is introduced. No functional change in this patch. Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 06eb8dc097b3fcb2d02eb553b17af5fcc2952f96 Author: Michael Niewöhner Date: Tue May 17 20:40:06 2022 +0200 ACPI: utils: include UUID in _DSM evaluation warning The _DSM evaluation warning in its current form is not very helpful, as it lacks any specific information: ACPI: \: failed to evaluate _DSM (0x1001) Thus, include the UUID of the missing _DSM: ACPI: \: failed to evaluate _DSM bf0212f2-... (0x1001) Signed-off-by: Michael Niewöhner Signed-off-by: Rafael J. Wysocki commit 6c3c2066d6dc317fd05893d4ce07b2f3633e3e2a Author: Krzysztof Kozlowski Date: Wed Apr 27 08:40:48 2022 +0200 dt-bindings: dma: pl330: Add power-domains The pl330 DMA controller on Exynos SoC (e.g. dma-controller@3880000 in Exynos5420) belongs to power domain, so allow such property. Reported-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220427064048.86635-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 2763826966808800beeda5db406b3b704edc8137 Author: Amelie Delaunay Date: Wed May 4 17:53:22 2022 +0200 dmaengine: stm32-mdma: use dev_dbg on non-busy channel spurious it If interrupt occurs while !chan->busy, it means channel has been disabled between the raise of the interruption and the read of status and ien, so, spurious interrupt can be silently discarded. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220504155322.121431-4-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit da3b8ddb464bd49b6248d00ca888ad751c9e44fd Author: Amelie Delaunay Date: Wed May 4 17:53:21 2022 +0200 dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() The parameter to pass back to the handler function when irq has been requested is a struct stm32_mdma_device pointer, not a struct stm32_mdma_chan pointer. Even if chan is reinit later in the function, remove this wrong initialization. Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220504155322.121431-3-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit 9d6a2d92e450926c483e45eaf426080a19219f4e Author: Amelie Delaunay Date: Wed May 4 17:53:20 2022 +0200 dmaengine: stm32-mdma: remove GISR1 register GISR1 was described in a not up-to-date documentation when the stm32-mdma driver has been developed. This register has not been added in reference manual of STM32 SoC with MDMA, which have only 32 MDMA channels. So remove it from stm32-mdma driver. Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20220504155322.121431-2-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul commit 59cafa728c373551423d67a1369289a717006a4b Author: Colin Ian King Date: Wed May 18 09:45:36 2022 +0100 powercap: intel_rapl: remove redundant store to value after multiply There is no need to store the result of the multiply back to variable value after the multiplication. The store is redundant, replace *= with just *. Cleans up clang scan build warning: warning: Although the value stored to 'value' is used in the enclosing expression, the value is never actually read from 'value' [deadcode.DeadStores] Signed-off-by: Colin Ian King Signed-off-by: Rafael J. Wysocki commit badb81a58b9e66ca8c15405476f5134e45b57dee Author: Borislav Petkov Date: Thu May 19 16:57:15 2022 +0200 platform/x86/intel/ifs: Add CPU_SUP_INTEL dependency The driver is using functions from a compilation unit which is enabled by CONFIG_CPU_SUP_INTEL. Add that dependency to Kconfig explicitly otherwise: drivers/platform/x86/intel/ifs/load.o: in function `ifs_load_firmware': load.c:(.text+0x3b8): undefined reference to `intel_cpu_collect_info' Reported-by: Randy Dunlap Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/YoZay8YR0zRGyVu+@zn.tnic Signed-off-by: Hans de Goede commit 2d41dc23804d075e248ff01d16d9d424bcbc1180 Author: Pierre Gondois Date: Wed May 18 11:09:01 2022 +0200 cpufreq: CPPC: Enable dvfs_possible_from_any_cpu The communication mean of the _CPC desired performance can be PCC, System Memory, System IO, or Functional Fixed Hardware (FFH). PCC, SystemMemory and SystemIo address spaces are available from any CPU. Thus, dvfs_possible_from_any_cpu should be enabled in such case. For FFH, let the FFH implementation do smp_call_function_*() calls. Signed-off-by: Pierre Gondois Reviewed-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 3cc30dd00a580ca0c9c0b01639841cfd72d10129 Author: Pierre Gondois Date: Wed May 18 11:09:00 2022 +0200 cpufreq: CPPC: Enable fast_switch The communication mean of the _CPC desired performance can be PCC, System Memory, System IO, or Functional Fixed Hardware. commit b7898fda5bc7 ("cpufreq: Support for fast frequency switching") fast_switching is 'for switching CPU frequencies from interrupt context'. Writes to SystemMemory and SystemIo are fast and suitable this. This is not the case for PCC and might not be the case for FFH. Enable fast_switching for the cppc_cpufreq driver in above cases. Add cppc_allow_fast_switch() to check the desired performance register address space and set fast_switching accordingly. Signed-off-by: Pierre Gondois Reviewed-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 6380b7b2b29da9d9c5ab2d4a265901cd93ba3696 Author: Pierre Gondois Date: Wed May 18 11:08:59 2022 +0200 ACPI: CPPC: Assume no transition latency if no PCCT The transition_delay_us (struct cpufreq_policy) is currently defined as: Preferred average time interval between consecutive invocations of the driver to set the frequency for this policy. To be set by the scaling driver (0, which is the default, means no preference). The transition_latency represents the amount of time necessary for a CPU to change its frequency. A PCCT table advertises mutliple values: - pcc_nominal: Expected latency to process a command, in microseconds - pcc_mpar: The maximum number of periodic requests that the subspace channel can support, reported in commands per minute. 0 indicates no limitation. - pcc_mrtt: The minimum amount of time that OSPM must wait after the completion of a command before issuing the next command, in microseconds. cppc_get_transition_latency() allows to get the max of them. commit d4f3388afd48 ("cpufreq / CPPC: Set platform specific transition_delay_us") allows to select transition_delay_us based on the platform, and fallbacks to cppc_get_transition_latency() otherwise. If _CPC objects are not using PCC channels (no PPCT table), the transition_delay_us is set to CPUFREQ_ETERNAL, leading to really long periods between frequency updates (~4s). If the desired_reg, where performance requests are written, is in SystemMemory or SystemIo ACPI address space, there is no delay in requests. So return 0 instead of CPUFREQ_ETERNAL, leading to transition_delay_us being set to LATENCY_MULTIPLIER us (1000 us). This patch also adds two macros to check the address spaces. Signed-off-by: Pierre Gondois Reviewed-by: Sudeep Holla Signed-off-by: Rafael J. Wysocki commit 72f2ecb7ece7c1d89758d4929d98e95d95fe7199 Author: Pierre Gondois Date: Wed May 18 11:08:58 2022 +0200 ACPI: bus: Set CPPC _OSC bits for all and when CPPC_LIB is supported The _OSC method allows the OS and firmware to communicate about supported features/capabitlities. It also allows the OS to take control of some features. In ACPI 6.4, s6.2.11.2 Platform-Wide OSPM Capabilities, the CPPC (resp. v2) bit should be set by the OS if it 'supports controlling processor performance via the interfaces described in the _CPC object'. The OS supports CPPC and parses the _CPC object only if CONFIG_ACPI_CPPC_LIB is set. Replace the x86 specific boot_cpu_has(X86_FEATURE_HWP) dynamic check with an arch generic CONFIG_ACPI_CPPC_LIB build-time check. Note: CONFIG_X86_INTEL_PSTATE selects CONFIG_ACPI_CPPC_LIB. Signed-off-by: Pierre Gondois Reviewed-by: Sudeep Holla Signed-off-by: Rafael J. Wysocki commit 0651ab90e4ade17f1d4f4367b70f6120480410f3 Author: Pierre Gondois Date: Wed May 18 11:08:57 2022 +0200 ACPI: CPPC: Check _OSC for flexible address space ACPI 6.2 Section 6.2.11.2 'Platform-Wide OSPM Capabilities': Starting with ACPI Specification 6.2, all _CPC registers can be in PCC, System Memory, System IO, or Functional Fixed Hardware address spaces. OSPM support for this more flexible register space scheme is indicated by the “Flexible Address Space for CPPC Registers” _OSC bit Otherwise (cf ACPI 6.1, s8.4.7.1.1.X), _CPC registers must be in: - PCC or Functional Fixed Hardware address space if defined - SystemMemory address space (NULL register) if not defined Add the corresponding _OSC bit and check it when parsing _CPC objects. Signed-off-by: Pierre Gondois Reviewed-by: Sudeep Holla Signed-off-by: Rafael J. Wysocki commit 3ce827bf9cfecaf2cbfd9a9d44f0db9f40882780 Author: Heikki Krogerus Date: Thu May 19 15:21:03 2022 +0300 platform/x86: intel_cht_int33fe: Set driver data Module removal fails because cht_int33fe_typec_remove() tries to access driver data that does not exist. Fixing by assigning the data at the end of probe. Fixes: 915623a80b5a ("platform/x86: intel_cht_int33fe: Switch to DMI modalias based loading") Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20220519122103.78546-1-heikki.krogerus@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit bd30d075eedce159fd5a42e772b903facaa3c47c Author: Zhang Rui Date: Thu May 19 22:35:08 2022 +0800 thermal: intel: pch: improve the cooling delay log Previously, during suspend, intel_pch_thermal driver logs for every cooling iteration, about the current PCH temperature and number of cooling iterations that have been tried, like below [ 100.955526] intel_pch_thermal 0000:00:14.2: CPU-PCH current temp [53C] higher than the threshold temp [50C], sleep 1 times for 100 ms duration [ 101.064156] intel_pch_thermal 0000:00:14.2: CPU-PCH current temp [53C] higher than the threshold temp [50C], sleep 2 times for 100 ms duration After changing the default delay_cnt to 600, in practice, it is common to see tens of the above messages if the system is suspended when PCH overheats. Thus, change this log message from dev_warn to dev_dbg because it is only useful when we want to check the temperature trend. At the same time, there is always a one-line message given by the driver with the patch applied, with below four possibilities. 1. PCH is cool, no cooling delay needed [ 1791.902853] intel_pch_thermal 0000:00:12.0: CPU-PCH is cool [48C] 2. PCH overheats and becomes cool after the cooling delays [ 1475.511617] intel_pch_thermal 0000:00:12.0: CPU-PCH is cool [49C] after 30700 ms delay 3. PCH still overheats after the overall cooling timeout [ 2250.157487] intel_pch_thermal 0000:00:12.0: CPU-PCH is hot [60C] after 60000 ms delay. S0ix might fail 4. PCH aborts cooling because of wakeup event detected during the delay [ 1933.639509] intel_pch_thermal 0000:00:12.0: Wakeup event detected, abort cooling Signed-off-by: Zhang Rui Tested-by: Sumeet Pawnikar Signed-off-by: Rafael J. Wysocki commit 92923028e9795055debc460243cc246cc9284cd1 Author: Zhang Rui Date: Thu May 19 22:35:07 2022 +0800 thermal: intel: pch: enhance overheat handling Commit ef63b043ac86 ("thermal: intel: pch: fix S0ix failure due to PCH temperature above threshold") introduces delay loop mechanism that allows PCH temperature to go down below threshold during suspend so it won't block S0ix. And the default overall delay timeout is 1 second. However, in practice, we found that the time it takes to cool the PCH down below threshold highly depends on the initial PCH temperature when the delay starts, as well as the ambient temperature. And in some cases, the 1 second delay is not sufficient. As a result, the system stays in a shallower power state like PCx instead of S0ix, and drains the battery power, without user' notice. To make sure S0ix is not blocked by the PCH overheating, we 1. expand the default overall timeout to 60 seconds. 2. make sure the temperature is below threshold rather than equal to it. At the same time, as the cooling delay can be much longer and many wakeup events (ACPI Power Button press, USB mouse move, etc) becomes valid in the suspend_noirq phase, add detection of wakeup event so that the driver does not delay blindly when the system suspend is likely to abort soon. This patch may introduce longer suspend time, but only in the cases when the system overheats and Linux used to enter a shallower S2idle state, say, PCx instead of S0ix. Signed-off-by: Zhang Rui Tested-by: Sumeet Pawnikar Signed-off-by: Rafael J. Wysocki commit 28708e19370013d819a511e76a0a85ae10f1be15 Author: Zhang Rui Date: Thu May 19 22:35:06 2022 +0800 thermal: intel: pch: move cooling delay to suspend_noirq phase Move the PCH Thermal driver suspend callback to suspend_noirq to do cooling while the system is more quiescent. Signed-off-by: Zhang Rui Tested-by: Sumeet Pawnikar Signed-off-by: Rafael J. Wysocki commit 55266546f45dcc9284ca93f4fa3f6693d30ea8ce Author: Zhang Rui Date: Thu May 19 22:35:05 2022 +0800 PM: wakeup: expose pm_wakeup_pending to modules intel_pch_thermal driver needs a long delay to cool itself (60 seconds in maximum) during suspend. When a wakeup event occures during the delay, it is better for the intel_pch_thermal driver to detect this and quit cooling because the suspend is likely to abort anyway. Thus expose pm_wakeup_pending to modules so that intel_pch_thermal driver can be aware of the wakeup events. Signed-off-by: Zhang Rui Tested-by: Sumeet Pawnikar Signed-off-by: Rafael J. Wysocki commit 1620c80bba53af8c547bab34a1d3bc58319fe608 Author: Michael Niewöhner Date: Tue May 17 20:31:30 2022 +0200 platform/x86: intel-hid: fix _DSM function index handling intel_hid_dsm_fn_mask is a bit mask containing one bit for each function index. Fix the function index check in intel_hid_evaluate_method accordingly, which was missed in commit 97ab4516205e ("platform/x86: intel-hid: fix _DSM function index handling"). Fixes: 97ab4516205e ("platform/x86: intel-hid: fix _DSM function index handling") Cc: stable@vger.kernel.org Signed-off-by: Michael Niewöhner Link: https://lore.kernel.org/r/66f813f5bcc724a0f6dd5adefe6a9728dbe509e3.camel@mniewoehner.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 9dcff75d39f246f3bb39b2816f35f54d6add8545 Merge: 6646b95aab5f6 3be0ec65fd17b Author: Greg Kroah-Hartman Date: Thu May 19 19:37:39 2022 +0200 Merge tag 'icc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 5.19 These are the interconnect changes for the 5.19-rc1 merge window consisting of driver updates. Driver changes: - New driver for SC8280XP - New driver for SDX65 - SC8180X driver fixes - Constify various data structures in that are never modified - Fix clock rate caching in RPM drivers. - Misc fixes and clean-ups Signed-off-by: Georgi Djakov * tag 'icc-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: dt-bindings: interconnect: Remove sc7180/sdx55 ipa compatibles interconnect: qcom: sc8180x: Reformat node and bcm definitions interconnect: qcom: sc8180x: Mark some BCMs keepalive interconnect: qcom: sc8180x: Fix QUP0 nodes interconnect: qcom: sc8180x: Modernize sc8180x probe dt-bindings: interconnect: Add SC8180X QUP0 virt provider interconnect: qcom: icc-rpm: Cache every clock rate interconnect: qcom: icc-rpm: Fix for cached clock rate interconnect: qcom: sc8280xp: constify qcom_icc_bcm pointers interconnect: qcom: sc8280xp: constify icc_node pointers interconnect: qcom: sc8280xp: constify qcom_icc_desc interconnect: qcom: Add SDX65 interconnect provider driver dt-bindings: interconnect: Add Qualcomm SDX65 DT bindings interconnect: qcom: constify qcom_icc_bcm pointers interconnect: qcom: constify icc_node pointers interconnect: qcom: constify qcom_icc_desc interconnect: qcom: Add SC8280XP interconnect provider dt-bindings: interconnect: qcom: Add sc8280xp binding commit b232b02bf3c205b13a26dcec08e53baddd8e59ed Author: Zhang Wensheng Date: Wed May 18 15:45:16 2022 +0800 driver core: fix deadlock in __device_attach In __device_attach function, The lock holding logic is as follows: ... __device_attach device_lock(dev) // get lock dev async_schedule_dev(__device_attach_async_helper, dev); // func async_schedule_node async_schedule_node_domain(func) entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC); /* when fail or work limit, sync to execute func, but __device_attach_async_helper will get lock dev as well, which will lead to A-A deadlock. */ if (!entry || atomic_read(&entry_count) > MAX_WORK) { func; else queue_work_node(node, system_unbound_wq, &entry->work) device_unlock(dev) As shown above, when it is allowed to do async probes, because of out of memory or work limit, async work is not allowed, to do sync execute instead. it will lead to A-A deadlock because of __device_attach_async_helper getting lock dev. To fix the deadlock, move the async_schedule_dev outside device_lock, as we can see, in async_schedule_node_domain, the parameter of queue_work_node is system_unbound_wq, so it can accept concurrent operations. which will also not change the code logic, and will not lead to deadlock. Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") Signed-off-by: Zhang Wensheng Link: https://lore.kernel.org/r/20220518074516.1225580-1-zhangwensheng5@huawei.com Signed-off-by: Greg Kroah-Hartman commit 1a702dc88e150487c9c173a249b3d236498b9183 Author: Hao Luo Date: Mon May 16 12:09:51 2022 -0700 kernfs: Separate kernfs_pr_cont_buf and rename_lock. Previously the protection of kernfs_pr_cont_buf was piggy backed by rename_lock, which means that pr_cont() needs to be protected under rename_lock. This can cause potential circular lock dependencies. If there is an OOM, we have the following call hierarchy: -> cpuset_print_current_mems_allowed() -> pr_cont_cgroup_name() -> pr_cont_kernfs_name() pr_cont_kernfs_name() will grab rename_lock and call printk. So we have the following lock dependencies: kernfs_rename_lock -> console_sem Sometimes, printk does a wakeup before releasing console_sem, which has the dependence chain: console_sem -> p->pi_lock -> rq->lock Now, imagine one wants to read cgroup_name under rq->lock, for example, printing cgroup_name in a tracepoint in the scheduler code. They will be holding rq->lock and take rename_lock: rq->lock -> kernfs_rename_lock Now they will deadlock. A prevention to this circular lock dependency is to separate the protection of pr_cont_buf from rename_lock. In principle, rename_lock is to protect the integrity of cgroup name when copying to buf. Once pr_cont_buf has got its content, rename_lock can be dropped. So it's safe to drop rename_lock after kernfs_name_locked (and kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock to protect pr_cont_buf. Acked-by: Tejun Heo Signed-off-by: Hao Luo Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com Signed-off-by: Greg Kroah-Hartman commit a6653fb584b5f6ac60ddd5d86ddd49a1f3945a04 Author: Ulf Hansson Date: Sat May 14 17:20:44 2022 +0200 cpuidle: riscv-sbi: Fix code to allow a genpd governor to be used The intent is to use a genpd governor when there are some states that needs to be managed. Although, the current code ends up to never assign a governor, let's fix this. Fixes: 6abf32f1d9c50 ("cpuidle: Add RISC-V SBI CPU idle driver") Signed-off-by: Ulf Hansson Reviewed-by: Anup Patel Tested-by: Anup Patel Signed-off-by: Rafael J. Wysocki commit 34be27517cb763ea367da21e3cdee5d1bc40f47f Author: Ulf Hansson Date: Sat May 14 17:20:32 2022 +0200 cpuidle: psci: Fix regression leading to no genpd governor While factoring out the PM domain related code from PSCI domain driver into a set of library functions, a regression when initializing the genpds got introduced. More precisely, we fail to assign a genpd governor, so let's fix this. Fixes: 9d976d6721df ("cpuidle: Factor-out power domain related code from PSCI domain driver") Signed-off-by: Ulf Hansson Reviewed-by: Anup Patel Signed-off-by: Rafael J. Wysocki commit bc10916e890948d8927a5c8c40fb5dc44be5e1b8 Author: Denis Efremov Date: Wed May 18 11:00:52 2022 +0400 staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->Ssid[] array. Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Cc: stable Signed-off-by: Denis Efremov Link: https://lore.kernel.org/r/20220518070052.108287-1-denis.e.efremov@oracle.com Signed-off-by: Greg Kroah-Hartman commit 15f214f9bdb7c1f560b4bf863c5a72ff53b442a4 Author: Dietmar Eggemann Date: Fri May 13 11:34:33 2022 +0200 topology: Remove unused cpu_cluster_mask() default_topology[] uses cpu_clustergroup_mask() for the CLS level (guarded by CONFIG_SCHED_CLUSTER) which is currently provided by x86 (arch/x86/kernel/smpboot.c) and arm64 (drivers/base/arch_topology.c). Fixes: 778c558f49a2 ("sched: Add cluster scheduler level in core and related Kconfig for ARM64") Acked-by: Barry Song Signed-off-by: Dietmar Eggemann Link: https://lore.kernel.org/r/20220513093433.425163-1-dietmar.eggemann@arm.com Signed-off-by: Greg Kroah-Hartman commit 2b28a1a84a0eb3412bad1a2d5cce2bb4addec626 Author: Saravana Kannan Date: Fri Apr 29 15:09:32 2022 -0700 driver core: Extend deferred probe timeout on driver registration The deferred probe timer that's used for this currently starts at late_initcall and runs for driver_deferred_probe_timeout seconds. The assumption being that all available drivers would be loaded and registered before the timer expires. This means, the driver_deferred_probe_timeout has to be pretty large for it to cover the worst case. But if we set the default value for it to cover the worst case, it would significantly slow down the average case. For this reason, the default value is set to 0. Also, with CONFIG_MODULES=y and the current default values of driver_deferred_probe_timeout=0 and fw_devlink=on, devices with missing drivers will cause their consumer devices to always defer their probes. This is because device links created by fw_devlink defer the probe even before the consumer driver's probe() is called. Instead of a fixed timeout, if we extend an unexpired deferred probe timer on every successful driver registration, with the expectation more modules would be loaded in the near future, then the default value of driver_deferred_probe_timeout only needs to be as long as the worst case time difference between two consecutive module loads. So let's implement that and set the default value to 10 seconds when CONFIG_MODULES=y. Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Rob Herring Cc: Linus Walleij Cc: Will Deacon Cc: Ulf Hansson Cc: Kevin Hilman Cc: Thierry Reding Cc: Mark Brown Cc: Pavel Machek Cc: Geert Uytterhoeven Cc: Yoshihiro Shimoda Cc: Paul Kocialkowski Cc: linux-gpio@vger.kernel.org Cc: linux-pm@vger.kernel.org Cc: iommu@lists.linux-foundation.org Reviewed-by: Mark Brown Acked-by: Rob Herring Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220429220933.1350374-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 42d2607d91c4ec37ea1970899c2d614824f3014b Author: Chanwoo Choi Date: Thu May 19 10:07:53 2022 +0900 PM / devfreq: passive: Return non-error when not-supported event is required Each devfreq governor specifies the supported governor event such as GOV_START and GOV_STOP. When not-supported event is required, just return non-error. But, commit ce9a0d88d97a ("PM / devfreq: Add cpu based scaling support to passive governor") returned the error value. So that return non-error value when not-supported event is required. Fixes: ce9a0d88d97a ("PM / devfreq: Add cpu based scaling support to passive governor") Reported-by: Marek Szyprowski Signed-off-by: Chanwoo Choi Signed-off-by: Rafael J. Wysocki commit 6779db970bd287bb35b28bd5dc256fd7aef19d1c Author: Dmitry Osipenko Date: Tue May 10 02:32:35 2022 +0300 kernel/reboot: Add devm_register_restart_handler() Add devm_register_restart_handler() helper that registers sys-off handler using restart mode and with a default priority. Most drivers will want to register restart handler with a default priority, so this helper will reduce the boilerplate code and make code easier to read and follow. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit d2c5415327171e6c1bca2dc4d8a77f450ecf7150 Author: Dmitry Osipenko Date: Tue May 10 02:32:34 2022 +0300 kernel/reboot: Add devm_register_power_off_handler() Add devm_register_power_off_handler() helper that registers sys-off handler using power-off mode and with a default priority. Most drivers will want to register power-off handler with a default priority, so this helper will reduce the boilerplate code and make code easier to read and follow. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit eae813b755c46c74d65f52fa6b0b1a5476e13551 Author: Dmitry Osipenko Date: Tue May 10 02:32:33 2022 +0300 soc/tegra: pmc: Use sys-off handler API to power off Nexus 7 properly Nexus 7 Android tablet can be turned off using a special bootloader command which is conveyed to bootloader by putting magic value into the special scratch register and then rebooting normally. This power-off method should be invoked if USB cable is connected. Bootloader then will display battery status and power off the device. This behaviour is borrowed from downstream kernel and matches user expectations, otherwise it looks like device got hung during power-off and it may wake up on USB disconnect. Switch PMC driver to sys-off handler API, which provides drivers with chained power-off callbacks functionality that is required for powering-off devices properly. It also brings resource-managed API for the restart handler registration that makes PMC driver code cleaner. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 5b71808eb7c97815fc3b9c386ca0ef6daf2dc053 Author: Dmitry Osipenko Date: Tue May 10 02:32:32 2022 +0300 reboot: Remove pm_power_off_prepare() All pm_power_off_prepare() users were converted to sys-off handler API. Remove the obsolete global callback variable. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 02a1124defc2571b81c054ae4c5481f1ac7ccf20 Author: Dmitry Osipenko Date: Tue May 10 02:32:31 2022 +0300 regulator: pfuze100: Use devm_register_sys_off_handler() Use devm_register_sys_off_handler() that replaces global pm_power_off_prepare variable and allows to register multiple power-off handlers. Acked-by: Mark Brown Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 98f30d0ecf79da8cf17a171fa4cf6eda7ba4dd71 Author: Dmitry Osipenko Date: Tue May 10 02:32:30 2022 +0300 ACPI: power: Switch to sys-off handler API Switch to sys-off API that replaces legacy pm_power_off callbacks, allowing us to remove global pm_* variables and support chaining of all restart and power-off modes consistently. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit bf8d73b934df8aa485dc4650d6d5dfe5a640af4b Author: Dmitry Osipenko Date: Tue May 10 02:32:29 2022 +0300 memory: emif: Use kernel_can_power_off() Replace legacy pm_power_off with kernel_can_power_off() helper that is aware about chained power-off handlers. Acked-by: Krzysztof Kozlowski Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 2dfb34edfebf8a881914ffc80551fd37d1b632c2 Author: Dmitry Osipenko Date: Tue May 10 02:32:28 2022 +0300 mips: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Thomas Bogendoerfer Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit d3ad437e68712ad82177e5ae481688a06661f797 Author: Dmitry Osipenko Date: Tue May 10 02:32:27 2022 +0300 ia64: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit d35773499329300d837818417f6d1b5a7987317d Author: Dmitry Osipenko Date: Tue May 10 02:32:26 2022 +0300 x86: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 9b0d0af145195cfd79210b805448a4bcc69f0e04 Author: Dmitry Osipenko Date: Tue May 10 02:32:25 2022 +0300 sh: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit f0f7e5265b3b37b0aea3d7601607e2e46ea6a9c1 Author: Dmitry Osipenko Date: Tue May 10 02:32:24 2022 +0300 m68k: Switch to new sys-off handler API Kernel now supports chained power-off handlers. Use register_power_off_handler() that registers power-off handlers and do_kernel_power_off() that invokes chained power-off handlers. Legacy pm_power_off() will be removed once all drivers will be converted to the new sys-off API. Normally arch code should adopt only the do_kernel_power_off() at first, but m68k is a special case because it uses pm_power_off() "inside out", i.e. pm_power_off() invokes machine_power_off() [in fact it does nothing], while it's machine_power_off() that should invoke the pm_power_off(), and thus, we can't convert platforms to the new API separately. There are only two platforms changed here, so it's not a big deal. Acked-by: Geert Uytterhoeven Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit c33fd0b17eab643e13cb8555a0588ae6eee8f657 Author: Dmitry Osipenko Date: Tue May 10 02:32:23 2022 +0300 powerpc: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Michael Ellerman Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit f089ab674cea43561fee8e3de8d15d864e486286 Author: Dmitry Osipenko Date: Tue May 10 02:32:22 2022 +0300 xen/x86: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Juergen Gross Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit f4622fe42484209fe2050b5461d14b6a1dd212ad Author: Dmitry Osipenko Date: Tue May 10 02:32:21 2022 +0300 parisc: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Helge Deller # parisc Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 0c6499149ebdb2ea7dd3507bb2263e5848c94ad7 Author: Dmitry Osipenko Date: Tue May 10 02:32:20 2022 +0300 arm64: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Catalin Marinas Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 6b22c7365962a80c4e8fb7dea19247cef260e725 Author: Dmitry Osipenko Date: Tue May 10 02:32:19 2022 +0300 riscv: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Palmer Dabbelt Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit cf7e5bf0c68fa4a057ad3297ebdafa1189208236 Author: Dmitry Osipenko Date: Tue May 10 02:32:18 2022 +0300 csky: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Acked-by: Guo Ren Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 856c288b0039791f64bdeb16e2a73ae1c8e5e575 Author: Dmitry Osipenko Date: Tue May 10 02:32:17 2022 +0300 ARM: Use do_kernel_power_off() Kernel now supports chained power-off handlers. Use do_kernel_power_off() that invokes chained power-off handlers. It also invokes legacy pm_power_off() for now, which will be removed once all drivers will be converted to the new sys-off API. Reviewed-by: Russell King (Oracle) Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit fb61375ecfba49e153af561402f49f6fe3bebd39 Author: Dmitry Osipenko Date: Tue May 10 02:32:16 2022 +0300 kernel/reboot: Add register_platform_power_off() Add platform-level registration helpers that will ease transition of the arch/platform power-off callbacks to the new sys-off based API, allowing us to remove the global pm_power_off variable in the future. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 0e2110d2e910e44cc7cf23fce14613e232602602 Author: Dmitry Osipenko Date: Tue May 10 02:32:15 2022 +0300 kernel/reboot: Add kernel_can_power_off() Add kernel_can_power_off() helper that replaces open-coded checks of the global pm_power_off variable. This is a necessary step towards supporting chained power-off handlers. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 5d34b41aa420c3908793b43419a1097362ca2668 Author: Dmitry Osipenko Date: Tue May 10 02:32:14 2022 +0300 kernel/reboot: Add stub for pm_power_off Add weak stub for the global pm_power_off callback variable. This will allow us to remove pm_power_off definitions from arch/ code and transition to the new sys-off based API that will replace the global variable. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 2b6aa7332f8020dfdaffe340ff038aac4df35238 Author: Dmitry Osipenko Date: Tue May 10 02:32:13 2022 +0300 kernel/reboot: Add do_kernel_power_off() Add do_kernel_power_off() helper that will remove open-coded pm_power_off invocations from the architecture code. This is the first step on the way to remove the global pm_power_off variable, which will allow us to implement consistent power-off chaining support. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 7b9a3de9ffe76e4a965bafe26c91d9c6351e1e18 Author: Dmitry Osipenko Date: Tue May 10 02:32:12 2022 +0300 kernel/reboot: Wrap legacy power-off callbacks into sys-off handlers Wrap legacy power-off callbacks into sys-off handlers in order to support co-existence of both legacy and new callbacks while we're in process of upgrading legacy callbacks to the new API. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 232edc2f72f5beda3586360de6254d443820050a Author: Dmitry Osipenko Date: Tue May 10 02:32:11 2022 +0300 kernel/reboot: Introduce sys-off handler API In order to support power-off chaining we need to get rid of the global pm_* variables, replacing them with the new kernel API functions that support chaining. Introduce new generic sys-off handler API that brings the following features: 1. Power-off and restart handlers are registered using same API function that supports chaining, hence all power-off and restart modes will support chaining using this unified function. 2. Prevents notifier priority collisions by disallowing registration of multiple handlers at the non-default priority level. 3. Supports passing opaque user argument to callback, which allows us to remove global variables from drivers. This patch adds support of the following sys-off modes: - SYS_OFF_MODE_POWER_OFF_PREPARE that replaces global pm_power_off_prepare variable and provides chaining support for power-off-prepare handlers. - SYS_OFF_MODE_POWER_OFF that replaces global pm_power_off variable and provides chaining support for power-off handlers. - SYS_OFF_MODE_RESTART that provides a better restart API, removing a need from drivers to have a global scratch variable by utilizing the opaque callback argument. Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit c82f898d873ce10d88f8d60b38c8dd19f1ed7c66 Author: Dmitry Osipenko Date: Tue May 10 02:32:10 2022 +0300 notifier: Add blocking/atomic_notifier_chain_register_unique_prio() Add variant of blocking/atomic_notifier_chain_register() functions that allow registration of a notifier only if it has unique priority, otherwise -EBUSY error code is returned by the new functions. Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 6ee60e9c9f2f83ad218159af6a175c57a395ae69 Author: Luis Chamberlain Date: Thu May 12 11:55:29 2022 -0700 MAINTAINERS: add Russ Weight as a firmware loader maintainer Russ has done extensive rework on the usermode helper interface for the firmware loader. He's also exressed recent interest with maintenance and has kindly agreed to help review generic patches for the firmware loader. So add him as a new maintainer! Signed-off-by: Luis Chamberlain Signed-off-by: Russ Weight Link: https://lore.kernel.org/r/20220512185529.3138310-1-mcgrof@kernel.org Signed-off-by: Greg Kroah-Hartman commit 310862e574001a97ad02272bac0fd13f75f42a27 Author: Schspa Shi Date: Fri May 13 19:24:44 2022 +0800 driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed. Fixes: 190888ac01d0 ("driver core: fix possible missing of device probe") Signed-off-by: Schspa Shi Link: https://lore.kernel.org/r/20220513112444.45112-1-schspa@gmail.com Signed-off-by: Greg Kroah-Hartman commit 185b29c6151cf3a5c387ca5904c51c6af3292a0c Author: Dan Carpenter Date: Fri May 6 09:55:15 2022 +0300 test_firmware: fix end of loop test in upload_read_show() If a list_for_each_entry() loop exits without hitting a break statement then the iterator points to invalid memory. So in this code the "tst->name" dereference is an out bounds read. It's an offset from the &test_upload_list pointer and it will likely work fine most of the time but it's not correct. One alternative is to fix this this by changing the test to: if (list_entry_is_head(tst, &test_upload_list, node)) { But the simpler, trendy new way is just create a new variable and test for NULL. Fixes: a31ad463b72d ("test_firmware: Add test support for firmware upload") Reviewed-by: Russ Weight Acked-by: Luis Chamberlain Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YnTGU3UJOIA09I7e@kili Signed-off-by: Greg Kroah-Hartman commit 1f7ff11ca68f464b6a9a71b8fbe9e5219e7cac57 Author: Won Chung Date: Mon May 9 21:49:30 2022 +0000 driver core: location: Add "back" as a possible output for panel Add "back" as a possible panel output when _PLD output from ACPI indicates back panel. Fixes: 6423d2951087 ("driver core: Add sysfs support for physical location of a device") Signed-off-by: Won Chung Link: https://lore.kernel.org/r/20220509214930.3573518-1-wonchung@google.com Signed-off-by: Greg Kroah-Hartman commit 28330dcc94152433c4bbc3d4d7a26755d4211874 Author: Won Chung Date: Mon May 9 17:31:35 2022 +0000 driver core: location: Free struct acpi_pld_info *pld After struct acpi_pld_info *pld is used to fill in physical location values, it should be freed to prevent memleak. Suggested-by: Yu Watanabe Signed-off-by: Won Chung Link: https://lore.kernel.org/r/20220509173135.3515126-1-wonchung@google.com Signed-off-by: Greg Kroah-Hartman commit f79f662e4cd56f6fd3436dd68057d2ec1f7d2025 Author: Saravana Kannan Date: Tue May 3 17:53:43 2022 -0700 driver core: Add "*" wildcard support to driver_async_probe cmdline param There's currently no way to use driver_async_probe kernel cmdline param to enable default async probe for all drivers. So, add support for "*" to match with all driver names. When "*" is used, all other drivers listed in driver_async_probe are drivers that will NOT match the "*". For example: * driver_async_probe=drvA,drvB,drvC drvA, drvB and drvC do asynchronous probing. * driver_async_probe=* All drivers do asynchronous probing except those that have set PROBE_FORCE_SYNCHRONOUS flag. * driver_async_probe=*,drvA,drvB,drvC All drivers do asynchronous probing except drvA, drvB, drvC and those that have set PROBE_FORCE_SYNCHRONOUS flag. Cc: Alexander Duyck Cc: Randy Dunlap Cc: Feng Tang Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220504005344.117803-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit a725e582d720066e49034f8980af57a720d75127 Author: Krzysztof Kozlowski Date: Wed Apr 27 18:11:23 2022 +0200 dmaengine: ti: deprecate '#dma-channels' The generic property, used in most of the drivers and defined in generic dma-common DT bindings, is 'dma-channels'. Switch to new property while keeping backward compatibility. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Tony Lindgren Link: https://lore.kernel.org/r/20220427161126.647073-4-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 13dfd97a341a5cf9d15f415dd469f45e971ef12a Author: Dmitry Osipenko Date: Thu May 19 14:02:32 2022 +0300 notifier: Add atomic_notifier_call_chain_is_empty() Add atomic_notifier_call_chain_is_empty() that returns true if given atomic call chain is empty. The first user of this new notifier API function will be the kernel power-off core code that will support power-off call chains. The core code will need to check whether there is a power-off handler registered at all in order to decide whether to halt machine or power it off. Reviewed-by: Michał Mirosław Signed-off-by: Dmitry Osipenko Signed-off-by: Rafael J. Wysocki commit 607c04a0441ff477666dca4744e94f555aa8fd65 Author: Krzysztof Kozlowski Date: Tue May 3 08:54:06 2022 +0200 dmaengine: mmp: deprecate '#dma-channels' The generic property, used in most of the drivers and defined in generic dma-common DT bindings, is 'dma-channels'. Switch to new property while keeping backward compatibility. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220503065407.52188-4-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit d9cb0a4c0be595b55e30cf8774d3e92ab38bca5b Author: Krzysztof Kozlowski Date: Tue May 3 08:54:05 2022 +0200 dmaengine: pxa: deprecate '#dma-channels' and '#dma-requests' The generic properties, used in most of the drivers and defined in generic dma-common DT bindings, are 'dma-channels' and 'dma-requests'. Switch to new properties while keeping backward compatibility. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220503065407.52188-3-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit bd1eca7b2c66c53873a0eab84f9f301aca41f33a Author: Krzysztof Kozlowski Date: Tue May 3 08:54:04 2022 +0200 dt-bindings: dmaengine: mmp: deprecate '#dma-channels' and '#dma-requests' The generic properties, used in most of the drivers and defined in generic dma-common DT bindings, are 'dma-channels' and 'dma-requests'. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220503065407.52188-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 2cdd3ca67aeabf4d6274af2d1c7e22f17a33dd64 Author: YueHaibing Date: Thu May 5 17:32:36 2022 +0800 dmaengine: tegra: Fix build error without IOMMU_API drivers/dma/tegra186-gpc-dma.c: In function ‘tegra_dma_probe’: drivers/dma/tegra186-gpc-dma.c:1364:24: error: ‘struct iommu_fwspec’ has no member named ‘ids’ stream_id = iommu_spec->ids[0] & 0xffff; ^~ Make TEGRA186_GPC_DMA depends on IOMMU_API to fix this. Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20220505093236.15076-1-yuehaibing@huawei.com Signed-off-by: Vinod Koul commit c23b7517fe623d5812436682937a79ca0cc4cd39 Merge: 7b145802ba545 ffcb2fc86eb7e Author: Rafael J. Wysocki Date: Thu May 19 19:15:34 2022 +0200 Merge tag 'thermal-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal control material for 5.19-rc1 from Daniel Lezcano: - Add the new k3 j72xx bangdap driver and the corresponding bindings (Keerthy) - Fix the missing of_node_put() in the SC iMX driver at probe timer (Miaoqian Lin) - Fix memory leak in __thermal_cooling_device_register() when device_register() fails by calling thermal_cooling_device_destroy_sysfs() (Yang Yingliang) - Add sc8180x and sc8280xp compatible string in the DT bindings and lMH support for QCom tsens driver (Bjorn Andersson) - Fix OTP Calibration Register values conforming to the documentation on RZ/G2L and bindings documentation for RZ/G2UL (Biju Das) - Fix type in kerneldoc description for __thermal_bind_params (Corentin Labbe) - Remove unneeded semi colon in libthermal and tools thermal as reported by cocci (Jiapeng Chong) - Fix potential NULL dereference in sr_thermal_probe() on Broadcom platform (Zheng Yongjun) - Add thermal library and thermal tools to encapsulate the netlink into event based callbacks (Daniel Lezcano) - Add change mode ops for the thermal-of sensor (Manaf Meethalavalappu Pallikunhi) - Fix non negative value support by preventing the value to be clamp to zero (Stefan Wahren) - Add compatible string and DT bindings for MSM8960 tsens driver (Dmitry Baryshkov) - Add hwmon support for K3 driver (Massimiliano Minella) - Refactor and add multiple generations support for QCom ADC driver (Jishnu Prakash) - Use platform_get_irq_optional() to get the interrupt on RCar driver and document Document RZ/V2L bindings (Lad Prabhakar) * tag 'thermal-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (28 commits) thermal: k3_j72xx_bandgap: Add the bandgap driver support dt-bindings: thermal: k3-j72xx: Add VTM bindings documentation thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe thermal/core: Fix memory leak in __thermal_cooling_device_register() dt-bindings: thermal: tsens: Add sc8280xp compatible dt-bindings: thermal: lmh: Add Qualcomm sc8180x compatible thermal/drivers/qcom/lmh: Add sc8180x compatible thermal/drivers/rz2gl: Fix OTP Calibration Register values dt-bindings: thermal: rzg2l-thermal: Document RZ/G2UL bindings thermal: thermal_of: fix typo on __thermal_bind_params tools/thermal: remove unneeded semicolon tools/lib/thermal: remove unneeded semicolon thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe tools/thermal: Add thermal daemon skeleton tools/thermal: Add a temperature capture tool tools/thermal: Add util library tools/lib/thermal: Add a thermal library thermal/drivers/thermal_of: Add change_mode ops support for thermal_of sensor thermal/drivers/bcm2711: Don't clamp temperature at zero thermal/drivers/tsens: Add compat string for the qcom,msm8960 ... commit d5a8fe0fee54d830c47959f625ffc41d080ee526 Author: Miquel Raynal Date: Wed Apr 27 11:56:51 2022 +0200 dmaengine: dw: Add RZN1 compatible The Renesas RZN1 DMA IP is very close to the original DW DMA IP, a DMA router has been introduced to handle the wiring options that have been added. Signed-off-by: Miquel Raynal Reviewed-by: Geert Uytterhoeven Acked-by: Andy Shevchenko Acked-By: Vinod Koul Link: https://lore.kernel.org/r/20220427095653.91804-8-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 2182066d95c33dfb4cb7400952a92cfd12265873 Author: Miquel Raynal Date: Wed Apr 27 11:56:50 2022 +0200 clk: renesas: r9a06g032: Probe possible children The clock controller device on r9a06g032 takes all the memory range that is described as being a system controller. This range contains many different (unrelated?) registers besides the ones belonging to the clock controller, that can necessitate to be accessed from other peripherals. For instance, the dmamux registers are there. The dmamux "device" will be described as a child node of the clock/system controller node, which means we need the top device driver (the clock controller driver in this case) to populate its children manually. In case of error when populating the children, we do not fail the probe on purpose to keep the clk driver up and running. Signed-off-by: Miquel Raynal Acked-by: Stephen Boyd Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220427095653.91804-7-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 134d9c52fca26d2d199516e915da00f0cc6adc73 Author: Miquel Raynal Date: Wed Apr 27 11:56:49 2022 +0200 dmaengine: dw: dmamux: Introduce RZN1 DMA router support The Renesas RZN1 DMA IP is based on a DW core, with eg. an additional dmamux register located in the system control area which can take up to 32 requests (16 per DMA controller). Each DMA channel can be wired to two different peripherals. We need two additional information from the 'dmas' property: the channel (bit in the dmamux register) that must be accessed and the value of the mux for this channel. Signed-off-by: Miquel Raynal Reviewed-by: Andy Shevchenko Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220427095653.91804-6-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 885525c1e7e27ea6207d648a8db20dfbbd9e4238 Author: Miquel Raynal Date: Wed Apr 27 11:56:48 2022 +0200 clk: renesas: r9a06g032: Export function to set dmamux The dmamux register is located within the system controller. Without syscon, we need an extra helper in order to give write access to this register to a dmamux driver. Signed-off-by: Miquel Raynal Acked-by: Stephen Boyd Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220427095653.91804-5-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 7ac92262e1fb574ee4da2944b83e412aa0ae2ab4 Author: Miquel Raynal Date: Wed Apr 27 11:56:47 2022 +0200 dt-bindings: dmaengine: Introduce RZN1 DMA compatible Just like for the NAND controller that is also on this SoC, let's provide a SoC generic and a more specific couple of compatibles for the DMA controller. Signed-off-by: Miquel Raynal Reviewed-by: Geert Uytterhoeven Acked-by: Rob Herring Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20220427095653.91804-4-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit ad73c629b591c73baac67cb388ea342d076f6b1b Author: Miquel Raynal Date: Wed Apr 27 11:56:46 2022 +0200 dt-bindings: clock: r9a06g032-sysctrl: Reference the DMAMUX subnode This system controller contains several registers that have nothing to do with the clock handling, like the DMA mux register. Describe this part of the system controller as a subnode. Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Acked-by: Stephen Boyd Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220427095653.91804-3-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 6cd4154a266584ca3908305ce64e14a5f0f3e81f Author: Miquel Raynal Date: Wed Apr 27 11:56:45 2022 +0200 dt-bindings: dmaengine: Introduce RZN1 dmamux bindings The Renesas RZN1 DMA IP is based on a DW core, with eg. an additional dmamux register located in the system control area which can take up to 32 requests (16 per DMA controller). Each DMA channel can be wired to two different peripherals. Signed-off-by: Miquel Raynal Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20220427095653.91804-2-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 6646b95aab5f62c049f1416a3801dec5432c348b Author: Samuel Thibault Date: Mon May 16 01:03:58 2022 +0200 speakup: Generate speakupmap.h automatically speakupmap.h was not actually intended to be source code, speakupmap.map is. This resurrects the makemapdata.c and genmap.c tools to generate speakupmap.h automatically from the input and speakup headers, and the speakupmap.map keyboard mapping source file. Signed-off-by: Samuel Thibault Link: https://lore.kernel.org/r/20220515230358.ikwt2kspiwvv5cf4@begin Signed-off-by: Greg Kroah-Hartman commit e6d3c99adf54fc1dcd07729990dc32acd3be874b Author: Abhyuday Godhasara Date: Wed Apr 27 00:48:03 2022 -0700 driver: soc: xilinx: Update function prototype for xlnx_unregister_event As per the current implementation only single callback data gets saved per event, driver is throwing an error if try to register multiple callback for same event. So at time of unregistration of any event required things are event details and callback handler as parameter of xlnx_unregister_event(). As part of adding support of multiple callbacks for same event also require change in prototype of xlnx_unregister_event(). During unregistration of any events, now required things are event details, callback handler and agent's private data as parameter of xlnx_unregister_event(). Also modify the usage of xlnx_unregister_event() in xilinx/zynqmp_power.c driver as per new implementation. Signed-off-by: Abhyuday Godhasara Link: https://lore.kernel.org/r/20220427074803.19009-3-abhyuday.godhasara@xilinx.com Signed-off-by: Greg Kroah-Hartman commit 05e5ba40ea7ab6a99bb8d6117c899d0e13ca8700 Author: Abhyuday Godhasara Date: Wed Apr 27 00:48:02 2022 -0700 driver: soc: xilinx: Add support of multiple callbacks for same event in event management driver As per the current implementation of only single callback data gets saved per event, driver is throwing an error if try to register multiple callback for same event. Add support of multiple callbacks data for same event. So agent can register for same event with multiple callbacks. Here event management driver will store the callbacks as list in Hash table entry for that event. Here each callback data contain 2 element as callback handler and private data of agent driver. Signed-off-by: Abhyuday Godhasara Link: https://lore.kernel.org/r/20220427074803.19009-2-abhyuday.godhasara@xilinx.com Signed-off-by: Greg Kroah-Hartman commit c5c07c5958cf0c9af6e76813e6de15d42ee49822 Author: Srinivas Kandagatla Date: Wed May 18 16:23:53 2022 +0100 misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl This is another instance of incorrect use of list iterator and checking it for NULL. The list iterator value 'map' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty (in this case, the check 'if (!map) {' will always be false and never exit as expected). To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'map' as a dedicated pointer to point to the found element. Without this patch, Kernel crashes with below trace: Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000ffff7fb03750 ... Call trace: fastrpc_map_create+0x70/0x290 [fastrpc] fastrpc_req_mem_map+0xf0/0x2dc [fastrpc] fastrpc_device_ioctl+0x138/0xc60 [fastrpc] __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xd4/0xfc do_el0_svc+0x28/0x90 el0_svc+0x3c/0x130 el0t_64_sync_handler+0xa4/0x130 el0t_64_sync+0x18c/0x190 Code: 14000016 f94000a5 eb05029f 54000260 (b94018a6) ---[ end trace 0000000000000000 ]--- Fixes: 5c1b97c7d7b7 ("misc: fastrpc: add support for FASTRPC_IOCTL_MEM_MAP/UNMAP") Cc: stable@vger.kernel.org Reported-by: Jan Jablonsky Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220518152353.13058-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 8e04a7afce3d796c0c25219e30e16543e3fde2d2 Author: Shuah Khan Date: Tue May 17 14:36:30 2022 -0600 misc: alcor_pci: set NULL intfdata and clear pci master alcor_pci doesn't set driver data to NULL and clear pci master when probe fails. Doesn't clear pci master from remove interface. Clearing pci master is necessary to disable bus mastering and prevent DMAs after driver removal. Fix alcor_pci_probe() to set driver data to NULL and clear pci master from its error path. Fix alcor_pci_remove() to clear pci master. Signed-off-by: Shuah Khan Link: https://lore.kernel.org/r/20220517203630.45232-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 5621a0bcb4b4dffc87d74330a9a31b868572f763 Author: Yang Yingliang Date: Wed May 11 14:46:22 2022 +0800 edd: simplify the check of 'attr->test' in edd_populate_dir() attr->test check is not needed when !attr->test is false. Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220511064622.3399164-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit c337125b8834f9719dfda0e40b25eaa266f1b8cf Author: Tony Lindgren Date: Thu May 12 08:30:21 2022 +0300 bus: ti-sysc: Fix warnings for unbind for serial We can get "failed to disable" clock_unprepare warnings on unbind at least for the serial console device if the unbind is done before the device has been idled. As some devices are using deferred idle, we must check the status for pending idle work to idle the device. Fixes: 76f0f772e469 ("bus: ti-sysc: Improve handling for no-reset-on-init and no-idle-on-init") Cc: Romain Naour Reviewed-by: Romain Naour Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220512053021.61650-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 660ba678f9998aca6db74f2dd912fa5124f0fa31 Author: Miaoqian Lin Date: Wed May 11 11:14:19 2022 +0400 firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add() If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix this issue by calling kobject_put(). Fixes: 948af1f0bbc8 ("firmware: Basic dmi-sysfs support") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220511071421.9769-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 077f5d900f62a817b155e614e7eb79220b1405de Author: Yang Yingliang Date: Wed May 11 14:45:06 2022 +0800 drivers: dio: add missing iounmap() in dio_init() If kzalloc() fails, iounmap() need be called in error path. Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220511064506.3398512-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 106101303eda8f93c65158e5d72b2cc6088ed034 Author: Zheng Bin Date: Wed May 11 11:29:37 2022 +0800 accessiblity: speakup: Add missing misc_deregister in softsynth_probe softsynth_probe misses a call misc_deregister() in an error path, this patch fixes that. Signed-off-by: Zheng Bin Link: https://lore.kernel.org/r/20220511032937.2736738-1-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 8cc6b422fc4b32a91810e16548353fc3eba39b13 Author: Yang Li Date: Tue May 10 10:52:05 2022 +0100 slimbus: qcom: Remove unnecessary print function dev_err() The print function dev_err() is redundant because platform_get_irq_byname() already prints an error. Eliminate the follow coccicheck warning: ./drivers/slimbus/qcom-ctrl.c:514:2-9: line 514 is redundant because platform_get_irq() already prints an error Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220510095205.337-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 225baab0aeb6e999754a2d43e9c2b954ec9a75ab Author: Miaoqian Lin Date: Tue May 10 10:52:04 2022 +0100 slimbus: qcom: Fix IRQ check in qcom_slim_probe platform_get_irq() returns non-zero IRQ number on success, negative error number on failure. And the doc of platform_get_irq() provides a usage example: int irq = platform_get_irq(pdev, 0); if (irq < 0) return irq; Fix the check of return value to catch errors correctly. Fixes: ad7fcbc308b0 ("slimbus: qcom: Add Qualcomm Slimbus controller driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220510095205.337-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 80ad54a63af3a3e2eb701fbf30242a922c4fac47 Author: Guo Zhengkui Date: Fri May 13 15:16:06 2022 +0800 drivers: comedi: replace ternary operator with min() Fix the following coccicheck warning: drivers/comedi/drivers.c:857:12-13: WARNING opportunity for min(). min() macro is defined in include/linux/minmax.h. It avoids multiple evaluations of the arguments when non-constant and performs strict type-checking. Reviewed-by: Ian Abbott Signed-off-by: Guo Zhengkui Link: https://lore.kernel.org/r/20220513071608.49047-1-guozhengkui@vivo.com Signed-off-by: Greg Kroah-Hartman commit 7394d2ebb651a9f62e08c6ab864aac015d27c64d Author: Cristian Ciocaltea Date: Tue May 17 02:46:46 2022 +0300 scripts/tags.sh: Invoke 'realpath' via 'xargs' When COMPILED_SOURCE is set, running make ARCH=x86_64 COMPILED_SOURCE=1 cscope tags could throw the following errors: scripts/tags.sh: line 98: /usr/bin/realpath: Argument list too long cscope: no source files found scripts/tags.sh: line 98: /usr/bin/realpath: Argument list too long ctags: No files specified. Try "ctags --help". This is most likely to happen when the kernel is configured to build a large number of modules, which has the consequence of passing too many arguments when calling 'realpath' in 'all_compiled_sources()'. Let's improve this by invoking 'realpath' through 'xargs', which takes care of properly limiting the argument list. Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20220516234646.531208-1-cristian.ciocaltea@collabora.com Signed-off-by: Greg Kroah-Hartman commit 53c83d6d8e399fad3d3d25df0ea0d54eb0f94f88 Author: Jason A. Donenfeld Date: Wed May 18 15:23:45 2022 +0200 siphash: add SPDX tags as sole licensing authority The text "dual BSD/GPLv2 license" is somewhat ambiguous, and moving this over to SPDX is overdue. This commit adds SPDX tags to the relevant files and clarifies that it's GPLv2 only and 3-clause BSD. It also removes the old text, so that the SPDX tags are the only source of the information. Suggested-by: Thomas Gleixner Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman commit e6af1bb07704b53bad7771db1b05ee17abad11cb Author: Zhang Jianhua Date: Thu May 19 10:24:50 2022 +0800 fs-verity: Use struct_size() helper in enable_verity() Follow the best practice for allocating a variable-sized structure. Signed-off-by: Zhang Jianhua [ebiggers: adjusted commit message] Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20220519022450.2434483-1-chris.zjh@huawei.com commit 7eb6369d7acfe87df73848b3757c648e8f352b86 Merge: 93c0651617a62 9be8459298ead Author: Palmer Dabbelt Date: Thu May 19 09:51:59 2022 -0700 RISC-V: Add support for rv32 userspace via COMPAT The RISC-V port supports the rv32i and rv64i base ISAs, but provides no mechanism to run 32-bit userspace on 64-bit systems. This adds that support, via the COMPAT framework. As the RISC-V ISAs (and uABIs) were developed concurrently, the resulting compat support is mostly generic. This includes a handful of cleanups to the generic compat infrastructure to more cleanly support RISC-V, followed by the RISC-V implementation. * palmer/riscv-compat: riscv: compat: Add COMPAT Kbuild skeletal support riscv: compat: ptrace: Add compat_arch_ptrace implement riscv: compat: signal: Add rt_frame implementation riscv: compat: vdso: Add setup additional pages implementation riscv: compat: vdso: Add COMPAT_VDSO base code implementation riscv: compat: Add hw capability check for elf riscv: compat: Add elf.h implementation riscv: compat: process: Add UXL_32 support in start_thread riscv: compat: syscall: Add entry.S implementation riscv: compat: syscall: Add compat_sys_call_table implementation riscv: compat: Support TASK_SIZE for compat mode riscv: compat: Add basic compat data type implementation riscv: Fixup difference with defconfig syscalls: compat: Fix the missing part for __SYSCALL_COMPAT asm-generic: compat: Cleanup duplicate definitions fs: stat: compat: Add __ARCH_WANT_COMPAT_STAT arch: Add SYSVIPC_COMPAT for all architectures compat: consolidate the compat_flock{,64} definition uapi: always define F_GETLK64/F_SETLK64/F_SETLKW64 in fcntl.h uapi: simplify __ARCH_FLOCK{,64}_PAD a little commit aed86f8add0e3f63a033861f247c9ae956b72c92 Author: Schspa Shi Date: Wed May 18 09:17:54 2022 +0800 binder: fix atomic sleep when get extended error binder_inner_proc_lock(thread->proc) is a spin lock, copy_to_user can't be called with in this lock. Copy it as a local variable to fix it. Fixes: bd32889e841c ("binder: add BINDER_GET_EXTENDED_ERROR ioctl") Reported-by: syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com Reviewed-by: Carlos Llamas Signed-off-by: Schspa Shi Link: https://lore.kernel.org/r/20220518011754.49348-1-schspa@gmail.com Signed-off-by: Greg Kroah-Hartman commit dafa5e9ab8b5b31d64c0ded188d95f8bb6be9746 Author: Carlos Llamas Date: Tue May 17 18:58:17 2022 +0000 binder: fix potential UAF of target_{proc,thread} Commit 9474be34a727 ("binder: add failed transaction logging info") dereferences target_{proc,thread} after they have been potentially freed by binder_proc_dec_tmpref() and binder_thread_dec_tmpref(). This patch delays the release of the two references after their last usage. Fixes the following two errors reported by smatch: drivers/android/binder.c:3562 binder_transaction() error: dereferencing freed memory 'target_proc' drivers/android/binder.c:3563 binder_transaction() error: dereferencing freed memory 'target_thread' Fixes: 9474be34a727 ("binder: add failed transaction logging info") Reported-by: Dan Carpenter Acked-by: Todd Kjos Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20220517185817.598872-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit da4864962d768b33e3bc31cd233270af6226686d Author: Carlos Llamas Date: Mon May 9 23:19:01 2022 +0000 binder: fix printk format for commands Make sure we use unsigned format specifier %u for binder commands as most of them are encoded above INT_MAX. This prevents negative values when logging them as in the following case: [ 211.895781] binder: 8668:8668 BR_REPLY 258949 0:0, cmd -2143260157 size 0-0 ptr 0000006e766a8000-0000006e766a8000 Acked-by: Todd Kjos Acked-by: Christian Brauner (Microsoft) Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20220509231901.3852573-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 25e02ba60f0fbe65ba07553b5b2b8867726273c4 Author: Ilpo Järvinen Date: Tue Apr 26 17:49:33 2022 +0300 tty: Rework receive flow control char logic Add a helper to check if the character is a flow control one. This rework prepares for adding lookahead done check cleanly to n_tty_receive_char_flow_ctrl() between n_tty_is_char_flow_ctrl() and the actions taken on the flow control characters. No functional changes intended. Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220426144935.54893-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ef44c6c1e86fa89f20d27713d7268d7c7689af5c Author: Ilpo Järvinen Date: Thu May 19 11:18:08 2022 +0300 pcmcia: synclink_cs: Don't allow CS5-6 Only CS7 and CS8 seem supported but CSIZE was not sanitized in termios c_cflag. The driver sets 7 bits whenever data_bits is not 8 so default to CS7 when CSIZE is not CS8. Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-10-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1deeda8d2877c18bc2b9eeee10dd6d2628852848 Author: Ilpo Järvinen Date: Thu May 19 11:18:07 2022 +0300 serial: stm32-usart: Correct CSIZE, bits, and parity Add CSIZE sanitization for unsupported CSIZE configurations. In addition, if parity is asked for but CSx was unsupported, the sensible result is CS8+parity which requires setting USART_CR1_M0 like with 9 bits. Incorrect CSIZE results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: c8a9d043947b (serial: stm32: fix word length configuration) Cc: Erwan Le Ray Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-9-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 52bb1cb7118564166b04d52387bd8403632f5190 Author: Ilpo Järvinen Date: Thu May 19 11:18:06 2022 +0300 serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 Only CS7 and CS8 seem supported but CSIZE is not sanitized from CS5 or CS6 to CS8. In addition, ASC_CTL_MODE_7BIT_PAR suggests that CS7 has to have parity, thus add PARENB. Incorrect CSIZE results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: c4b058560762 (serial:st-asc: Add ST ASC driver.) Cc: Srinivas Kandagatla Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-8-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c069d2756c01ed36121fae6a42c14fdf1325c71d Author: Ilpo Järvinen Date: Thu May 19 11:18:05 2022 +0300 serial: sifive: Sanitize CSIZE and c_iflag Only CS8 is supported but CSIZE was not sanitized to CS8. Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Similarly, INPCK, PARMRK, and BRKINT are reported textually unsupported but were not cleared in termios c_iflag which is the machine-readable format. Fixes: 45c054d0815b (tty: serial: add driver for the SiFive UART) Cc: Paul Walmsley Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-7-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9b87162de8be26bf3156460b37deee6399fd0fcb Author: Ilpo Järvinen Date: Thu May 19 11:18:04 2022 +0300 serial: sh-sci: Don't allow CS5-6 Only CS7 and CS8 seem supported but CSIZE is not sanitized from CS5 or CS6 to CS8. Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2) Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-6-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 79ac88655dc0551e3571ad16bdabdbe65d61553e Author: Ilpo Järvinen Date: Thu May 19 11:18:03 2022 +0300 serial: txx9: Don't allow CS5-6 Only CS7 and CS8 are supported but CSIZE is not sanitized with CS5 or CS6 to CS8. Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2) Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-5-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 098333a9c7d12bb3ce44c82f08b4d810c44d31b0 Author: Ilpo Järvinen Date: Thu May 19 11:18:02 2022 +0300 serial: rda-uart: Don't allow CS5-6 Only CS7 and CS8 are supported but CSIZE is not sanitized after fallthrough from CS5 or CS6 to CS7. Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: c10b13325ced (tty: serial: Add RDA8810PL UART driver) Cc: Manivannan Sadhasivam Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit fd63031b8c0763addcecdefe0e0c59d49646204e Author: Ilpo Järvinen Date: Thu May 19 11:18:01 2022 +0300 serial: digicolor-usart: Don't allow CS5-6 Only CS7 and CS8 seem supported but CSIZE is not sanitized to CS8 in the default: block. Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout(). Fixes: 5930cb3511df (serial: driver for Conexant Digicolor USART) Acked-by: Baruch Siach Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3f7fed405c118607d4d42255f2572072db728399 Author: Ilpo Järvinen Date: Thu May 19 11:18:00 2022 +0300 serial: uartlite: Fix BRKINT clearing BRKINT is within c_iflag rather than c_cflag. Fixes: ea017f5853e9 (tty: serial: uartlite: Prevent changing fixed parameters) Reviewed-by: Sean Anderson Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220519081808.3776-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0258502f11a4f6036b5f8b34b09027c8a92def3a Author: YueHaibing Date: Wed May 18 21:54:52 2022 +0800 serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE drivers/tty/serial/cpm_uart/cpm_uart_core.c: In function ‘cpm_uart_init_port’: drivers/tty/serial/cpm_uart/cpm_uart_core.c:1251:7: error: ‘udbg_port’ undeclared (first use in this function); did you mean ‘uart_port’? if (!udbg_port) ^~~~~~~~~ uart_port commit d142585bceb3 leave this corner, wrap it with #ifdef block Fixes: d142585bceb3 ("serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20220518135452.39480-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman commit c9d2325cdb92fd4a6362ea792d93571195741675 Author: Vijaya Krishna Nivarthi Date: Mon May 16 14:50:10 2022 +0530 serial: core: Do stop_rx in suspend path for console if console_suspend is disabled For the case of console_suspend disabled, if back to back suspend/resume test is executed, at the end of test, sometimes console would appear to be frozen not responding to input. This would happen because, during resume, rx transactions can come in before system is ready, malfunction of rx happens in turn resulting in console appearing to be stuck. Do a stop_rx in suspend sequence to prevent this. Signed-off-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/1652692810-31148-1-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Greg Kroah-Hartman commit c2194bc999d41eff69301ee723b0c2979b6eb7bd Author: Vijaya Krishna Nivarthi Date: Mon May 16 16:08:30 2022 +0530 tty: serial: qcom-geni-serial: Remove uart frequency table. Instead, find suitable frequency with call to clk_round_rate. Replace the UART frequency table 'root_freq[]' with logic around clk_round_rate() so that SoC details like the available clk frequencies can change and this driver still works. This reduces tight coupling between this UART driver and the SoC clk driver because we no longer have to update the 'root_freq[]' array for new SoCs. Instead the driver determines the available frequencies at runtime. Signed-off-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/1652697510-30543-1-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 4ed26f87c71f97d6551caeb2e9e533f8980e764e Author: Phil Edworthy Date: Thu May 12 08:26:49 2022 +0100 dt-bindings: serial: renesas,em-uart: Add RZ/V2M clock to access the registers The RZ/V2M SoC has an additional clock to access the registers. The HW manual says this clock should not be touched as it is used by the "ISP Firmware". Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring Signed-off-by: Phil Edworthy Link: https://lore.kernel.org/r/20220512072649.7879-1-phil.edworthy@renesas.com Signed-off-by: Greg Kroah-Hartman commit af0179270977508df6986b51242825d7edd59caf Author: Ilpo Järvinen Date: Fri May 13 16:46:43 2022 +0300 serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 SER_RS485_RTS_ON_SEND and SER_RS485_RTS_AFTER_SEND relate to behavior within RS485 operation. The driver checks if they have the same value which is not possible to realize with the hardware. The check is taken regardless of SER_RS485_ENABLED flag and -EINVAL is returned when the check fails, which creates problems. This check makes it unnecessarily complicated to turn RS485 mode off as simple zeroed serial_rs485 struct will trigger that equal values check. In addition, the driver itself memsets its rs485 structure to zero when RS485 is disabled but if userspace would try to make an TIOCSRS485 ioctl() call with the very same struct, it would end up failing with -EINVAL which doesn't make much sense. Resolve the problem by moving the check inside SER_RS485_ENABLED block. Fixes: 7ecc77011c6f ("serial: 8250_fintek: Return -EINVAL on invalid configuration") Cc: Ricardo Ribalda Delgado Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/035c738-8ea5-8b17-b1d7-84a7b3aeaa51@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f0136f65285bcfb7e8f90d1013723076a35acd51 Author: AngeloGioacchino Del Regno Date: Tue May 10 14:26:20 2022 +0200 Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" It was found that some MediaTek SoCs are incompatible with this change. Also, this register was mistakenly understood as it was related to the 16550A register layout selection but, at least on some IPs, if not all, it's related to something else unknown. This reverts commit 6f81fdded0d024c7d4084d434764f30bca1cd6b1. Signed-off-by: AngeloGioacchino Del Regno Fixes: 6f81fdded0d0 ("serial: 8250_mtk: Make sure to select the right FEATURE_SEL") Reported-by: "kernelci.org bot" Link: https://lore.kernel.org/r/20220510122620.150342-1-angelogioacchino.delregno@collabora.com Signed-off-by: Greg Kroah-Hartman commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 Author: John Ogness Date: Fri May 6 23:39:24 2022 +0206 serial: msm_serial: disable interrupts in __msm_console_write() __msm_console_write() assumes that interrupts are disabled, but with threaded console printers it is possible that the write() callback of the console is called with interrupts enabled. Explicitly disable interrupts using local_irq_save() to preserve the assumed context. Reported-by: Marek Szyprowski Reviewed-by: Petr Mladek Signed-off-by: John Ogness Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 589f892ac8ef244e47c5a00ffd8605daa1eaef8e Author: John Ogness Date: Sun May 8 12:41:47 2022 +0206 serial: meson: acquire port->lock in startup() The uart_ops startup() callback is called without interrupts disabled and without port->lock locked, relatively late during the boot process (from the call path of console_on_rootfs()). If the device is a console, it was already previously registered and could be actively printing messages. Since the startup() callback is reading/writing registers used by the console write() callback (AML_UART_CONTROL), its access must be synchronized using the port->lock. Currently it is not. The startup() callback is the only function that explicitly enables interrupts. Without the synchronization, it is possible that interrupts become accidentally permanently disabled. CPU0 CPU1 meson_serial_console_write meson_uart_startup -------------------------- ------------------ spin_lock(port->lock) val = readl(AML_UART_CONTROL) uart_console_write() writel(INT_EN, AML_UART_CONTROL) writel(val, AML_UART_CONTROL) spin_unlock(port->lock) Add port->lock synchronization to meson_uart_startup() to avoid racing with meson_serial_console_write(). Also add detailed comments to meson_uart_reset() explaining why it is *not* using port->lock synchronization. Link: https://lore.kernel.org/lkml/2a82eae7-a256-f70c-fd82-4e510750906e@samsung.com Fixes: ff7693d079e5 ("ARM: meson: serial: add MesonX SoC on-chip uart driver") Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Reviewed-by: Petr Mladek Reviewed-by: Jiri Slaby Acked-by: Neil Armstrong Signed-off-by: John Ogness Link: https://lore.kernel.org/r/20220508103547.626355-1-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 57f83e5dd6a33c4696699954784f8fee789b1d0c Author: Andy Shevchenko Date: Mon May 9 20:21:29 2022 +0300 serial: 8250_dw: Use dev_err_probe() Simplify the error path in ->probe() a bit by using dev_err_probe(). Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220509172129.37770-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 295b09128d12fb1a7a67f771cc0ae0df869eafaf Author: Andy Shevchenko Date: Mon May 9 20:21:28 2022 +0300 serial: 8250_dw: Use devm_add_action_or_reset() Slightly simplify ->probe() and drop a few goto labels by using devm_add_action_or_reset() for clock and reset cleanup. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220509172129.37770-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4088ca3edca80c19cd190fba75af7e7a3194adcf Author: Andy Shevchenko Date: Mon May 9 19:19:11 2022 +0300 serial: 8250_dw: Update the list of OF headers used by driver The of_irq.h and of_platform.h are not used by the driver. On the other hand, the mod_devicetable.h missed. Drop the former two and add the latter one. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220509161911.37164-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2da6f1e5f72a3ea8a5aed85a8473a710d2e41ffb Author: Ilpo Järvinen Date: Fri May 13 11:29:06 2022 +0300 serial: jsm: Use B0 instead of 0 Use B0 to check zero baudrate rather than literal 0. While at it, remove extra parenthesis around CBAUD. Reviewed-by: Johan Hovold Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220513082906.11096-6-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 503f418b10040b9b1044734b21ab2a3bea810aad Author: Ilpo Järvinen Date: Fri May 13 11:29:05 2022 +0300 serial: fsl_lpuart: Remove unnecessary clearing for CRTSCTS if (termios->c_cflag & CRTSCTS) guarantees that CRTSCTS is not ever set in the else block so clearing it is unnecessary. While at it, remove also one pair of extra parenthesis. Reviewed-by: Johan Hovold Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220513082906.11096-5-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9cca25e2762f0436834695225a38bc90ae3ebdfc Author: Ilpo Järvinen Date: Fri May 13 11:29:04 2022 +0300 tty: remove IBSHIFT ifdefs IBSHIFT is defined by all architectures since commit d0ffb805b729 ("arch/alpha, termios: implement BOTHER, IBSHIFT and termios2"). Reviewed-by: Johan Hovold Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220513082906.11096-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 69648d7bda8636088db8bce742c1bb1c99a11cdd Author: Ilpo Järvinen Date: Fri May 13 11:29:03 2022 +0300 tty: remove BOTHER ifdefs BOTHER is defined by all architectures since commit d0ffb805b729 ("arch/alpha, termios: implement BOTHER, IBSHIFT and termios2"). Reviewed-by: Johan Hovold Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220513082906.11096-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9fafe733514b7c3eb51e46d8f494d32cbeb0924b Author: Ilpo Järvinen Date: Fri May 13 11:29:02 2022 +0300 tty: remove CMSPAR ifdefs CMSPAR is defined by all architectures since commit 6bf08cb246b5 ("[PATCH] Add CMSPAR to termbits.h for powerpc and alpha"). Reviewed-by: Johan Hovold Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220513082906.11096-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2059b698a2efcce3c67b0e61eab7d7680bbe10bd Author: Chuck Lever Date: Tue May 10 11:45:53 2022 -0400 SUNRPC: Simplify synopsis of svc_pool_for_cpu() Clean up: There is one caller. The @cpu argument can be made implicit now that a get_cpu/put_cpu pair is no longer needed. Signed-off-by: Chuck Lever commit 586095d339b1b46f4283863e6e8e15de662a3f93 Author: Sebastian Andrzej Siewior Date: Tue May 10 16:38:33 2022 +0200 SUNRPC: Don't disable preemption while calling svc_pool_for_cpu(). svc_xprt_enqueue() disables preemption via get_cpu() and then asks for a pool of a specific CPU (current) via svc_pool_for_cpu(). While preemption is disabled, svc_xprt_enqueue() acquires svc_pool::sp_lock with bottom-halfs disabled, which can sleep on PREEMPT_RT. Disabling preemption is not required here. The pool is protected with a lock so the following list access is safe even cross-CPU. The following iteration through svc_pool::sp_all_threads is under RCU-readlock and remaining operations within the loop are atomic and do not rely on disabled-preemption. Use raw_smp_processor_id() as the argument for the requested CPU in svc_pool_for_cpu(). Reported-by: Mike Galbraith Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Chuck Lever commit e9488d5ae13c0a72223c507e2508dc2ac66cad4f Author: Dai Ngo Date: Mon May 2 14:19:27 2022 -0700 NFSD: Show state of courtesy client in client info Update client_info_show to show state of courtesy client and seconds since last renew. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 27431affb0dbc259ac6ffe6071243a576c8f38f1 Author: Dai Ngo Date: Mon May 2 14:19:26 2022 -0700 NFSD: add support for lock conflict to courteous server This patch allows expired client with lock state to be in COURTESY state. Lock conflict with COURTESY client is resolved by the fs/lock code using the lm_lock_expirable and lm_expire_lock callback in the struct lock_manager_operations. If conflict client is in COURTESY state, set it to EXPIRABLE and schedule the laundromat to run immediately to expire the client. The callback lm_expire_lock waits for the laundromat to flush its work queue before returning to caller. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 2443da2259e97688f93d64d17ab69b15f466078a Author: Dai Ngo Date: Mon May 2 14:19:25 2022 -0700 fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict Add 2 new callbacks, lm_lock_expirable and lm_expire_lock, to lock_manager_operations to allow the lock manager to take appropriate action to resolve the lock conflict if possible. A new field, lm_mod_owner, is also added to lock_manager_operations. The lm_mod_owner is used by the fs/lock code to make sure the lock manager module such as nfsd, is not freed while lock conflict is being resolved. lm_lock_expirable checks and returns true to indicate that the lock conflict can be resolved else return false. This callback must be called with the flc_lock held so it can not block. lm_expire_lock is called to resolve the lock conflict if the returned value from lm_lock_expirable is true. This callback is called without the flc_lock held since it's allowed to block. Upon returning from this callback, the lock conflict should be resolved and the caller is expected to restart the conflict check from the beginnning of the list. Lock manager, such as NFSv4 courteous server, uses this callback to resolve conflict by destroying lock owner, or the NFSv4 courtesy client (client that has expired but allowed to maintains its states) that owns the lock. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 591502c5cb325b1c6ec59ab161927d606b918aa0 Author: Dai Ngo Date: Mon May 2 14:19:24 2022 -0700 fs/lock: add helper locks_owner_has_blockers to check for blockers Add helper locks_owner_has_blockers to check if there is any blockers for a given lockowner. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit d76cc46b37e123e8d245cc3490978dbda56f979d Author: Dai Ngo Date: Mon May 2 14:19:23 2022 -0700 NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd This patch moves create/destroy of laundry_wq from nfs4_state_start and nfs4_state_shutdown_net to init_nfsd and exit_nfsd to prevent the laundromat from being freed while a thread is processing a conflicting lock. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 3d69427151806656abf129342028f3f4e5e1fee0 Author: Dai Ngo Date: Mon May 2 14:19:22 2022 -0700 NFSD: add support for share reservation conflict to courteous server This patch allows expired client with open state to be in COURTESY state. Share/access conflict with COURTESY client is resolved by setting COURTESY client to EXPIRABLE state, schedule laundromat to run and returning nfserr_jukebox to the request client. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 66af25799940b26efd41ea6e648f75c41a48a2c2 Author: Dai Ngo Date: Mon May 2 14:19:21 2022 -0700 NFSD: add courteous server support for thread with only delegation This patch provides courteous server support for delegation only. Only expired client with delegation but no conflict and no open or lock state is allowed to be in COURTESY state. Delegation conflict with COURTESY/EXPIRABLE client is resolved by setting it to EXPIRABLE, queue work for the laundromat and return delay to the caller. Conflict is resolved when the laudromat runs and expires the EXIRABLE client while the NFS client retries the OPEN request. Local thread request that gets conflict is doing the retry in _break_lease. Client in COURTESY or EXPIRABLE state is allowed to reconnect and continues to have access to its state. Access to the nfs4_client by the reconnecting thread and the laundromat is serialized via the client_lock. Reviewed-by: J. Bruce Fields Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 983084b2672c593959e3148d6a17c8b920797dde Author: Chuck Lever Date: Wed Apr 6 14:38:59 2022 -0400 SUNRPC: Remove svc_rqst::rq_xprt_hlen Clean up: This field is now always set to zero. Signed-off-by: Chuck Lever commit 4af8b42e5629b97bdde287d5d6c250535d324676 Author: Chuck Lever Date: Sun Apr 3 12:25:55 2022 -0400 SUNRPC: Remove dead code in svc_tcp_release_rqst() Clean up: svc_tcp_sendto() always sets rq_xprt_ctxt to NULL. Signed-off-by: Chuck Lever commit 0b6c14bdd908879078ec85d65cfb78472a97e4e7 Author: Chuck Lever Date: Fri Apr 1 13:10:31 2022 -0400 SUNRPC: Make cache_req::thread_wait an unsigned long The second parameter of wait_for_completion_interruptible_timeout() is a jiffies value whose type is "unsigned long". Avoid an unnecessary and potentially fraught implicit type conversion at the wait_for_completion_interruptible_timeout() call site in cache_wait_req(). Signed-off-by: Chuck Lever commit 37324e6bb120bc3cb7cbaa87512ff3a93dbcf5c4 Author: Chuck Lever Date: Thu Mar 31 15:30:10 2022 -0400 SUNRPC: Cache deferral injection Cache deferral injection stress-tests the cache deferral logic as well as upper layer protocol deferred request handlers. This facility is for developers and professional testers to ensure coverage of the rqst deferral code paths. To date, we haven't had an adequate way to ensure these code paths are covered during testing, short of temporary code changes to force their use. A file called /sys/kernel/debug/fail_sunrpc/ignore-cache-wait enables administrators to disable cache deferral injection while allowing other types of sunrpc errors to be injected. The default setting is that cache deferral injection is enabled (ignore=false). To enable support for cache deferral injection, CONFIG_FAULT_INJECTION, CONFIG_FAULT_INJECTION_DEBUG_FS, and CONFIG_SUNRPC_DEBUG must all be set to "Y". Signed-off-by: Chuck Lever commit 45cb7955c180a2a34d291e68938250c4f9bd294f Author: Chuck Lever Date: Thu Apr 14 15:50:12 2022 -0400 SUNRPC: Clean up svc_deferred_class trace events Replace the temporary fix from commit 4d5004451ab2 ("SUNRPC: Fix the svc_deferred_event trace class") with the use of __sockaddr and friends, which is the preferred solution (but only available in 5.18 and newer). Signed-off-by: Chuck Lever commit 91e23b1c39820bfed642119ff6b6ef9f43cf09ce Author: Chuck Lever Date: Thu Apr 7 16:48:24 2022 -0400 NFSD: Clean up nfsd_splice_actor() nfsd_splice_actor() checks that the page being spliced does not match the previous element in the svc_rqst::rq_pages array. We believe this is to prevent a double put_page() in cases where the READ payload is partially contained in the xdr_buf's head buffer. However, the NFSD READ proc functions no longer place any part of the READ payload in the head buffer, in order to properly support NFS/RDMA READ with Write chunks. Therefore, simplify the logic in nfsd_splice_actor() to remove this unnecessary check. Signed-off-by: Chuck Lever commit 44e0b165b6c078b84767da4ba06ffa27af562c96 Author: Ilpo Järvinen Date: Mon May 9 12:34:46 2022 +0300 termbits.h: Remove posix_types.h include Nothing in termbits seems to require anything from linux/posix_types.h. Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220509093446.6677-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c9b34088e80efe30459517fa3834cf78532c9a02 Author: Ilpo Järvinen Date: Mon May 9 12:34:45 2022 +0300 termbits.h: Align lines & format - Align c_cc defines. - Remove extra newlines. - Realign & adjust number of leading zeros. - Reorder c_cflag defines to ascending order - Make comment ending shorted (=remove period and one extra space from the comments in mips). Co-developed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220509093446.6677-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0b46ac44f2673be2ee51bb52149cab3546ff1696 Author: Ilpo Järvinen Date: Mon May 9 12:34:44 2022 +0300 termbits.h: create termbits-common.h for identical bits Some defines are the same across all archs. Move the most obvious intersection to termbits-common.h. Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220509093446.6677-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 135c579d77d066aece83609329150b87fe81e454 Author: Hector Martin Date: Mon May 2 18:25:05 2022 +0900 tty: serial: samsung_tty: Fix suspend/resume on S5L We were restoring the IRQ masks then clearing them again, because ucon_mask wasn't set properly. Adding that makes suspend/resume work as intended. Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20220502092505.30934-1-marcan@marcan.st Signed-off-by: Greg Kroah-Hartman commit 91ca09ca7f310aaefb2d56d57421e02cc44a7eb4 Author: Maciej W. Rozycki Date: Fri May 13 23:42:13 2022 +0100 Documentation: Wire Oxford Semiconductor PCIe (Tornado) 950 Wire Oxford Semiconductor PCIe (Tornado) 950 description as a chapter into the misc-devices document. Signed-off-by: Maciej W. Rozycki Link: https://lore.kernel.org/r/alpine.DEB.2.21.2205131727070.10656@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 421bdf5385dc551f2b35d17db3cfc150550d5434 Author: Maciej W. Rozycki Date: Fri May 13 23:42:08 2022 +0100 Documentation: Reformat Oxford Semiconductor PCIe (Tornado) 950 Reformat Oxford Semiconductor PCIe (Tornado) 950 description in terms of reStructuredText markup, fixing warnings with `make htmldocs'. While at it remove typos: s/the the/the/ and s/the/then/ in lines changed anyway. Signed-off-by: Maciej W. Rozycki Link: https://lore.kernel.org/r/alpine.DEB.2.21.2205131721110.10656@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 7b0364eacb8f5177b6747a1c524b4bfd04011a2a Author: Maciej W. Rozycki Date: Fri May 13 23:42:03 2022 +0100 Documentation: Move Oxford Semiconductor PCIe (Tornado) 950 to misc-devices Documentation/tty has been moved to driver-api, which is not suitable for user documentation, so move the Oxford Semiconductor PCIe (Tornado) 950 description to misc-devices instead. Signed-off-by: Maciej W. Rozycki Link: https://lore.kernel.org/r/alpine.DEB.2.21.2205131823430.10656@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit b693a8a6160f8c2237b593020ed2f70c011ebd38 Author: Jiri Slaby Date: Thu May 19 09:56:53 2022 +0200 serial: pmac_zilog: remove initial print Don't report about the driver when loaded. It's unneeded and frowned upon nowadays. Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Reviewed-by: Ilpo Järvinen Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220519075653.31356-4-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit c83a34a5304a295795e049c1729a1ee86f33d648 Author: Jiri Slaby Date: Thu May 19 09:56:52 2022 +0200 serial: pmac_zilog: remove tracing prints Remove debug printouts upon function enter/exit. This can be achieved better by tracing. Remove also the one protected by DEBUG_HARD which is not defined anyway. Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220519075653.31356-3-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit ae1de09341d9becf0e68d3dcd0710f2cac4a5d01 Author: Jiri Slaby Date: Thu May 19 09:56:51 2022 +0200 serial: pmac_zilog: remove unused uart_pmac_port::termios_cache struct uart_pmac_port contains termios_cache. It is only written and never read. Remove it as it only occupies space. Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220519075653.31356-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit a5ddc498e792df250346caf3081f6f12fcb7086c Author: Jiri Slaby Date: Thu May 19 09:56:50 2022 +0200 serial: pmac_zilog: remove unfinished DBDMA support The support for DBDMA was never completed. Remove the the code that only maps spaces without real work. Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220519075653.31356-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 9bb13b2f77819d868902753fc73f6a03200fad80 Author: Jiri Slaby Date: Thu May 19 09:57:20 2022 +0200 serial: amba-pl011: move header content to .c There is no point keeping the header content separated. In this case, it is only an enum. So move the enum to the appropriate source file. Cc: Russell King Reviewed-by: Ilpo Järvinen Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220519075720.31402-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 925ea0fa5277c1e6bb9e51955ef34eea9736c3d7 Author: Tony Lindgren Date: Thu May 12 16:15:06 2022 +0300 tty: n_gsm: Fix packet data hex dump output The module param debug for n_gsm uses KERN_INFO level, but the hexdump now uses KERN_DEBUG level. This started after commit 091cb0994edd ("lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds"). We now use dynamic_hex_dump() unless DEBUG is set. This causes no packets to be seen with modprobe n_gsm debug=0x1f unlike earlier. Let's fix this by adding gsm_hex_dump_bytes() that calls print_hex_dump() with KERN_INFO to match what n_gsm is doing with the other debug related output. Fixes: 091cb0994edd ("lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds") Cc: Stephen Boyd Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220512131506.1216-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 859bdc359567f5fa8e8dc780d7b5e53ea43d9ce9 Author: Mayank Rana Date: Wed May 18 11:12:52 2022 -0700 usb: dwc3: core: Add error log when core soft reset failed DWC3 controller soft reset is important operation for USB functionality. In case when it fails, currently there is no failure log. Hence add error log when core soft reset failed. Signed-off-by: Mayank Rana Link: https://lore.kernel.org/r/1652897572-14461-1-git-send-email-quic_mrana@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 3c5880745b4439ac64eccdb040e37fc1cc4c5406 Author: Albert Wang Date: Wed May 18 14:13:15 2022 +0800 usb: dwc3: gadget: Move null pinter check to proper place When dwc3_gadget_ep_cleanup_completed_requests() called to dwc3_gadget_giveback() where the dwc3 lock is released, other thread is able to execute. In this situation, usb_ep_disable() gets the chance to clear endpoint descriptor pointer which leds to the null pointer dereference problem. So needs to move the null pointer check to a proper place. Example call stack: Thread#1: dwc3_thread_interrupt() spin_lock -> dwc3_process_event_buf() -> dwc3_process_event_entry() -> dwc3_endpoint_interrupt() -> dwc3_gadget_endpoint_trbs_complete() -> dwc3_gadget_ep_cleanup_completed_requests() ... -> dwc3_giveback() spin_unlock Thread#2 executes Thread#2: configfs_composite_disconnect() -> __composite_disconnect() -> ffs_func_disable() -> ffs_func_set_alt() -> ffs_func_eps_disable() -> usb_ep_disable() wait for dwc3 spin_lock Thread#1 released lock clear endpoint.desc Fixes: 26288448120b ("usb: dwc3: gadget: Fix null pointer exception") Cc: stable Signed-off-by: Albert Wang Link: https://lore.kernel.org/r/20220518061315.3359198-1-albertccwang@google.com Signed-off-by: Greg Kroah-Hartman commit 6c5ba7395b1badce5e0b8e597907751e952646cb Author: Bhuvanesh Surachari Date: Thu May 12 17:37:14 2022 +0200 usb: hub: Simplify error and success path in port_over_current_notify kasprintf() returns NULL or valid pointer. Since kfree() can handle NULL pointer condition, simplify error and success paths in function port_over_current_notify() by removing multiple error path labels. Signed-off-by: Bhuvanesh Surachari Signed-off-by: Eugeniu Rosca Link: https://lore.kernel.org/r/1652369834-4480-1-git-send-email-erosca@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman commit dce49449e04ff150838a31386ee65917beb9ebb5 Author: Frank Li Date: Mon May 9 11:40:55 2022 -0500 usb: cdns3: allocate TX FIFO size according to composite EP number Some devices have USB compositions which may require multiple endpoints. To get better performance, need bigger CDNS3_EP_BUF_SIZE. But bigger CDNS3_EP_BUF_SIZE may exceed total hardware FIFO size when multiple endpoints. By introducing the check_config() callback, calculate CDNS3_EP_BUF_SIZE. Move CDNS3_EP_BUF_SIZE into cnds3_device: ep_buf_size Combine CDNS3_EP_ISO_SS_BURST and CDNS3_EP_ISO_HS_MULT into cnds3_device:ep_iso_burst Using a simple algorithm to calculate ep_buf_size. ep_buf_size = ep_iso_burst = (onchip_buffers - 2k) / (number of IN EP + 1). Test at 8qxp: Gadget ep_buf_size RNDIS: 5 RNDIS+ACM: 3 Mass Storage + NCM + ACM 2 Previous CDNS3_EP_BUF_SIZE is 4, RNDIS + ACM will be failure because exceed FIFO memory. Acked-by: Peter Chen Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20220509164055.1815081-1-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9d778f0c5f95ca5aa2ff628ea281978697e8d89b Author: Mayank Rana Date: Wed May 4 12:36:41 2022 -0700 usb: dwc3: Fix ep0 handling when getting reset while doing control transfer According to the databook ep0 should be in setup phase during reset. If host issues reset between control transfers, ep0 will be in an invalid state. Fix this by issuing stall and restart on ep0 if it is not in setup phase. Also SW needs to complete pending control transfer and setup core for next setup stage as per data book. Hence check ep0 state during reset interrupt handling and make sure active transfers on ep0 out/in endpoint are stopped by queuing ENDXFER command for that endpoint and restart ep0 out again to receive next setup packet. Signed-off-by: Mayank Rana Link: https://lore.kernel.org/r/1651693001-29891-1-git-send-email-quic_mrana@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 69a1c9a9b273271f2a2674bcc117336a9bb0a4b4 Author: Dmitry Torokhov Date: Wed May 18 15:02:51 2022 -0700 usb: Probe EHCI, OHCI controllers asynchronously initcall_debug shows that OHCI controllers take ~60ms to probe on Rockchip RK3399 systems: probe of fe3a0000.usb returned 1 after 58941 usecs A few of these can add up to waste non-trivial amounts of time at boot. These host controllers don't provide resources to other drivers, so this shouldn't contribute to exposing race conditions. Chrome OS kernels have carried this patch on some systems for a while without issues. Similar patches have been merged for a variety of (e)MMC host controllers for similar reasons. [Brian: rewrote commit message, refreshed, but retained dtor's original authorship ] Acked-by: Alan Stern Signed-off-by: Dmitry Torokhov Signed-off-by: Brian Norris Link: https://lore.kernel.org/r/20220518150150.1.Ie8ea0e945a9c15066237014be219eed60066d493@changeid Signed-off-by: Greg Kroah-Hartman commit 26ae2c942b5702f2e43d36b2a4389cfb7d616b6a Author: Linus Walleij Date: Mon May 16 11:14:24 2022 +0200 usb: isp1760: Fix out-of-bounds array access Running the driver through kasan gives an interesting splat: BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0x70c Read of size 20 at addr f1db2e64 by task swapper/0/1 (...) isp1760_register from isp1760_plat_probe+0x1d8/0x220 (...) This happens because the loop reading the regmap fields for the different ISP1760 variants look like this: for (i = 0; i < HC_FIELD_MAX; i++) { ... } Meaning it expects the arrays to be at least HC_FIELD_MAX - 1 long. However the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[], isp1763_hc_volatile_ranges[] and isp1763_dc_volatile_ranges[] are dynamically sized during compilation. Fix this by putting an empty assignment to the [HC_FIELD_MAX] and [DC_FIELD_MAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HC_FIELD_MAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on. Fixes: 1da9e1c06873 ("usb: isp1760: move to regmap for register access") Cc: stable@vger.kernel.org Cc: Rui Miguel Silva Cc: Dietmar Eggemann Reviewed-by: Rui Miguel Silva Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220516091424.391209-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit 1bd8bb7d2dfc44509acf729e636523c3c2b729df Author: Mathias Nyman Date: Mon May 16 12:48:50 2022 +0300 xhci: Don't defer primary roothub registration if there is only one roothub The support for xHCI controllers with only one roothub, and the code to defer primary roothub registation until second roothub got merged to usb-next for 5.19 at the same time. commit 873f323618c2 ("xhci: prepare for operation w/o shared hcd") commit b7a4f9b5d0e4 ("xhci: Set HCD flag to defer primary roothub registration") These got merged in such a way that the flag to defer primary roothub registration is set even for xHC controllers with just one roothub. Fix this by setting the defer flag in a codepath taken only if we have two roothubs Fixes: 873f323618c2 ("xhci: prepare for operation w/o shared hcd") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220516094850.19788-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 834650b50ed283d9d34a32b425d668256bf2e487 Merge: 70a1b25326dd7 d16495a982324 Author: Alexei Starovoitov Date: Thu May 19 09:03:31 2022 -0700 Merge branch 'Start libbpf 1.0 dev cycle' Andrii Nakryiko says: ==================== Start preparations for libbpf 1.0 release and as a first test remove bpf_create_map*() APIs. ==================== Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit d16495a982324f75e8e65de01475f9533de1db7a Author: Andrii Nakryiko Date: Wed May 18 11:59:15 2022 -0700 libbpf: remove bpf_create_map*() APIs To test API removal, get rid of bpf_create_map*() APIs. Perf defines __weak implementation of bpf_map_create() that redirects to old bpf_create_map() and that seems to compile and run fine. Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20220518185915.3529475-4-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit e2371b1632b1c61c1fa726a17b82e6833a9e4d85 Author: Andrii Nakryiko Date: Wed May 18 11:59:14 2022 -0700 libbpf: start 1.0 development cycle Start libbpf 1.0 development cycle by adding LIBBPF_1.0.0 section to libbpf.map file and marking all current symbols as local. As we remove all the deprecated APIs we'll populate global list before the final 1.0 release. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20220518185915.3529475-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 056431ae4d790efd0372c1daf93569fdd2814190 Author: Andrii Nakryiko Date: Wed May 18 11:59:13 2022 -0700 libbpf: fix up global symbol counting logic Add the same negative ABS filter that we use in VERSIONED_SYM_COUNT to filter out ABS symbols like LIBBPF_0.8.0. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20220518185915.3529475-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 376d6b02cb08021c0d3679bb53a6d6bf0dac181c Merge: 74f55a62c4c35 c7c99a09ef0e2 Author: Greg Kroah-Hartman Date: Thu May 19 18:00:01 2022 +0200 Merge tag 'thunderbolt-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v5.19 merge window This includes following Thunderbolt/USB4 changes for the v5.19 merge window: * Improvements for Thunderbolt 1 DisplayPort tunneling * Link USB4 ports to their USB Type-C connectors * Lane bonding support for host-to-host (XDomain) connections * Buffer allocation improvement for devices with no DisplayPort adapters * Few cleanups and minor fixes. All these have been in linux-next with no reported issues except that there is a minor merge conflict with the kunit-next tree because one of the commits touches the driver KUnit tests. * tag 'thunderbolt-for-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Add KUnit test for devices with no DisplayPort adapters thunderbolt: Fix buffer allocation of devices with no DisplayPort adapters thunderbolt: Add support for XDomain lane bonding thunderbolt: Ignore port locked error in tb_port_wait_for_link_width() thunderbolt: Split setting link width and lane bonding into own functions thunderbolt: Move tb_port_state() prototype to correct place thunderbolt: Add debug logging when lane is enabled/disabled thunderbolt: Link USB4 ports to their USB Type-C connectors misc/mei: Add NULL check to component match callback functions thunderbolt: Use different lane for second DisplayPort tunnel thunderbolt: Dump path config space entries during discovery thunderbolt: Use decimal number with port numbers thunderbolt: Fix typo in comment thunderbolt: Replace usage of found with dedicated list iterator variable commit d80c69846ddfddf437167b31ab4cd0de12f61001 Author: Paulo Alcantara Date: Thu May 19 12:18:37 2022 -0300 cifs: fix signed integer overflow when fl_end is OFFSET_MAX This fixes the following when running xfstests generic/504: [ 134.394698] CIFS: Attempting to mount \\win16.vm.test\Share [ 134.420905] CIFS: VFS: generate_smb3signingkey: dumping generated AES session keys [ 134.420911] CIFS: VFS: Session Id 05 00 00 00 00 c4 00 00 [ 134.420914] CIFS: VFS: Cipher type 1 [ 134.420917] CIFS: VFS: Session Key ea 0b d9 22 2e af 01 69 30 1b 15 74 bf 87 41 11 [ 134.420920] CIFS: VFS: Signing Key 59 28 43 5c f0 b6 b1 6f f5 7b 65 f2 9f 9e 58 7d [ 134.420923] CIFS: VFS: ServerIn Key eb aa 58 c8 95 01 9a f7 91 98 e4 fa bc d8 74 f1 [ 134.420926] CIFS: VFS: ServerOut Key 08 5b 21 e5 2e 4e 86 f6 05 c2 58 e0 af 53 83 e7 [ 134.771946] ================================================================================ [ 134.771953] UBSAN: signed-integer-overflow in fs/cifs/file.c:1706:19 [ 134.771957] 9223372036854775807 + 1 cannot be represented in type 'long long int' [ 134.771960] CPU: 4 PID: 2773 Comm: flock Not tainted 5.11.22 #1 [ 134.771964] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 134.771966] Call Trace: [ 134.771970] dump_stack+0x8d/0xb5 [ 134.771981] ubsan_epilogue+0x5/0x50 [ 134.771988] handle_overflow+0xa3/0xb0 [ 134.771997] ? lockdep_hardirqs_on_prepare+0xe8/0x1b0 [ 134.772006] cifs_setlk+0x63c/0x680 [cifs] [ 134.772085] ? _get_xid+0x5f/0xa0 [cifs] [ 134.772085] cifs_flock+0x131/0x400 [cifs] [ 134.772085] __x64_sys_flock+0xfc/0x120 [ 134.772085] do_syscall_64+0x33/0x40 [ 134.772085] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 134.772085] RIP: 0033:0x7fea4f83b3fb [ 134.772085] Code: ff 48 8b 15 8f 1a 0d 00 f7 d8 64 89 02 b8 ff ff ff ff eb da e8 16 0b 02 00 66 0f 1f 44 00 00 f3 0f 1e fa b8 49 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 1a 0d 00 f7 d8 64 89 01 48 Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit fcfbc93cc33ec601f00f113eca6fc484b930532d Author: Dan Williams Date: Wed May 18 16:35:17 2022 -0700 cxl/port: Reuse 'struct cxl_hdm' context for hdm init The port driver maps component registers for port operations. Reuse that mapping for HDM Decoder Capability setup / enable. Move devm_cxl_setup_hdm() before cxl_hdm_decode_init() and plumb @cxlhdm through the hdm init helpers. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291691712.1426646.14336397551571515480.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 5e5f4ad52f33c125af9b91d4c3b7cad59c13772e Author: Dan Williams Date: Wed May 18 16:35:11 2022 -0700 cxl/port: Move endpoint HDM Decoder Capability init to port driver The responsibility for establishing HDM Decoder Capability based operation is more closely tied to port enabling than memdev enabling which is concerned with port enumeration. This later enables reusing @cxlhdm for probing / controlling "global enable" for the HDM Decoder Capability. For now, just do the nominal move. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291691167.1426646.7936109077255288258.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 92804edb11f065aadb3a4f398bed8a846a035cd3 Author: Dan Williams Date: Wed May 18 16:35:06 2022 -0700 cxl/pci: Drop @info argument to cxl_hdm_decode_init() Now that nothing external to cxl_hdm_decode_init() considers 'struct cxl_endpoint_dvec_info' move it internal to cxl_hdm_decode_init(). Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291690612.1426646.7866084245521113414.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit a12562bb70776093b270f79a4b6ef18f4bcead2b Author: Dan Williams Date: Wed May 18 16:35:00 2022 -0700 cxl/mem: Merge cxl_dvsec_ranges() and cxl_hdm_decode_init() In preparation for changing how the driver handles 'mem_enable' in the CXL DVSEC control register. Merge the contents of cxl_hdm_decode_init() into cxl_dvsec_ranges() and rename the combined function cxl_hdm_decode_init(). The possible cleanups and fixes that result from this merge are saved for a follow-on change. Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165291690027.1426646.10249756632415633752.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit dd2d42ad6f422076d1bd49b132bec74376c26f5c Author: Dan Williams Date: Wed May 18 16:34:54 2022 -0700 cxl/mem: Skip range enumeration if mem_enable clear When a device does not have mem_enable set then the current range settings are moot. Skip the enumeration and cause cxl_hdm_decode_init() to proceed directly to enable the HDM Decoder Capability. Fixes: 560f78559006 ("cxl/pci: Retrieve CXL DVSEC memory info") Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291689442.1426646.18012291761753694336.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 14d78874077442d1d0f08129f5a0ea5070984b4b Author: Dan Williams Date: Wed May 18 16:34:48 2022 -0700 cxl/mem: Consolidate CXL DVSEC Range enumeration in the core In preparation for fixing the setting of the 'mem_enabled' bit in CXL DVSEC Control register, move all CXL DVSEC range enumeration into the same source file. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291688886.1426646.15046138604010482084.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 2e4ba0ec978335b4b550bbed95cb198ac3a00745 Author: Dan Williams Date: Wed May 18 16:34:43 2022 -0700 cxl/pci: Move cxl_await_media_ready() to the core Allow cxl_await_media_ready() to be mocked for testing purposes rather than carrying the maintenance burden of an indirect function call in the mainline driver. With the move cxl_await_media_ready() can no longer reuse the mailbox timeout override, so add a media_ready_timeout module parameter to the core to backfill. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291688340.1426646.4755627801983775011.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 75b7ae29991f945b69c10d75b861d7d5e90bd541 Author: Dan Williams Date: Wed May 18 16:34:37 2022 -0700 cxl/mem: Validate port connectivity before dvsec ranges In preparation for validating DVSEC ranges against the platform declared CXL memory ranges (ACPI CFMWS) move port enumeration before the endpoint's decoder validation. Ultimately this logic will move to the port driver, but create a bisect point before that larger move. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291687749.1426646.18091538443879226995.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 76a4121e86649bf381aa32cb69ede913def57202 Author: Dan Williams Date: Wed May 18 16:34:31 2022 -0700 cxl/mem: Fix cxl_mem_probe() error exit The addition of cxl_mem_active() broke error exit scenarios for cxl_mem_probe(). Return early rather than proceed with disabling suspend, and update the label name since it is no longer a terminal "out" label that exits the function. Fixes: 9ea4dcf49878 ("PM: CXL: Disable suspend") Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291687176.1426646.15449254938752532784.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 194d5edadf0b403f6de2be89c484a01c83ee269f Author: Dan Williams Date: Wed May 18 16:34:26 2022 -0700 cxl/pci: Drop wait_for_valid() from cxl_await_media_ready() A check mem_info_valid already happens in __cxl_dvsec_ranges(). Rely on that instead of calling wait_for_valid again. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291686632.1426646.7479581732894574486.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 1e14c9fbb55fbc48eb88b55d1736c994b1deb631 Author: Dan Williams Date: Wed May 18 16:34:20 2022 -0700 cxl/pci: Consolidate wait_for_media() and wait_for_media_ready() Now that wait_for_media() does nothing supplemental to wait_for_media_ready() just promote wait_for_media_ready() to a common helper and drop wait_for_media(). Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291686046.1426646.4390664747934592185.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 2bcf3bbd348fc10260aa6243ff6a22a1882b5b35 Author: Dan Williams Date: Wed May 18 16:34:15 2022 -0700 cxl/mem: Drop mem_enabled check from wait_for_media() Media ready is asserted by the device independent of whether mem_enabled was ever set. Drop this check to allow for dropping wait_for_media() in favor of ->wait_media_ready(). Fixes: 8dd2bc0f8e02 ("cxl/mem: Add the cxl_mem driver") Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165291685501.1426646.10372821863672431074.stgit@dwillia2-xfh Signed-off-by: Dan Williams commit 80b949f332e331b67c3ae4f323daf2cb91e743e5 Author: ChiYuan Huang Date: Thu May 19 10:13:38 2022 +0800 ASoC: rt9120: Use pm_runtime and regcache to optimize 'pwdnn' logic From the datasheet, the only way to meet the lowest power consumption is to pull low the 'pwdnn' gpio. But if it is low, IC will keep in reset state, all registers reset to default. And the power consumption is listed below 1. amp off and 'pwdnn' high => idle state, PVDD = 1mA, DVDD = 7mA 2. amp off and 'pwdnn' low => shutdown state, PVDD < 20uA, DVDD < 15uA It's the large difference for the consumption current This fix is to use pm_runtime and regcache to handle 'pwdnn' gpio control. Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/1652926418-8519-3-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown commit 57f68f2168988e574133fb5abcd73949bf1d1df2 Author: ChiYuan Huang Date: Thu May 19 10:13:37 2022 +0800 ASoC: rt9120: Fix 3byte read, valule offset typo For RG 3byte read, the value order is offset [0], [1], and [2]. Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/1652926418-8519-2-git-send-email-u0084500@gmail.com Signed-off-by: Mark Brown commit 17572892e3beefe68d0875ecfd015eef521c244d Author: V sujith kumar Reddy Date: Mon May 16 21:36:10 2022 +0530 ASoC: amd: acp: Set Speaker enable/disable pin through rt1019 codec driver. RT1019 codec has two ways of controlling the en_spkr. one way is controlling through gpio pin method the another way is through codec register update through driver. Now Speaker enable/disable is controlled through codec register updated by codec driver. This patch reverts gpio logic. This reverts commit 5c5f08f7fc0bee9a1bc3fbdcb7a21cfd0648ab14 ("ASoC: amd: acp: Power on/off the speaker enable gpio pin based on DAPM callback.") Signed-off-by: V sujith kumar Reddy Link: https://lore.kernel.org/r/20220516160619.17832-2-Vsujithkumar.Reddy@amd.com Signed-off-by: Mark Brown commit 4d0cc9e0e53e9946d7b8dc58279c62dfa7a2191b Author: Dan Carpenter Date: Thu May 19 08:17:20 2022 +0300 staging: r8188eu: delete rtw_wx_read/write32() These debugging tools let you call: status = usb_control_msg_recv/send(udev, 0, REALTEK_USB_VENQT_CMD_REQ, REALTEK_USB_VENQT_READ/WRITE, value, REALTEK_USB_VENQT_CMD_IDX, io_buf, size, RTW_USB_CONTROL_MSG_TIMEOUT, GFP_KERNEL); with a user controlled "value" in the 0-0xffff range. It's not a valid API. Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YoXS4OaD1oauPvmj@kili Signed-off-by: Greg Kroah-Hartman commit 464725a95d8a1cc4bb8d28e2d55f2af3ff3368d5 Author: Soumya Negi Date: Thu May 19 02:50:11 2022 -0700 staging: r8188eu: Remove multiple assignments Conform to Linux coding style. Issue found by checkpatch:- CHECK: multiple assignments should be avoided Signed-off-by: Soumya Negi Link: https://lore.kernel.org/r/20220519095012.5619-1-soumya.negi97@gmail.com Signed-off-by: Greg Kroah-Hartman commit f94b47c6bde624d6c07f43054087607c52054a95 Author: Jiasheng Jiang Date: Wed May 18 15:59:57 2022 +0800 staging: r8188eu: add check for kzalloc As kzalloc() may return null pointer, it should be better to check the return value and return error if fails in order to avoid dereference of null pointer. Moreover, the return value of rtw_alloc_hwxmits() should also be dealt with. Fixes: 15865124feed ("staging: r8188eu: introduce new core dir for RTL8188eu driver") Reviewed-by: Dan Carpenter Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20220518075957.514603-1-jiasheng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 6107fb660749507d5e02988151e45884b5423cdc Author: V sujith kumar Reddy Date: Mon May 16 21:36:09 2022 +0530 ASoC: amd: acp: Set Speaker enable/disable pin through rt1019 codec driver RT1019 codec has two ways of controlling the en_spkr. one way is controlling through gpio pin method the another way is through codec register update through driver. Now Speaker enable/disable is controlled through codec register updated by codec driver. This patch reverts gpio logic. This reverts commit 7fa5c33d043160eba3be9fb8e21588dff2a467c7 ("ASoC: amd: acp: Set gpio_spkr_en to None for max speaker amplifer in machine driver"). Signed-off-by: V sujith kumar Reddy Link: https://lore.kernel.org/r/20220516160619.17832-1-Vsujithkumar.Reddy@amd.com Signed-off-by: Mark Brown commit 455d5f02dc23f4e7a298b1f4acb5dc5457e08801 Author: Vihas Makwana Date: Tue May 17 19:36:26 2022 +0530 staging: r8188eu: fix warnings in rtw_wlan_util Refactor the code to fix following warnings: WARNING: Comparisons should place the constant on the right side of the test CHECK: Comparison to NULL could be written "p" Signed-off-by: Vihas Makwana Link: https://lore.kernel.org/r/20220517140626.3716-4-makvihas@gmail.com Signed-off-by: Greg Kroah-Hartman commit 43ea9201795fb47dd48beaf64b3184bdfd481260 Author: Vihas Makwana Date: Tue May 17 19:36:25 2022 +0530 staging: r8188eu: fix warnings in rtw_pwrctrl Refactor the code to fix following warnings: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by: Vihas Makwana Link: https://lore.kernel.org/r/20220517140626.3716-3-makvihas@gmail.com Signed-off-by: Greg Kroah-Hartman commit 801626f71d6f822e0becbfaa8b26a41addea693a Author: Vihas Makwana Date: Tue May 17 19:36:24 2022 +0530 staging: r8188eu: fix warnings in rtw_p2p Refactor the code to fix following warning: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by: Vihas Makwana Link: https://lore.kernel.org/r/20220517140626.3716-2-makvihas@gmail.com Signed-off-by: Greg Kroah-Hartman commit be2af740e2a9c7134f2d8ab4f104006e110b13de Author: Yang Yingliang Date: Sat May 14 17:10:53 2022 +0800 ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() Fix the missing clk_disable_unprepare() before return from wm2000_anc_transition() in the error handling case. Fixes: 514cfd6dd725 ("ASoC: wm2000: Integrate with clock API") Signed-off-by: Yang Yingliang Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220514091053.686416-1-yangyingliang@huawei.com Signed-off-by: Mark Brown commit 81e7b165c45e94188ae8f1134b57f27d1f35452f Author: YueHaibing Date: Mon May 16 20:09:09 2022 +0800 ASoC: codecs: lpass: Fix passing zero to 'PTR_ERR' sound/soc/codecs/lpass-macro-common.c:28 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' sound/soc/codecs/lpass-macro-common.c:38 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' sound/soc/codecs/lpass-macro-common.c:54 lpass_macro_pds_init() warn: passing zero to 'ERR_PTR' dev_pm_domain_attach_by_name() may return NULL, set 'ret' as -ENODATA to fix this warning. Fixes: 1a8ee4cf8418 ("ASoC: codecs: Fix error handling in power domain init and exit handlers") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20220516120909.36356-1-yuehaibing@huawei.com Signed-off-by: Mark Brown commit b1378b259c0c0300cf62dd7117bf550edce0f9cc Author: Pierre-Louis Bossart Date: Tue May 17 12:37:15 2022 -0500 ASoC: SOF: sof-client-ipc-flood-test: use pm_runtime_resume_and_get() Use pm_runtime_resume_and_get() to replace the pm_runtime_get_sync() and pm_runtime_put_noidle() pattern. No functional changes. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220517173715.468894-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 0f653c95c4f4b6b623ce8bd995002daf8032bfc3 Author: Wan Jiabing Date: Wed May 18 20:58:57 2022 +0800 ASoC: SOF: mediatek: remove duplicate include in mt8195.c Fix following checkincludes.pl warning: sound/soc/sof/mediatek/mt8195/mt8195.c: linux/of_platform.h is included more than once. Signed-off-by: Wan Jiabing Link: https://lore.kernel.org/r/20220518125902.13407-1-wanjiabing@vivo.com Signed-off-by: Mark Brown commit 3a054f90e95500387cc871f5a04ad91def1664ed Author: YC Hung Date: Tue May 17 12:31:09 2022 -0500 ASoC: SOF: mediatek: Add mt8195 debug dump Add mt8195_adsp_dump in mt8195.c for debug_dump callback to dump mt8195 debug registers and call mtk_adsp_dump. Reviewed-by: Ranjani Sridharan Signed-off-by: YC Hung Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220517173109.468568-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 Author: Wang Cheng Date: Mon May 16 17:22:41 2022 +0800 staging: rtl8712: fix uninit-value in r871xu_drv_init() When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, 'mac[6]' will not be initialized. BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable mac created at: r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 Reported-by: Tested-by: Reviewed-by: Dan Carpenter Signed-off-by: Wang Cheng Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com Signed-off-by: Greg Kroah-Hartman commit 698c1e99a0a3b883a629159ae47fa41778209258 Author: YC Hung Date: Tue May 17 12:31:08 2022 -0500 ASoC: SOF: mediatek: Add mediatek common debug dump 1.Add mtk-adsp-common.c file for mediatek platforms common usage. 2.Add mtk_adsp_dump implementation in mtk-adsp-common.c for general debug dump. Reviewed-by: Ranjani Sridharan Signed-off-by: YC Hung Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220517173109.468568-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 Author: Wang Cheng Date: Mon May 16 17:22:23 2022 +0800 staging: rtl8712: fix uninit-value in usb_read8() and friends When r8712_usbctrl_vendorreq() returns negative, 'data' in usb_read{8,16,32} will not be initialized. BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline] BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725 string_nocheck lib/vsprintf.c:643 [inline] string+0x4ec/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 va_format lib/vsprintf.c:1704 [inline] pointer+0x18e6/0x1f70 lib/vsprintf.c:2443 vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604 dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615 __dev_printk+0x3be/0x440 drivers/base/core.c:4627 _dev_info+0x1ea/0x22f drivers/base/core.c:4673 r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5363 [inline] hub_port_connect_change drivers/usb/core/hub.c:5507 [inline] port_event drivers/usb/core/hub.c:5665 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289 worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436 kthread+0x3c7/0x500 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Local variable data created at: usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33 r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 Reported-by: Tested-by: Reviewed-by: Dan Carpenter Signed-off-by: Wang Cheng Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com Signed-off-by: Greg Kroah-Hartman commit 644ee3bff4ae56db4c4c92b4331f7f4ea4b2147e Author: Wang Cheng Date: Mon May 16 17:23:05 2022 +0800 staging: rtl8712: add error handler in r8712_usbctrl_vendorreq() When 'status' returned from usb_control_msg() is not equal to 'len', that usb_control_msg() is on partial failure, r8712_usbctrl_vendorreq() will treat partial reads as success. Reviewed-by: Dan Carpenter Signed-off-by: Wang Cheng Link: https://lore.kernel.org/r/e33ea53d36c422fbe7eabec5bd9eecb0ebce1bc5.1652618244.git.wanngchenng@gmail.com Signed-off-by: Greg Kroah-Hartman commit b390c25c6757b9d56cecdfbf6d55f15fc89a6386 Author: Pierre-Louis Bossart Date: Tue May 17 12:26:47 2022 -0500 ASoC: rt1015p: remove dependency on GPIOLIB commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a series of unnecessary dependencies on GPIOLIB when the gpio was optional. A similar simplification seems valid for rt1015p, so remove the dependency as well. This will avoid the following warning WARNING: unmet direct dependencies detected for SND_SOC_RT1015P Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] Selected by [y]: - SND_SOC_INTEL_SOF_RT5682_MACH [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C [=y] && ACPI [=y] && (SND_HDA_CODEC_HDMI [=y] && SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || COMPILE_TEST [=y]) || SND_SOC_SOF_BAYTRAIL [=n] && (X86_INTEL_LPSS [=n] || COMPILE_TEST [=y])) Reported-by: kernel test robot Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220517172647.468244-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 Author: Pierre-Louis Bossart Date: Tue May 17 12:26:46 2022 -0500 ASoC: max98357a: remove dependency on GPIOLIB commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a series of unnecessary dependencies on GPIOLIB when the gpio was optional. A similar simplification seems valid for max98357a, so remove the dependency as well. This will avoid the following warning WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] Selected by [y]: - SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C [=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] && SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || COMPILE_TEST [=n]) Reported-by: kernel test robot Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20220517172647.468244-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 0683532999ab3890f44f832cd47feee9e2374c22 Author: Peter Ujfalusi Date: Mon May 16 13:47:11 2022 +0300 ASoC: SOF: ipc3-dtrace: Move dtrace related variables local from sof_dev The variables and structs for DMA trace can be moved local to ipc3-dtrace.c and the storage can be allocated dynamically, stored behind the fw_trace_data pointer. Signed-off-by: Peter Ujfalusi Reviewed-by: Paul Olaru Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220516104711.26115-9-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 08341b27bd2ee3c79265ef7925b3bc68a1790ab9 Author: Peter Ujfalusi Date: Mon May 16 13:47:10 2022 +0300 ASoC: SOF: Introduce opaque storage of private data for firmware tracing Firmware tracing implementations can allocate and store their privately used data behind the fw_trace_pdata pointer instead of adding more members to struct snd_sof_dev. Signed-off-by: Peter Ujfalusi Reviewed-by: Paul Olaru Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220516104711.26115-8-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 4b49cbd1e7ebe4b000a7eedc4f910488da62c055 Author: Peter Ujfalusi Date: Mon May 16 13:47:09 2022 +0300 ASoC: SOF: Modify the host trace_init parameter list to include dmab Stop host code (AMD, Intel) to access sdev->dmatb directly. Modify the trace_init prototype to include the pointer to a struct snd_dma_buffer. The ipc3-dtrace passes for now the pointer to sdev->dmatb, but the aim is to move all tracing related runtime information local to a trace implementation. Signed-off-by: Peter Ujfalusi Reviewed-by: Paul Olaru Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220516104711.26115-7-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b69979a1ec2d9347a43bf0ebdad2c1eb23447ca6 Author: Peter Ujfalusi Date: Mon May 16 13:47:08 2022 +0300 ASoC: SOF: ipc3-dtrace: Move host ops wrappers from generic header to private Move the snd_sof_dma_trace_* ops wrappers from ops.h to ipc3-priv.h since they are not used outside of IPC3 code. While moving, rename them to sof_dtrace_host_* Signed-off-by: Peter Ujfalusi Reviewed-by: Paul Olaru Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20220516104711.26115-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1dedbe4f223cac603e871d91133b9aa3136fbc21 Author: Peter Ujfalusi Date: Mon May 16 13:47:07 2022 +0300 ASoC: SOF: Switch to IPC generic firmware tracing Introduce new, generic API for firmware tracing with sof_fw_trace_ prefix and switch to use it. At the same time the old IPC3 code can be dropped from trace.c, which is now a generic wrapper for the firmware tracing ops. Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220516104711.26115-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 671e0b90051ec19e83c12501905734fb808b944e Author: Peter Ujfalusi Date: Mon May 16 13:47:06 2022 +0300 ASoC: SOF: Clone the trace code to ipc3-dtrace as fw_tracing implementation The existing trace.c file is implementing the IPC3 dma-trace support. Clone the existing code with prefix fixes as ipc3 fw_tracing implementation to be used when the core is converted to use generic ops for firmware tracing. Drop the dual licensing of the content as the implementation is based on debugfs. Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220516104711.26115-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 25b17da691f3c1a7cc433f864fd4845998a5a37a Author: Peter Ujfalusi Date: Mon May 16 13:47:05 2022 +0300 ASoC: SOF: Rename dtrace_is_supported flag to fw_trace_is_supported Rename the internal flag to not limit it's use for dma-trace, but to be used for generic firmware tracing functionality. Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220516104711.26115-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 0cfbaee21fcbf131f02c475dbc15f8a18ee621bc Author: Peter Ujfalusi Date: Mon May 16 13:47:04 2022 +0300 ASoC: SOF: Introduce IPC independent ops for firmware tracing support The current (dma-)trace is only supported with IPC3, it is not available when IPC4 is used. Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220516104711.26115-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ea32366a8fc98cbabaf8ef1b9cc7618498cb34d4 Author: Phillip Potter Date: Mon May 16 23:46:40 2022 +0100 staging: r8188eu: remove _drv_ defines from include/rtw_debug.h Remove the following defines: _drv_always_ _drv_emerg_ _drv_alert_ _drv_crit_ _drv_err_ _drv_warning_ _drv_notice_ _drv_info_ _drv_debug_ from include/rtw_debug.h, as they are no longer used anywhere in the driver, and are unlikely to be ever again with the removal of the old debugging/logging code. Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220516224640.90973-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 63ab906069cd417791f4e15c5eea63699a31b4e3 Author: Gaston Gonzalez Date: Mon May 16 19:17:41 2022 -0300 staging: vc04_services: remove unused macro BITSET_CLR is not used. Remove the define. Signed-off-by: Gaston Gonzalez Link: https://lore.kernel.org/r/20220516221741.1015814-1-gascoar@gmail.com Signed-off-by: Greg Kroah-Hartman commit 902d75058129aa33c899e08c97d4f5cda8d047eb Author: Haowen Bai Date: Mon May 16 18:22:12 2022 +0800 staging: rtl8192u: remove null check after call container_of() container_of() will never return NULL, so remove useless code. Signed-off-by: Haowen Bai Link: https://lore.kernel.org/r/1652696533-18011-1-git-send-email-baihaowen@meizu.com Signed-off-by: Greg Kroah-Hartman commit 37a3929feba82d71f3d3519fb57c25bef8ed281a Author: Haowen Bai Date: Mon May 16 18:20:03 2022 +0800 staging: rtl8192e: remove null check after call container_of() container_of() will never return NULL, so remove useless code. Signed-off-by: Haowen Bai Link: https://lore.kernel.org/r/1652696403-17852-1-git-send-email-baihaowen@meizu.com Signed-off-by: Greg Kroah-Hartman commit 3baab4bc2f5a1eb083a4c4d25d393a4fec87fd48 Author: Haowen Bai Date: Mon May 16 18:18:41 2022 +0800 staging: ks7010: remove null check after call container_of() container_of() will never return NULL, so remove useless code. Signed-off-by: Haowen Bai Link: https://lore.kernel.org/r/1652696322-17685-1-git-send-email-baihaowen@meizu.com Signed-off-by: Greg Kroah-Hartman commit 14afedb488c61fecf5118030dcdd0a1eaeeca3a7 Author: Michael Straube Date: Mon May 16 07:48:30 2022 +0200 staging: r8188eu: remove HW_VAR_AC_PARAM_BE from SetHwReg8188EU() Remove the HW_VAR_AC_PARAM_BE case from SetHwReg8188EU() and move the functionality to the place where SetHwReg8188EU() is called. This is part of the ongoing effort to get rid of the unwanted hal layer. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220516054830.8702-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 381b6d7b9c26a1e5f01ef53e236f8768834c1ada Author: Martin Kaiser Date: Sun May 15 17:54:01 2022 +0200 staging: r8188eu: assoc_rsp and assoc_rsp_len are not used The assoc_rsp buffer in struct mlme_priv is not used. There's no need to store an incoming association response after receiving an processing it. Remove the buffer pointer and its length from struct mlme_priv. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515155401.352742-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit c8bff2118e68d630e11479481078894b0fde0b34 Author: Martin Kaiser Date: Sun May 15 17:54:00 2022 +0200 staging: r8188eu: last_rx_mgnt_pkts is set but not used last_rx_mgnt_pkts in struct stainfo_stats is set but not used. Remove it. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515155401.352742-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 4f44756e4fe03aa28894c243548955d2a3420942 Author: Martin Kaiser Date: Sun May 15 17:53:59 2022 +0200 staging: r8188eu: simplify error handling in recv_func_prehandle Simplify the error handling in recv_func_prehandle. There's no need to goto exit, this would be the next statement anyway. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515155401.352742-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 619916037480b1f40c9a1a0456c2f960f9686128 Author: Martin Kaiser Date: Sun May 15 17:53:58 2022 +0200 staging: r8188eu: remove obsolete comments Remove some comments in HalPwrSeqCmd.c that contain no useful information. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515155401.352742-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit c7711f1fa7edb59f52fdf478b7f714ebc6315a80 Author: Martin Kaiser Date: Sun May 15 17:53:57 2022 +0200 staging: r8188eu: use ieee80211 helper to check for beacon Use the ieee80211_is_beacon helper to check if the incoming frame is a beacon frame. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515155401.352742-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 3194f684aca1a9da04614472bdfbdfe9ac0c831f Author: Martin Kaiser Date: Sun May 15 17:27:59 2022 +0200 staging: r8188eu: use defines for addba response status Replace the numeric values with defines from ieee80211.h. Suggested-by: Joe Perches Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220515152759.335889-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit fed6328357225837cba278162f1b0f48ad30f9e0 Author: Martin Kaiser Date: Sat May 14 18:47:40 2022 +0200 staging: r8188eu: use the tid in delba processing Extract the tid from the delba frame regardless of the recipient/initiator setting. Use the extracted tid when we process the delba frame. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-8-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 32668668126f516665b08f9d453482c614723436 Author: Martin Kaiser Date: Sat May 14 18:47:39 2022 +0200 staging: r8188eu: check for initiator vs recipient For an incoming delba message, the code checks if the delba was sent by the data initiator or by the data recipient. Rewrite this check using the ieee80211 helpers, making the code easier to understand. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-7-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 813586def1590e714af9eb3712fb61b2642eb981 Author: Martin Kaiser Date: Sat May 14 18:47:38 2022 +0200 staging: r8188eu: use BIT(tid) instead of manual shift Use BIT(tid) instead of 1 << tid when we process an addba response. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 9465d2d91551854f7f65b24f07656eb5c096e2f4 Author: Martin Kaiser Date: Sat May 14 18:47:37 2022 +0200 staging: r8188eu: replace if with ternary operator Replace an if statement with a ternary operator, making the code a tiny bit shorter. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit d4170582c8b0e4f9c68a6caf5decc77424ef844b Author: Martin Kaiser Date: Sat May 14 18:47:36 2022 +0200 staging: r8188eu: merge process_addba_req into OnAction_back The process_addba_req function is called only by OnAction_back. Merge the two functions. OnAction_back has already checked that psta != NULL, we can drop the check in process_addba_req before merging the functions. We can also simplify the parsing of the tid by using struct ieee80211. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit cfed805f8217b078935c2cc6d55368cf143b8c12 Author: Martin Kaiser Date: Sat May 14 18:47:35 2022 +0200 staging: r8188eu: read addba resp tid from ieee80211_mgmt Use the same code as ieee80211_process_addba_resp to calculate the tid from the capability field of an addba response message. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 571cc06877c211458aecfe4cdcad30fcb0fa134a Author: Martin Kaiser Date: Sat May 14 18:47:34 2022 +0200 staging: r8188eu: get addba resp status from ieee80211_mgmt Read the addba response status from struct ieee80211_mgmt instead of parsing the incoming frame ourselves. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220514164740.282552-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 1ebea4231634207486f3e2d6a10ea14a27bd33d7 Author: Soumya Negi Date: Fri May 13 00:51:07 2022 -0700 staging: r8188eu: Fix block comment format Adhere to Linux coding style. Fix the below checkpatch warning: WARNING: Block comments should align the * on each line Signed-off-by: Soumya Negi Link: https://lore.kernel.org/r/20220513075107.23285-1-soumya.negi97@gmail.com Signed-off-by: Greg Kroah-Hartman commit f722d67fad290b0c960f27062adc8cf59488d0a7 Author: Soumya Negi Date: Thu May 12 19:55:53 2022 -0700 staging: rtl8723bs: Fix alignment to match open parenthesis Adhere to Linux coding style. Fixes checkpatch warnings: CHECK: Alignment should match open parenthesis CHECK: line length of 101 exceeds 100 columns Signed-off-by: Soumya Negi Link: https://lore.kernel.org/r/20220513025553.13634-1-soumya.negi97@gmail.com Signed-off-by: Greg Kroah-Hartman commit 404079e7b4810f45a51d83f1b8dd2d3187ad0dc1 Author: Philipp Hortmann Date: Sun May 8 21:30:03 2022 +0200 staging: vt6655: Replace VNSvOutPortB with iowrite8 Replace macro VNSvOutPortB with iowrite8 because it replaces just one line. The name of macro and the arguments use CamelCase which is not accepted by checkpatch.pl Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/38611512677a18f63d9266cde1d20758c0feeb6e.1651957741.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit b3e5e492ad698e7bc1c6ea957a8c89f9db38ef01 Author: Philipp Hortmann Date: Sun May 8 21:29:58 2022 +0200 staging: vt6655: Replace MACvTransmitBCN with VNSvOutPortB Replace macro MACvTransmitBCN with VNSvOutPortB and as it was the only user, it can now be removed. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/698ce973d92065846a9db4339f017cd9e094706e.1651957741.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7436b3ea277cdc1136e6822b53150cb396ad9236 Author: Philipp Hortmann Date: Sun May 8 21:29:53 2022 +0200 staging: vt6655: Replace MACvStart with VNSvOutPortB Replace macro MACvStart with VNSvOutPortB and as it was the only user, it can now be removed. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/d998305b4dec2827b0e13e49938e68a32517c487.1651957741.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit c0235e384e8d036bc1c990e7f465c03967a96252 Author: Vihas Makwana Date: Sun May 8 23:54:01 2022 +0530 staging: r8188eu: drop redundant if check The check for ETH_P_IP is already performed in the outer if block and inner if check is redundant. So drop the check. Signed-off-by: Vihas Makwana Link: https://lore.kernel.org/r/20220508182400.22433-1-makvihas@gmail.com Signed-off-by: Greg Kroah-Hartman commit 073d44eaccf07ffbc48e941c62ccd95324df93bf Author: Martin Kaiser Date: Sun May 8 18:14:51 2022 +0200 staging: r8188eu: read back action code from ieee80211_mgmt Read the back action code from struct ieee80211_mgmt. struct ieee80211_mgmt contains an "action" union. Each of its members starts with an 8-bit action code. Treat the union as addba_req when we read the action code although we do not yet know if it is an addba_req. This approach is similar to ieee80211_iface_process_skb. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220508161451.115847-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit e2b1711fb54436b681257ee75e0b1a230f5cbb1c Author: Martin Kaiser Date: Sun May 8 18:14:50 2022 +0200 staging: r8188eu: use back action codes from ieee80211.h Use the defines from ieee80211.h for the back action codes. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220508161451.115847-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 81900cf8a6045283691afa05994bc012de411020 Author: Martin Kaiser Date: Sun May 8 18:14:49 2022 +0200 staging: r8188eu: read destination address from ieee80211_mgmt For management frames, addr1 is the destination address (da). Read this address from struct ieee80211_mgmt instead of calling a driver-specific macro. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220508161451.115847-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 5b3903d555d4ed45277883012325173c96b7dc2f Author: Martin Kaiser Date: Sun May 8 18:14:48 2022 +0200 staging: r8188eu: don't check the category in OnAction_back Do not check the category in OnAction_back. OnAction has already checked the category before calling OnAction_back. Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220508161451.115847-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 5108b9838a76a9c5cee07b4c4a1bc4bb4024ceeb Author: Martin Kaiser Date: Sun May 8 18:14:47 2022 +0200 staging: r8188eu: read addr2 from ieee80211_mgmt Define a struct ieee80211_mgmt variable in the OnAction_back function. Use it to read addr2. For management frames, addr2 is the source address (sa). Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220508161451.115847-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 20e7ac6f74bc1142f9f9ca0fa46a13d6c3b4cebb Author: Colin Ian King Date: Sat May 7 19:34:14 2022 +0100 staging: rtl8192u: make const array queuetopipe const, reduces object code size Don't populate the const array queuetopipe on the stack, instead make it static. Also makes the object code smaller. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20220507183414.26633-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit dc6a7effb48e7267c9f1314e3aa8cfe539bd6096 Merge: bab6ffa233b96 f260fd59e3f38 Author: Greg Kroah-Hartman Date: Thu May 19 17:18:55 2022 +0200 Merge tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into char-misc-next Kees writes: lkdtm updates for -next - Test for new usercopy memory regions - avoid GCC 12 warnings - update expected CONFIGs for selftests * tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lkdtm/heap: Hide allocation size from -Warray-bounds selftests/lkdtm: Add configs for stackleak and "after free" tests lkdtm/usercopy: Check vmalloc and >0-order folios lkdtm/usercopy: Rename "heap" to "slab" lkdtm: cfi: Fix type width for masking PAC bits commit bab6ffa233b960181feb3bdaa51e93ec35f3eb01 Merge: 9c518db6407d4 ae23f746d7442 Author: Greg Kroah-Hartman Date: Thu May 19 17:17:58 2022 +0200 Merge tag 'fpga-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Moritz writes: FPGA Manager changes for 5.19-rc1 FPGA Manager - My change moves the linux-fpga repository to a shared location w/ shared responsibilities between maintainers - Nava's changes fix coding style and kernel-docs DFL - Matthew's change allows ports to be linked to FMEs. - Tianfei's changes clean up some documentation and ensure the feature type is checked before parsing IRQs All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Signed-off-by: Moritz Fischer * tag 'fpga-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: dfl: Allow Port to be linked to FME's DFL Documentation: fpga: dfl: add link address of feature id table fpga: dfl: check feature type before parse irq info fpga: fpga-region: fix kernel-doc formatting issues fpga: Use tab instead of space indentation fpga: fpga-mgr: fix kernel-doc warnings fpga: fix for coding style issues MAINTAINERS: Update linux-fpga repository location commit 9c518db6407d45cede53469bdc2ef1d69cbecbac Merge: e727efee8c5ad 1adff542d67a2 Author: Greg Kroah-Hartman Date: Thu May 19 17:16:37 2022 +0200 Merge tag 'coresight-next-v5.19' of gitolite.kernel.org:pub/scm/linux/kernel/git/coresight/linux into char-misc-next Mathieu writes: Coresight changes for v5.19 This pull request includes: - Work to uniformise access to the ETMv4 registers, making it easier to look for and change register accesses. - A correction to a probing failure when looking for links between devices. - The replacement of a call to mutex_lock() with a mutex_trylock() in the panic notifier of the cpu-debug infrastructure to avoid a possible deadlock. Signed-off-by: Mathieu Poirier * tag 'coresight-next-v5.19' of gitolite.kernel.org:pub/scm/linux/kernel/git/coresight/linux: coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier coresight: core: Fix coresight device probe failure issue coresight: etm4x: Cleanup TRCRSCTLRn register accesses coresight: etm4x: Cleanup TRCBBCTLR register accesses coresight: etm4x: Cleanup TRCSSPCICRn register accesses coresight: etm4x: Cleanup TRCSSCCRn and TRCSSCSRn register accesses coresight: etm4x: Cleanup TRCACATRn register accesses coresight: etm3x: Cleanup ETMTECR1 register accesses coresight: etm4x: Cleanup TRCVICTLR register accesses coresight: etm4x: Cleanup TRCSTALLCTLR register accesses coresight: etm4x: Cleanup TRCEVENTCTL1R register accesses coresight: etm4x: Cleanup TRCCONFIGR register accesses coresight: etm4x: Cleanup TRCIDR5 register accesses coresight: etm4x: Cleanup TRCIDR4 register accesses coresight: etm4x: Cleanup TRCIDR3 register accesses coresight: etm4x: Cleanup TRCIDR2 register accesses coresight: etm4x: Cleanup TRCIDR0 register accesses commit e727efee8c5add759d0c596b011ab033bf0f0ed1 Merge: fa5602c62544e 5dcc2afe716d6 Author: Greg Kroah-Hartman Date: Thu May 19 17:14:34 2022 +0200 Merge tag 'extcon-next-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next Chanwoo writes: Update extcon next for v5.19 Detailed description for this pull request: 1. update extcon core driver - extcon_get_extcon_dev() has been almost used to get the extcon device on booting time. If extcon provider driver is probed at late time, the extcon consumer driver get the -EPROBE_DEFER return value. It requires the inefficient handling code of -EPROBE_DEFER. Instead, extcon_get_extcon_dev() will return -EPROBE_DEFER if the required extcon device is none. It makes the extcon consumer driver to be simplified when getting extcon device. - Register device after dev_set_drvdata because of accessing the sysfs attributes at timing of between drv_set_data and device_register. - Fix some kernel-doc comments of extcon functions. 2. update extcon provider driver - Update extcon-intel-int3496.c : Add support for controlling vbus power via regulator and support to the extcon-intel-int3496.c driver to bind to devices without an ACPi companion. And fix the minor clean-up. - Use struct_size() helper on extcon-usbc-cros-ec.c - Remove the disable irq operation in system sleep for using vbus/id gpio as the wakeup source on extcon-usb-gpio.c - Add support of SM5703 device by using existing extcon-sm5502.c and rename i2c_devic_id from sm5703 to sm5703-muic to reduce confusion between SM5703 MFD device and extcon device. - Add usb role class support and add queue work sync before driver release on extcon-ptn5150.c * tag 'extcon-next-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon: extcon: Modify extcon device to be created after driver data is set extcon: sm5502: Clarify SM5703's i2c device ID extcon: ptn5150: Add usb role class support extcon: ptn5150: Add queue work sync before driver release extcon: sm5502: Add support for SM5703 dt-bindings: extcon: bindings for SM5703 extcon: usb-gpio: Remove disable irq operation in system sleep extcon: Fix some kernel-doc comments extcon: usbc-cros-ec: Use struct_size() helper in kzalloc() extcon: int3496: Add support for controlling Vbus through a regulator extcon: int3496: Add support for binding to plain platform devices extcon: int3496: Request non-exclusive access to the ID GPIO extcon: int3496: Make the driver a bit less verbose extcon: Fix extcon_get_extcon_dev() error handling commit fa5602c62544ea5303ce870a9a3318fa7695ffc2 Merge: 46509e7578a28 74da272400b46 Author: Greg Kroah-Hartman Date: Thu May 19 16:57:16 2022 +0200 Merge tag 'soundwire-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next Vinod writes: soundwire updates for 5.19-rc1 - Support for v1.6.0 Qualcomm controllers - Bunch of pm updates by Intel for peripheral attachment and system pm etc * tag 'soundwire-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: qcom: adjust autoenumeration timeout soundwire: qcom: use pm_runtime_resume_and_get() soundwire: intel: use pm_runtime_resume_and_get() soundwire: cadence: use pm_runtime_resume_and_get() soundwire: bus: use pm_runtime_resume_and_get() soundwire: qcom: return error when pm_runtime_get_sync fails soundwire: bus: pm_runtime_request_resume on peripheral attachment soundwire: intel: disable WAKEEN in pm_runtime resume soundwire: intel: prevent pm_runtime resume prior to system suspend soundwire: cadence: recheck device0 attachment after status change dt-bindings: soundwire: qcom: Add bindings for audio clock reset control property soundwire: qcom: Add compatible name for v1.6.0 soundwire: stream: Fix error return code in do_bank_switch() soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled() commit 46509e7578a28b0f87329d2c7e5e363879266c12 Merge: 46ee6bcac9838 d413a34932f98 Author: Greg Kroah-Hartman Date: Thu May 19 16:56:17 2022 +0200 Merge tag 'phy-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-work-next Vinod writes: phy-for-5.19 - New support: - LVDS configuration support and implementation in fsl driver - Qualcomm UFS phy support for SM6350 and USB PHY for SDX65 - Allwinner D-PHY Rx mode support - Yamilfy Mixel mipi-dsi-phy - Updates: - Documentation for phy ops order - Can transceiver mux support - Qualcomm QMP phy updates - Uniphier phy updates * tag 'phy-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (40 commits) phy: qcom-qmp: rename error labels phy: qcom-qmp: fix pipe-clock imbalance on power-on failure phy: qcom-qmp: switch to explicit reset helpers phy: qcom-qmp: fix reset-controller leak on probe errors phy: qcom-qmp: fix struct clk leak on probe errors dt-bindings: phy: renesas,usb2-phy: Document RZ/G2UL phy bindings dt-bindings: phy: marvell,armada-3700-utmi-host-phy: Fix incorrect compatible in example phy: qcom-qmp: fix phy-descriptor kernel-doc typo phy: rockchip-inno-usb2: Clean up some inconsistent indenting phy: freescale: imx8m-pcie: Handle IMX8_PCIE_REFCLK_PAD_UNUSED phy: core: Warn when phy_power_on is called before phy_init phy: core: Update documentation syntax phy: core: Add documentation of phy operation order phy: rockchip-inno-usb2: Handle ID IRQ phy: rockchip-inno-usb2: Handle bvalid falling phy: rockchip-inno-usb2: Support multi-bit mask properties phy: rockchip-inno-usb2: Do not lock in bvalid IRQ handler phy: rockchip-inno-usb2: Do not check bvalid twice phy: rockchip-inno-usb2: Fix muxed interrupt support phy: allwinner: phy-sun6i-mipi-dphy: Support D-PHY Rx mode for MIPI CSI-2 ... commit 46ee6bcac9838b7f74ff91f9cf38511c901ea9c5 Merge: bcfa9546500a4 13b9b814da2de Author: Greg Kroah-Hartman Date: Thu May 19 16:55:13 2022 +0200 Merge tag 'mhi-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-work-next Manivannan writes: MHI changes for v5.19 MHI Host -------- Support for new modems: - Foxconn Cinterion MV32-WA/MV32-WB based on SDX62/SDX65 - Telit FN980 v1 based on SDX55 - Telit FN990 based on SDX65 - Foxconn T99W373/T99W368 based on SDX62/SDX65 Core changes: - During the recycle of event ring elements, compute the ctxt_wp based on the local cached value instead of reading from shared memory. This is to prevent the possible corruption of the ctxt_wp as some of the endpoint devices could modify the value in shared memory. - Add sysfs support for resetting the endpoint based on the MHI spec. The MHI spec allows the host to hard reset the device in the case of an unrecoverable error and all other reset mechanisms have failed. - During MHI shutdown, wait for the endpoint device to enter the ready state post reset before proceeding. This is to avoid a possible race where host would remove the interrupt handler and device will send ready state interrupt, resulting in IOMMU fault. - Bail out updating the MHI register if the read has failed during read/modify/write. - Use mhi_write_reg() instead of mhi_write_reg_field() for writing the whole register fields in mhi_init_mmio(). MAINTAINERS change: - Since Qualcomm has moved the email domain for its employess from codeaurora domain to quicinc, update the same for Hemant. * tag 'mhi-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi: (29 commits) bus: mhi: host: Add support for Foxconn T99W373 and T99W368 bus: mhi: host: pci_generic: add Telit FN990 bus: mhi: host: pci_generic: add Telit FN980 v1 hardware revision bus: mhi: host: Add support for Cinterion MV32-WA/MV32-WB bus: mhi: host: Optimize and update MMIO register write method bus: mhi: host: Bail on writing register fields if read fails bus: mhi: host: Wait for ready state after reset bus: mhi: host: Add soc_reset sysfs bus: mhi: host: pci_generic: Sort mhi_pci_id_table based on the PID bus: mhi: host: Use cached values for calculating the shared write pointer MAINTAINERS: Update Hemant's email id bus: mhi: ep: Add uevent support for module autoloading bus: mhi: ep: Add support for suspending and resuming channels bus: mhi: ep: Add support for queueing SKBs to the host bus: mhi: ep: Add support for processing channel rings bus: mhi: ep: Add support for reading from the host bus: mhi: ep: Add support for processing command rings bus: mhi: ep: Add support for handling SYS_ERR condition bus: mhi: ep: Add support for handling MHI_RESET bus: mhi: ep: Add support for powering down the MHI endpoint stack ... commit 3092adcef3ffd2ef59634998297ca8358461ebce Author: Jason A. Donenfeld Date: Sun May 15 00:22:05 2022 +0200 random: unify batched entropy implementations There are currently two separate batched entropy implementations, for u32 and u64, with nearly identical code, with the goal of avoiding unaligned memory accesses and letting the buffers be used more efficiently. Having to maintain these two functions independently is a bit of a hassle though, considering that they always need to be kept in sync. This commit factors them out into a type-generic macro, so that the expansion produces the same code as before, such that diffing the assembly shows no differences. This will also make it easier in the future to add u16 and u8 batches. This was initially tested using an always_inline function and letting gcc constant fold the type size in, but the code gen was less efficient, and in general it was more verbose and harder to follow. So this patch goes with the boring macro solution, similar to what's already done for the _wait functions in random.h. Cc: Dominik Brodowski Signed-off-by: Jason A. Donenfeld commit 5ad7dd882e45d7fe432c32e896e2aaa0b21746ea Author: Jason A. Donenfeld Date: Sat May 14 13:59:30 2022 +0200 random: move randomize_page() into mm where it belongs randomize_page is an mm function. It is documented like one. It contains the history of one. It has the naming convention of one. It looks just like another very similar function in mm, randomize_stack_top(). And it has always been maintained and updated by mm people. There is no need for it to be in random.c. In the "which shape does not look like the other ones" test, pointing to randomize_page() is correct. So move randomize_page() into mm/util.c, right next to the similar randomize_stack_top() function. This commit contains no actual code changes. Cc: Andrew Morton Signed-off-by: Jason A. Donenfeld commit 6701de6c51c172b5de5633374479503c81fefc0b Author: Jason A. Donenfeld Date: Sun May 15 15:06:18 2022 +0200 random: remove mostly unused async readiness notifier The register_random_ready_notifier() notifier is somewhat complicated, and was already recently rewritten to use notifier blocks. It is only used now by one consumer in the kernel, vsprintf.c, for which the async mechanism is really overly complex for what it actually needs. This commit removes register_random_ready_notifier() and unregister_random_ ready_notifier(), because it just adds complication with little utility, and changes vsprintf.c to just check on `!rng_is_initialized() && !rng_has_arch_random()`, which will eventually be true. Performance- wise, that code was already using a static branch, so there's basically no overhead at all to this change. Cc: Steven Rostedt Cc: Sergey Senozhatsky Acked-by: Petr Mladek # for vsprintf.c Reviewed-by: Petr Mladek Signed-off-by: Jason A. Donenfeld commit 248561ad25a8ba4ecbc7df42f9a5a82fd5fbb4f6 Author: Jason A. Donenfeld Date: Sat May 14 13:09:17 2022 +0200 random: remove get_random_bytes_arch() and add rng_has_arch_random() The RNG incorporates RDRAND into its state at boot and every time it reseeds, so there's no reason for callers to use it directly. The hashing that the RNG does on it is preferable to using the bytes raw. The only current use case of get_random_bytes_arch() is vsprintf's siphash key for pointer hashing, which uses it to initialize the pointer secret earlier than usual if RDRAND is available. In order to replace this narrow use case, just expose whether RDRAND is mixed into the RNG, with a new function called rng_has_arch_random(). With that taken care of, there are no users of get_random_bytes_arch() left, so it can be removed. Later, if trust_cpu gets turned on by default (as most distros are doing), this one use of rng_has_arch_random() can probably go away as well. Cc: Steven Rostedt Cc: Sergey Senozhatsky Acked-by: Petr Mladek # for vsprintf.c Signed-off-by: Jason A. Donenfeld commit 560181c27b582557d633ecb608110075433383af Author: Jason A. Donenfeld Date: Fri May 13 16:17:12 2022 +0200 random: move initialization functions out of hot pages Much of random.c is devoted to initializing the rng and accounting for when a sufficient amount of entropy has been added. In a perfect world, this would all happen during init, and so we could mark these functions as __init. But in reality, this isn't the case: sometimes the rng only finishes initializing some seconds after system init is finished. For this reason, at the moment, a whole host of functions that are only used relatively close to system init and then never again are intermixed with functions that are used in hot code all the time. This creates more cache misses than necessary. In order to pack the hot code closer together, this commit moves the initialization functions that can't be marked as __init into .text.unlikely by way of the __cold attribute. Of particular note is moving credit_init_bits() into a macro wrapper that inlines the crng_ready() static branch check. This avoids a function call to a nop+ret, and most notably prevents extra entropy arithmetic from being computed in mix_interrupt_randomness(). Reviewed-by: Dominik Brodowski Signed-off-by: Jason A. Donenfeld commit a19402634c435a4eae226df53c141cdbb9922e7b Author: Jason A. Donenfeld Date: Fri May 13 13:18:46 2022 +0200 random: make consistent use of buf and len The current code was a mix of "nbytes", "count", "size", "buffer", "in", and so forth. Instead, let's clean this up by naming input parameters "buf" (or "ubuf") and "len", so that you always understand that you're reading this variety of function argument. Signed-off-by: Jason A. Donenfeld commit 7c3a8a1db5e03d02cc0abb3357a84b8b326dfac3 Author: Jason A. Donenfeld Date: Fri May 13 12:32:23 2022 +0200 random: use proper return types on get_random_{int,long}_wait() Before these were returning signed values, but the API is intended to be used with unsigned values. Signed-off-by: Jason A. Donenfeld commit 7782cfeca7d420e8bb707613d4cfb0f7ff29bb3a Author: Jason A. Donenfeld Date: Fri May 13 12:29:38 2022 +0200 random: remove extern from functions in header Accoriding to the kernel style guide, having `extern` on functions in headers is old school and deprecated, and doesn't add anything. So remove them from random.h, and tidy up the file a little bit too. Signed-off-by: Jason A. Donenfeld commit f5bda35fba615ace70a656d4700423fa6c9bebee Author: Jason A. Donenfeld Date: Tue May 3 15:30:45 2022 +0200 random: use static branch for crng_ready() Since crng_ready() is only false briefly during initialization and then forever after becomes true, we don't need to evaluate it after, making it a prime candidate for a static branch. One complication, however, is that it changes state in a particular call to credit_init_bits(), which might be made from atomic context, which means we must kick off a workqueue to change the static key. Further complicating things, credit_init_bits() may be called sufficiently early on in system initialization such that system_wq is NULL. Fortunately, there exists the nice function execute_in_process_context(), which will immediately execute the function if !in_interrupt(), and otherwise defer it to a workqueue. During early init, before workqueues are available, in_interrupt() is always false, because interrupts haven't even been enabled yet, which means the function in that case executes immediately. Later on, after workqueues are available, in_interrupt() might be true, but in that case, the work is queued in system_wq and all goes well. Cc: Theodore Ts'o Cc: Sultan Alsawaf Reviewed-by: Dominik Brodowski Signed-off-by: Jason A. Donenfeld commit bcfa9546500a41fa448816a3c6df2fb798ba9130 Merge: 33a1c6618677f eda75f8238b07 Author: Greg Kroah-Hartman Date: Thu May 19 16:53:08 2022 +0200 Merge tag 'iio-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: First set of IIO new device support, features and cleanup for 5.19 Usual mixed bag. Stand out this time is Andy Shevchenko's continuing effort to move drivers over the generic firmware interfaces. Device support * sprd,sc2720 - upm9620 binding addition. - Refactor and support for sc2720, sc2721 and sc2730. * ti,ads1015 - Refactor driver and add support for TLA2024. Device support (IDs only) * invensense,mpu6050 - Add ID for ICM-20608-D. * st,accel: - Add ID for lis302dl. * st,lsm6dsx - Add support for ASM330LHHX (can fallback to LSM6DSR.) Features * convert drivers to device properties - IIO core - adi,ad7266 - adi,adis16480 - adi,adxl355 - bosch,bmi160 - domintech,dmard06 - fsl,fxas21002c - invensense,mpu3050 - linear,ltc2983 - linear,ltc2632 - maxbotix,mb1232 - maxim,max31856 - maxim,max31865 - multiplexer - ping - rescale - taos,tsl2772 * core - Add runtime check on whether realbits fit in storagebits for each channel. * adi,ad_sigma_delta - Add sequencer support and relevant update_scan_mode callbacks for adi,ad7192 and adi,ad7124. Cleanup and minor fixes * MAINTAINERS - Update Lorenzo Bianconi's email address for IIO drivers. - Add entry for ad3552r and update maintainer in dt-binding doc. * tree-wide - Replace strtobool() with kstrtobool(). - Drop false OF dependencies. * core - Tidy up and document IIO modes. - Take iio_buffer_enabled() out of header allowing current_mode to be moved to the opaque structure. - As all kfifo buffers use the same mode value, drop that parameter and set it unconditionally. - White space fixes and similar. - Drop use of list iterator variable for list_for_each_entry_continue_reverse and use list_prepare_entry to restart. * sysfs-trigger - Replace use of 'found' variable with dedicate list iterator variable. * adi,ad7124 - Drop misleading shift. * adi,ad2s1210 - Remove redundant local variable assignment. * adi,adis16480 - Use local device pointer to reduce repetition. - Improve handling of clocks. * domintech,dmard09 - White space. * dummy driver - Improve error handling. * fsl,mma8452 - Add missing documentation of name element. * invensense,mpu3050 - Stop remove() returning non 0. * kionix,kxsd9 - White space. * linear,ltc2688 - Use local variable for struct device. - Combine of_node_put() error handling paths. * linear,ltc2983 - Avoid use of constants in messages where a define is available. * microchip,mcp4131 - Fix compatible in dt example. * pni,rm3100 - Stop directly accessing iio_dev->current_mode just to find out if the buffer is enabled. * renesas,rzg2l - Relax kconfig constraint to include newer devices. * sprd,sc27xx - Fix wrong scaling mask. - Improve the calibration values. * samsung,ssp - Replace a 'found' variable in favor of an explicit value that was found. * sensortek,stk3xx - Add proximity-near-level binding and driver support. * st,st_sensors: - Drop unused accel_type enum. - Return early in *_write_raw() - Drop unnecessary locking in _avail functions. - Add local lock to protect odr against concurrent updates allowing mlock to no longer be used outside of the core. - Use iio_device_claim_direct_mode() rather than racy checking of the current mode. * st,stmpe-adc - Fix checks on wait_for_completion_timeout(). - Allow use of of_device_id for matching. * st,stm32-dfsdm - Stop accessing iio_dev->current_mode to find out if the buffer is enabled (so we can hide that variable in the opaque structure) * st,vl53l0x - Fix checks on wait_for_completion_timeout. * ti,ads1015 - Add missing ID for ti,ads1115 in binding doc. - Convert from repeated chip ID look up to selecting static const data. - Switch to read_avail() callback. * ti,ads8688 - Use of_device_id for driver matching. * ti,palmas-adc - Drop a warning on minor calibration mismatch leading to slightly negative values after applying the calibration. * tag 'iio-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (95 commits) iio: ti-ads8688: use of_device_id for OF matching iio: stmpe-adc: use of_device_id for OF matching dt-bindings: iio: Fix incorrect compatible strings in examples iio: gyro: mpu3050: Make mpu3050_common_remove() return void iio: dac: ltc2632: Make use of device properties iio: temperature: max31865: Make use of device properties iio: proximity: mb1232: Switch to use fwnode_irq_get() iio: imu: adis16480: Improve getting the optional clocks iio: imu: adis16480: Use temporary variable for struct device iio: imu: adis16480: Make use of device properties staging: iio: ad2s1210: remove redundant assignment to variable negative iio: adc: sc27xx: add support for PMIC sc2730 iio: adc: sc27xx: add support for PMIC sc2720 and sc2721 iio: adc: sc27xx: refactor some functions for support more PMiCs iio: adc: sc27xx: structure adjustment and optimization iio: adc: sc27xx: Fine tune the scale calibration values iio: adc: sc27xx: fix read big scale voltage not right dt-bindings:iio:adc: add sprd,ump9620-adc dt-binding iio: proximity: stk3310: Export near level property for proximity sensor dt-bindings: iio: light: stk33xx: Add proximity-near-level ... commit 933adebbbd2f3160451b55f915133cd4d1c4d8fd Author: Rob Herring Date: Wed May 18 20:12:09 2022 -0500 dt-bindings: pinctrl: qcom: Drop 'maxItems' on 'wakeup-parent' 'wakeup-parent' is a single phandle and not an array, so 'maxItems' is wrong. Drop it. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220519011210.170022-1-robh@kernel.org Signed-off-by: Linus Walleij commit 48bd5c381c4a750bf486360536f4274c10b9ca35 Author: Geert Uytterhoeven Date: Wed May 18 16:41:42 2022 +0200 pinctrl: starfive: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warning is now observed for the starfive driver: gpio gpiochip0: (11910000.pinctrl): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the starfive driver immutable. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/5eb66be34356afd5eb0ea9027329e0939d03d3a0.1652884852.git.geert+renesas@glider.be Signed-off-by: Linus Walleij commit e89aa642be21b14e53bab40a37b8c6b0cf05143d Author: Christophe Leroy Date: Mon May 9 07:36:14 2022 +0200 powerpc/ftrace: Use PPC_RAW_xxx() macros instead of opencoding. PPC_RAW_xxx() macros are self explanatory and less error prone than open coding. Use them in ftrace.c Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/9292094c9a69cef6d29ee83f435a557b59c45065.1652074503.git.christophe.leroy@csgroup.eu commit cf9df92a823ce24c19c4c64b334dc5cadd74fa98 Author: Christophe Leroy Date: Mon May 9 07:36:13 2022 +0200 powerpc/ftrace: Use BRANCH_SET_LINK instead of value 1 To make it explicit, use BRANCH_SET_LINK instead of value 1 when calling create_branch(). Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d57847063ac93660a5af620d4df1847f10edf61a.1652074503.git.christophe.leroy@csgroup.eu commit ccf6607e45aaf5e0ceabfe018aeb01818a936697 Author: Christophe Leroy Date: Mon May 9 07:36:12 2022 +0200 powerpc/ftrace: Remove ftrace_plt_tramps[] ftrace_plt_tramps table is never filled so it is useless. Remove it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/daeeb618a6619e3a7e3f82f1bd83ca7c25af6330.1652074503.git.christophe.leroy@csgroup.eu commit c2cba93d1a5e2475a636b5cb974da6b73d7a72df Author: Christophe Leroy Date: Mon May 9 07:36:11 2022 +0200 powerpc/ftrace: Use CONFIG_FUNCTION_TRACER instead of CONFIG_DYNAMIC_FTRACE Since commit 0c0c52306f47 ("powerpc: Only support DYNAMIC_FTRACE not static"), CONFIG_DYNAMIC_FTRACE is always selected when CONFIG_FUNCTION_TRACER is selected. To avoid confusion and have the reader wonder what's happen when CONFIG_FUNCTION_TRACER is selected and CONFIG_DYNAMIC_FTRACE is not, use CONFIG_FUNCTION_TRACER in ifdefs instead of CONFIG_DYNAMIC_FTRACE. As CONFIG_FUNCTION_GRAPH_TRACER depends on CONFIG_FUNCTION_TRACER, ftrace.o doesn't need to appear for both symbols in Makefile. Then as ftrace.o is built only when CONFIG_FUNCTION_TRACER is selected ifdef CONFIG_FUNCTION_TRACER is not needed in ftrace.c, and since it implies CONFIG_DYNAMIC_FTRACE, CONFIG_DYNAMIC_FTRACE is not needed in ftrace.c Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/628d357503eb90b4a034f99b7df516caaff4d279.1652074503.git.christophe.leroy@csgroup.eu commit a3d0f5b4b7e425b8abeadda1e76496bda88989bd Author: Christophe Leroy Date: Mon May 9 07:36:10 2022 +0200 powerpc/ftrace: Don't include ftrace.o for CONFIG_FTRACE_SYSCALLS Since commit 7bea7ac0ca01 ("powerpc/syscalls: Fix syscall tracing") ftrace.o is not needed anymore for CONFIG_FTRACE_SYSCALLS. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/275932a5d61543b825ff9a64f61abed6da5d4a2a.1652074503.git.christophe.leroy@csgroup.eu commit 23b44fc248f420bbcd0dcd290c3399885360984d Author: Christophe Leroy Date: Mon May 9 07:36:09 2022 +0200 powerpc/ftrace: Make __ftrace_make_{nop/call}() common to PPC32 and PPC64 Since c93d4f6ecf4b ("powerpc/ftrace: Add module_trampoline_target() for PPC32"), __ftrace_make_nop() for PPC32 is very similar to the one for PPC64. Same for __ftrace_make_call(). Make them common. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/96f53c237316dab4b1b8c682685266faa92da816.1652074503.git.christophe.leroy@csgroup.eu commit 5b89492c03e5c0a2c259b97d7d4c1bb9b02860aa Author: Christophe Leroy Date: Mon May 9 07:36:08 2022 +0200 powerpc: Finalise cleanup around ABI use Now that we have CONFIG_PPC64_ELF_ABI_V1 and CONFIG_PPC64_ELF_ABI_V2, get rid of all indirect detection of ABI version. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/709d9d69523c14c8a9fba4486395dca0f2d675b1.1652074503.git.christophe.leroy@csgroup.eu commit 7d40aff8213c92e64a1576ba9dfebcd201c0564d Author: Christophe Leroy Date: Mon May 9 07:36:07 2022 +0200 powerpc: Replace PPC64_ELF_ABI_v{1/2} by CONFIG_PPC64_ELF_ABI_V{1/2} Replace all uses of PPC64_ELF_ABI_v1 and PPC64_ELF_ABI_v2 by resp CONFIG_PPC64_ELF_ABI_V1 and CONFIG_PPC64_ELF_ABI_V2. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/ba13d59e8c50bc9aa6328f1c7f0c0d0278e0a3a7.1652074503.git.christophe.leroy@csgroup.eu commit 661aa880398add5c27943cb077c451a45cc112a1 Author: Christophe Leroy Date: Mon May 9 07:36:06 2022 +0200 powerpc: Add CONFIG_PPC64_ELF_ABI_V1 and CONFIG_PPC64_ELF_ABI_V2 At the time being, we use CONFIG_CPU_LITTLE_ENDIAN and CONFIG_CPU_BIG_ENDIAN to pass -mabi=elfv1 or elfv2 to compiler, then define a PPC64_ELF_ABI_v1 or PPC64_ELF_ABI_v2 macro in asm/types.h based on _CALL_ELF define set by the compiler. Make it more straight forward with a CONFIG option that is directly usable. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1eca1addbc550167da9841c7340a010d0c4b2200.1652074503.git.christophe.leroy@csgroup.eu commit bbffdd2fc743bdc529f9a8264bdb5d3491f58c95 Author: Christophe Leroy Date: Mon May 9 07:36:05 2022 +0200 powerpc/ftrace: Use patch_instruction() return directly Instead of returning -EPERM when patch_instruction() fails, just return what patch_instruction returns. That simplifies ftrace_modify_code(): 0: 94 21 ff c0 stwu r1,-64(r1) 4: 93 e1 00 3c stw r31,60(r1) 8: 7c 7f 1b 79 mr. r31,r3 c: 40 80 00 30 bge 3c 10: 93 c1 00 38 stw r30,56(r1) 14: 7c 9e 23 78 mr r30,r4 18: 7c a4 2b 78 mr r4,r5 1c: 80 bf 00 00 lwz r5,0(r31) 20: 7c 1e 28 40 cmplw r30,r5 24: 40 82 00 34 bne 58 28: 83 c1 00 38 lwz r30,56(r1) 2c: 7f e3 fb 78 mr r3,r31 30: 83 e1 00 3c lwz r31,60(r1) 34: 38 21 00 40 addi r1,r1,64 38: 48 00 00 00 b 38 38: R_PPC_REL24 patch_instruction Before: 0: 94 21 ff c0 stwu r1,-64(r1) 4: 93 e1 00 3c stw r31,60(r1) 8: 7c 7f 1b 79 mr. r31,r3 c: 40 80 00 4c bge 58 10: 93 c1 00 38 stw r30,56(r1) 14: 7c 9e 23 78 mr r30,r4 18: 7c a4 2b 78 mr r4,r5 1c: 80 bf 00 00 lwz r5,0(r31) 20: 7c 08 02 a6 mflr r0 24: 90 01 00 44 stw r0,68(r1) 28: 7c 1e 28 40 cmplw r30,r5 2c: 40 82 00 48 bne 74 30: 7f e3 fb 78 mr r3,r31 34: 48 00 00 01 bl 34 34: R_PPC_REL24 patch_instruction 38: 80 01 00 44 lwz r0,68(r1) 3c: 20 63 00 00 subfic r3,r3,0 40: 83 c1 00 38 lwz r30,56(r1) 44: 7c 63 19 10 subfe r3,r3,r3 48: 7c 08 03 a6 mtlr r0 4c: 83 e1 00 3c lwz r31,60(r1) 50: 38 21 00 40 addi r1,r1,64 54: 4e 80 00 20 blr It improves ftrace activation/deactivation duration by about 3%. Modify patch_instruction() return on failure to -EPERM in order to match with ftrace expectations. Other users of patch_instruction() do not care about the exact error value returned. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/49a8597230713e2633e7d9d7b56140787c4a7e20.1652074503.git.christophe.leroy@csgroup.eu commit 2c920fca8c70287c4448f2653a388ecca7b32e83 Author: Christophe Leroy Date: Mon May 9 07:36:04 2022 +0200 powerpc/ftrace: Inline ftrace_modify_code() Inlining ftrace_modify_code(), it increases a bit the size of ftrace code but brings 5% improvment on ftrace activation. Usually in C files we let gcc decide what to do but here it really help to 'help' gcc to decide to inline, thought we don't want to force it with an __always_inline that would be too much for CONFIG_CC_OPTIMIZE_FOR_SIZE. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1597a06d57cfc80e6853838c4066e799bf6c7977.1652074503.git.christophe.leroy@csgroup.eu commit d2f47dabf1252520a88d257133e6bdec474fd935 Author: Christophe Leroy Date: Mon May 9 07:36:03 2022 +0200 powerpc/code-patching: Inline create_branch() create_branch() is a good candidate for inlining because: - Flags can be folded in. - Range tests are likely to be already done. Hence reducing the create_branch() to only a set of instructions. So inline it. It improves ftrace activation by 10%. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/69851cc9a7bf8f03d025e6d29e165f2d0bd3bb6e.1652074503.git.christophe.leroy@csgroup.eu commit a1facd2578b312770aaea384adc7de0ed3f543d1 Author: Christophe Leroy Date: Mon May 9 07:36:02 2022 +0200 powerpc/ftrace: Use is_offset_in_branch_range() Use is_offset_in_branch_range() instead of create_branch() to check if a target is within branch range. This patch together with the previous one improves ftrace activation time by 7% Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/912ae51782f5a53c44e435497c8c3fb5cc632387.1652074503.git.christophe.leroy@csgroup.eu commit 1acbf27e8a5843911d122ad0008e79ec5f7b6382 Author: Christophe Leroy Date: Mon May 9 07:36:01 2022 +0200 powerpc/code-patching: Inline is_offset_in_{cond}_branch_range() Test in is_offset_in_branch_range() and is_offset_in_cond_branch_range() are simple tests that are worth inlining. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a05be0ccb7373e6a9789a1988fcd0c810f5f9269.1652074503.git.christophe.leroy@csgroup.eu commit ae3a2a2188214adc355a5bdf6deb29120886c96f Author: Christophe Leroy Date: Mon May 9 07:36:00 2022 +0200 powerpc/ftrace: Remove redundant create_branch() calls Since commit d5937db114e4 ("powerpc/code-patching: Fix patch_branch() return on out-of-range failure") patch_branch() fails with -ERANGE when trying to branch out of range. No need to perform the test twice. Remove redundant create_branch() calls. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/aa45fbad0b4b7493080835d8276c0cb4ce146503.1652074503.git.christophe.leroy@csgroup.eu commit d996d5053eb5c0abc0358e5670014a62ada6967e Author: Christophe Leroy Date: Mon May 9 07:35:59 2022 +0200 powerpc/ftrace: Refactor prepare_ftrace_return() When we have CONFIG_DYNAMIC_FTRACE_WITH_ARGS, prepare_ftrace_return() is called by ftrace_graph_func() otherwise prepare_ftrace_return() is called from assembly. Refactor prepare_ftrace_return() into a static __prepare_ftrace_return() that will be called by both prepare_ftrace_return() and ftrace_graph_func(). It will allow GCC to fold __prepare_ftrace_return() inside ftrace_graph_func(). Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0d42deafe353980c66cf19d3132638c05ba9f4a9.1652074503.git.christophe.leroy@csgroup.eu commit 804c0a166ffea628eb7ef72b9fd710883cb1fa8f Author: Nicholas Piggin Date: Tue Mar 8 23:50:46 2022 +1000 powerpc/rtas: enture rtas_call is called with MMU enabled rtas_call must not be called with the MMU disabled because in case of rtas error, log_error is called which requires MMU enabled. Add a test and warning for this. Signed-off-by: Nicholas Piggin Reviewed-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-14-npiggin@gmail.com commit 014b2e896cc8445fcc04636e69bf5f9e24281daa Author: Nicholas Piggin Date: Tue Mar 8 23:50:42 2022 +1000 powerpc/rtas: Leave MSR[RI] enabled over RTAS call PAPR specifies that RTAS may be called with MSR[RI] enabled if the calling context is recoverable, and RTAS will manage RI as necessary. Call the rtas entry point with RI enabled, and add a check to ensure the caller has RI enabled. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-10-npiggin@gmail.com commit 5c86bd02b3c3ef68a109fa7e690ad62d3091f6d4 Author: Nicholas Piggin Date: Tue Mar 8 23:50:40 2022 +1000 powerpc/rtas: PACA can be restored directly from SPRG On 64-bit, PACA is saved in a SPRG so it does not need to be saved on stack. We also don't need to mask off the top bits for real mode addresses because the architecture does this for us. Signed-off-by: Nicholas Piggin Reviewed-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-8-npiggin@gmail.com commit c5a65e0a420d50655bf692fc7386813683c0cd81 Author: Nicholas Piggin Date: Tue Mar 8 23:50:37 2022 +1000 powerpc/rtas: Call enter_rtas with MSR[EE] disabled Disable MSR[EE] in C code rather than asm. Signed-off-by: Nicholas Piggin Reviewed-by: Laurent Dufour Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-5-npiggin@gmail.com commit 4e949faae2bd42783a2b2b732b7bf17557d94cfb Author: Nicholas Piggin Date: Tue Mar 8 23:50:36 2022 +1000 powerpc/rtas: Fix whitespace in rtas_entry.S The code was moved verbatim including whitespace cruft. Fix that. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-4-npiggin@gmail.com commit 07940b4b61cf0cbcfb9e4226c07318f737157c42 Author: Nicholas Piggin Date: Tue Mar 8 23:50:35 2022 +1000 powerpc/rtas: Make enter_rtas a nokprobe symbol on 64-bit This symbol is marked nokprobe on 32-bit but not 64-bit, add it. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-3-npiggin@gmail.com commit 838ee286ecc9a3c76e6bd8f5aaad0c8c5c66b9ca Author: Nicholas Piggin Date: Tue Mar 8 23:50:34 2022 +1000 powerpc/rtas: Move rtas entry assembly into its own file This makes working on the code a bit easier. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220308135047.478297-2-npiggin@gmail.com commit 2896b2dff49d0377e4372f470dcddbcb26f2be59 Author: Nicholas Piggin Date: Tue Mar 8 04:27:34 2022 +1000 powerpc/signal: Report minimum signal frame size to userspace via AT_MINSIGSTKSZ Implement the AT_MINSIGSTKSZ AUXV entry, allowing userspace to dynamically size stack allocations in a manner forward-compatible with new processor state saved in the signal frame For now these statically find the maximum signal frame size rather than doing any runtime testing of features to minimise the size. glibc 2.34 will take advantage of this, as will applications that use use _SC_MINSIGSTKSZ and _SC_SIGSTKSZ. Reviewed-by: Tulio Magno Quites Machado Filho Signed-off-by: Nicholas Piggin References: 94b07c1f8c39 ("arm64: signal: Report signal frame size to userspace via auxv") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220307182734.289289-2-npiggin@gmail.com commit 2f82ec19757f58549467db568c56e7dfff8af283 Author: Nicholas Piggin Date: Tue Mar 8 04:27:33 2022 +1000 powerpc/64: Bump SIGSTKSZ and MINSIGSTKSZ The sad tale of SIGSTKSZ and MINSIGSTKSZ is documented in glibc.git commit f7c399cff5bd ("PowerPC SIGSTKSZ"), which explains why glibc does not use the kernel defines for these constants. Since then in fact there has been a further expansion of the signal stack frame size on little-endian with linux commit 573ebfa6601f ("powerpc: Increase stack redzone for 64-bit userspace to 512 bytes"), which has caused it to exceed even the glibc defines. See kernel commit 63dee5df43a3 ("powerpc: Allow 4224 bytes of stack expansion for the signal frame") for more details of the history of the expansion. Increase MINSIGSTKSZ to 8192 which is double the current glibc value and fits the current stack frame with room to grow. SIGSTKSZ is set to 4x the minimum as convention. glibc will have to be updated as well. Reviewed-by: Tulio Magno Quites Machado Filho Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220307182734.289289-1-npiggin@gmail.com commit 4406b12214f6592909b63dabdea86d69f1b5ba2e Author: Nathan Chancellor Date: Wed May 11 11:50:01 2022 -0700 powerpc/vdso: Link with ld.lld when requested The PowerPC vDSO uses $(CC) to link, which differs from the rest of the kernel, which uses $(LD) directly. As a result, the default linker of the compiler is used, which may differ from the linker requested by the builder. For example: $ make ARCH=powerpc LLVM=1 mrproper defconfig arch/powerpc/kernel/vdso/ ... $ llvm-readelf -p .comment arch/powerpc/kernel/vdso/vdso{32,64}.so.dbg File: arch/powerpc/kernel/vdso/vdso32.so.dbg String dump of section '.comment': [ 0] clang version 14.0.0 (Fedora 14.0.0-1.fc37) File: arch/powerpc/kernel/vdso/vdso64.so.dbg String dump of section '.comment': [ 0] clang version 14.0.0 (Fedora 14.0.0-1.fc37) LLVM=1 sets LD=ld.lld but ld.lld is not used to link the vDSO; GNU ld is because "ld" is the default linker for clang on most Linux platforms. This is a problem for Clang's Link Time Optimization as implemented in the kernel because use of GNU ld with LTO requires the LLVMgold plugin, which is not technically supported for ld.bfd per https://llvm.org/docs/GoldPlugin.html. Furthermore, if LLVMgold.so is missing from a user's system, the build will fail, even though LTO as it is implemented in the kernel requires ld.lld to avoid this dependency in the first place. Ultimately, the PowerPC vDSO should be converted to compiling and linking with $(CC) and $(LD) respectively but there were issues last time this was tried, potentially due to older but supported tool versions. To avoid regressing GCC + binutils, use the compiler option '-fuse-ld', which tells the compiler which linker to use when it is invoked as both the compiler and linker. Use '-fuse-ld=lld' when LD=ld.lld has been specified (CONFIG_LD_IS_LLD) so that the vDSO is linked with the same linker as the rest of the kernel. $ llvm-readelf -p .comment arch/powerpc/kernel/vdso/vdso{32,64}.so.dbg File: arch/powerpc/kernel/vdso/vdso32.so.dbg String dump of section '.comment': [ 0] Linker: LLD 14.0.0 [ 14] clang version 14.0.0 (Fedora 14.0.0-1.fc37) File: arch/powerpc/kernel/vdso/vdso64.so.dbg String dump of section '.comment': [ 0] Linker: LLD 14.0.0 [ 14] clang version 14.0.0 (Fedora 14.0.0-1.fc37) LD can be a full path to ld.lld, which will not be handled properly by '-fuse-ld=lld' if the full path to ld.lld is outside of the compiler's search path. '-fuse-ld' can take a path to the linker but it is deprecated in clang 12.0.0; '--ld-path' is preferred for this scenario. Use '--ld-path' if it is supported, as it will handle a full path or just 'ld.lld' properly. See the LLVM commit below for the full details of '--ld-path'. Signed-off-by: Nathan Chancellor Tested-by: Alexey Kardashevskiy Reviewed-by: Nick Desaulniers Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://github.com/ClangBuiltLinux/linux/issues/774 Link: https://github.com/llvm/llvm-project/commit/1bc5c84710a8c73ef21295e63c19d10a8c71f2f5 Link: https://lore.kernel.org/r/20220511185001.3269404-3-nathan@kernel.org commit e247172854a57d1a7213bb835ecb4a40ce9bb2b9 Author: Nathan Chancellor Date: Wed May 11 11:50:00 2022 -0700 powerpc/vdso: Remove unused ENTRY in linker scripts When linking vdso{32,64}.so.dbg with ld.lld, there is a warning about not finding _start for the starting address: ld.lld: warning: cannot find entry symbol _start; not setting start address ld.lld: warning: cannot find entry symbol _start; not setting start address Looking at GCC + GNU ld, the entry point address is 0x0: $ llvm-readelf -h vdso{32,64}.so.dbg &| rg "(File|Entry point address):" File: vdso32.so.dbg Entry point address: 0x0 File: vdso64.so.dbg Entry point address: 0x0 This matches what ld.lld emits: $ powerpc64le-linux-gnu-readelf -p .comment vdso{32,64}.so.dbg File: vdso32.so.dbg String dump of section '.comment': [ 0] Linker: LLD 14.0.0 [ 14] clang version 14.0.0 (Fedora 14.0.0-1.fc37) File: vdso64.so.dbg String dump of section '.comment': [ 0] Linker: LLD 14.0.0 [ 14] clang version 14.0.0 (Fedora 14.0.0-1.fc37) $ llvm-readelf -h vdso{32,64}.so.dbg &| rg "(File|Entry point address):" File: vdso32.so.dbg Entry point address: 0x0 File: vdso64.so.dbg Entry point address: 0x0 Remove ENTRY to remove the warning, as it is unnecessary for the vDSO to function correctly. Signed-off-by: Nathan Chancellor Tested-by: Alexey Kardashevskiy Reviewed-by: Nick Desaulniers Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220511185001.3269404-2-nathan@kernel.org commit d9e5c3e9e75162f845880535957b7fd0b4637d23 Author: Kevin Hao Date: Tue Mar 29 16:57:09 2022 +0800 powerpc: Export mmu_feature_keys[] as non-GPL When the mmu_feature_keys[] was introduced in the commit c12e6f24d413 ("powerpc: Add option to use jump label for mmu_has_feature()"), it is unlikely that it would be used either directly or indirectly in the out of tree modules. So we exported it as GPL only. But with the evolution of the codes, especially the PPC_KUAP support, it may be indirectly referenced by some primitive macro or inline functions such as get_user() or __copy_from_user_inatomic(), this will make it impossible to build many non GPL modules (such as ZFS) on ppc architecture. Fix this by exposing the mmu_feature_keys[] to the non-GPL modules too. Fixes: 7613f5a66bec ("powerpc/64s/kuap: Use mmu_has_feature()") Reported-by: Nathaniel Filardo Signed-off-by: Kevin Hao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220329085709.4132729-1-haokexin@gmail.com commit e2aa34ce80a26d24a0333da9402d533885f239c9 Author: Guilherme G. Piccoli Date: Wed Apr 27 19:49:02 2022 -0300 powerpc/setup: Refactor/untangle panic notifiers The panic notifiers infrastructure is a bit limited in the scope of the callbacks - basically every kind of functionality is dropped in a list that runs in the same point during the kernel panic path. This is not really on par with the complexities and particularities of architecture / hypervisors' needs, and a refactor is ongoing. As part of this refactor, it was observed that powerpc has 2 notifiers, with mixed goals: one is just a KASLR offset dumper, whereas the other aims to hard-disable IRQs (necessary on panic path), warn firmware of the panic event (fadump) and run low-level platform-specific machinery that might stop kernel execution and never come back. Clearly, the 2nd notifier has opposed goals: disable IRQs / fadump should run earlier while low-level platform actions should run late since it might not even return. Hence, this patch decouples the notifiers splitting them in three: - First one is responsible for hard-disable IRQs and fadump, should run early; - The kernel KASLR offset dumper is really an informative notifier, harmless and may run at any moment in the panic path; - The last notifier should run last, since it aims to perform low-level actions for specific platforms, and might never return. It is also only registered for 2 platforms, pseries and ps3. The patch better documents the notifiers and clears the code too, also removing a useless header. Currently no functionality change should be observed, but after the planned panic refactor we should expect more panic reliability with this patch. Signed-off-by: Guilherme G. Piccoli Reviewed-by: Hari Bathini Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220427224924.592546-9-gpiccoli@igalia.com commit 2e1ccc6a75cc67ee00a79263442667709030ed28 Author: AngeloGioacchino Del Regno Date: Tue May 17 10:39:57 2022 +0200 pinctrl: mediatek: Add pinctrl driver for MT6795 Helio X10 Add support for the MediaTek Helio X10 (MT6795) SoC's GPIO/pinmux controller. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20220517083957.11816-3-angelogioacchino.delregno@collabora.com Signed-off-by: Linus Walleij commit 81557a71564a8c44ee5b9262d08438b0170a25f3 Author: AngeloGioacchino Del Regno Date: Tue May 17 10:39:56 2022 +0200 dt-bindings: pinctrl: Add MediaTek MT6795 pinctrl bindings Add devicetree and pinfunc bindings for MediaTek Helio X10 MT6795. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220517083957.11816-2-angelogioacchino.delregno@collabora.com Signed-off-by: Linus Walleij commit b104e41cda1ef9c5e851a7de3f30b53535e7d528 Merge: a5fc286f69fc9 ad55bae7dc364 Author: Michael Ellerman Date: Thu May 19 23:10:42 2022 +1000 Merge branch 'topic/ppc-kvm' into next Merge our KVM topic branch. commit fff65226b229a8c1155936cef781ade56ebbb902 Author: Jesse Taube Date: Mon May 16 23:27:59 2022 -0400 pinctrl: freescale: Add i.MXRT1170 pinctrl driver support Add the pinctrl driver support for i.MXRT1170. Cc: Giulio Benetti Signed-off-by: Jesse Taube Reviewed-by: Dong Aisheng Link: https://lore.kernel.org/r/20220517032802.451743-11-Mr.Bossman075@gmail.com Signed-off-by: Linus Walleij commit 0dfd7fc0e1d517581d4b157a5439265dcc249fd9 Author: Jesse Taube Date: Mon May 16 23:27:53 2022 -0400 dt-bindings: pinctrl: add i.MXRT1170 pinctrl Documentation Add i.MXRT1170 pinctrl binding Documentation Cc: Giulio Benetti Signed-off-by: Jesse Taube Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220517032802.451743-5-Mr.Bossman075@gmail.com Signed-off-by: Linus Walleij commit ed1f77b78322e22421935ff93e5d6dbf19e50c39 Author: Sebastian Reichel Date: Wed May 4 23:32:48 2022 +0200 dt-bindings: pinctrl: rockchip: increase max amount of device functions RK3588 can have 10 different device functions, so increase the maximum amount appropriately. Considering rockchip uses auto-generated pinmux files, adding a quite complex if construct to increase the limit just for rk3588 does not seem to be worth the effort. Signed-off-by: Sebastian Reichel Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220504213251.264819-19-sebastian.reichel@collabora.com Signed-off-by: Linus Walleij commit d31dcf1f008c8c1ce2e872b1cdb9ffec9e370a95 Author: Krzysztof Kozlowski Date: Sun May 8 15:59:29 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: add 'gpio-reserved-ranges' 'gpio-reserved-ranges' property is already used and supported by common pinctrl bindings, so add it also here to fix warnings like: qrb5165-rb5.dtb: gpio@c000: 'gpio-reserved-ranges' does not match any of the regexes: '-state$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220508135932.132378-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 58819949b8ec7322d0f67d14e5cb993ce8cd989b Author: Krzysztof Kozlowski Date: Sat May 7 21:49:06 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: add 'input-disable' 'input-disable' is already used and supported by common pinctrl bindings, so add it also here to fix warnings like: arch/arm64/boot/dts/qcom/qrb5165-rb5.dtb: gpio@c000: lt9611-rst-state: 'oneOf' conditional failed, one must be fixed: 'input-disable' does not match any of the regexes: 'pinctrl-[0-9]+' 'function', 'input-disable', 'output-high', 'pins', 'power-source' do not match any of the regexes: '(pinconf|-pins)$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220507194913.261121-5-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 04bed6407ee67f720660ea55fca7927e21d735d8 Author: Krzysztof Kozlowski Date: Sat May 7 21:49:05 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: describe gpio-line-names Add missing 'gpio-line-names' property and describe its constraints for all models except PM8226 (which seems not really used). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220507194913.261121-4-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 06367559766b7c9bd96d2baef8bfc5a9bb451e25 Author: Krzysztof Kozlowski Date: Sat May 7 21:49:04 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: fix matching pin config Matching PMIC GPIOs config nodes within a '-state' node by '.*' pattern does not work as expected because of linux,phandle in the DTB: arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon-cityman.dtb: gpios@c000: divclk4-state: 'oneOf' conditional failed, one must be fixed: 'pins' is a required property 'function' is a required property 'pinconf' does not match any of the regexes: 'pinctrl-[0-9]+' [[2]] is not of type 'object' Make the schema stricter and expect such nodes to be either named 'pinconfig' or followed with '-pins' prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220507194913.261121-3-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 2313623dd15b845968c99fb00ac6246609a4ea53 Author: Krzysztof Kozlowski Date: Sat May 7 21:49:03 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: document PM8150L and PMM8155AU Add missing compatibles for devices: PM8150L and PMM8155AU. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220507194913.261121-2-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit a249ca7dfbce1eb82bcd3a5a6bb21daeade20469 Author: Jan Kara Date: Thu May 19 12:52:32 2022 +0200 bfq: Remove bfq_requeue_request_body() The function has only a single caller and two lines. Just remove it since it is pointless and just harming readability. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220519105235.31397-4-jack@suse.cz Signed-off-by: Jens Axboe commit e79cf8892e332b9dafc99aef02189a2897eced24 Author: Jan Kara Date: Thu May 19 12:52:31 2022 +0200 bfq: Remove superfluous conversion from RQ_BIC() We store struct bfq_io_cq pointer in rq->elv.priv[0] in bfq_init_rq(). Thus a call to icq_to_bic() in RQ_BIC() is wrong. Luckily it does no harm currently because struct io_iq is the first one in struct bfq_io_cq. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220519105235.31397-3-jack@suse.cz Signed-off-by: Jens Axboe commit c5ac56bb6110e42e79d3106866658376b2e48ab9 Author: Jan Kara Date: Thu May 19 12:52:30 2022 +0200 bfq: Allow current waker to defend against a tentative one The code in bfq_check_waker() ignores wake up events from the current waker. This makes it more likely we select a new tentative waker although the current one is generating more wake up events. Treat current waker the same way as any other process and allow it to reset the waker detection logic. Fixes: 71217df39dc6 ("block, bfq: make waker-queue detection more robust") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220519105235.31397-2-jack@suse.cz Signed-off-by: Jens Axboe commit f950667356ce90a41b446b726d4595a10cb65415 Author: Jan Kara Date: Thu May 19 12:52:29 2022 +0200 bfq: Relax waker detection for shared queues Currently we look for waker only if current queue has no requests. This makes sense for bfq queues with a single process however for shared queues when there is a larger number of processes the condition that queue has no requests is difficult to meet because often at least one process has some request in flight although all the others are waiting for the waker to do the work and this harms throughput. Relax the "no queued request for bfq queue" condition to "the current task has no queued requests yet". For this, we also need to start tracking number of requests in flight for each task. This patch (together with the following one) restores the performance for dbench with 128 clients that regressed with commit c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") because this commit makes requests of wakers properly enter BFQ queues and thus these queues become ineligible for the old waker detection logic. Dbench results: Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%* Numbers are time to complete workload so lower is better. Fixes: c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220519105235.31397-1-jack@suse.cz Signed-off-by: Jens Axboe commit 4d8a768ef4ed80112ffaa13a677196faa9d651c3 Author: Marijn Suijten Date: Thu May 12 00:06:09 2022 +0200 pinctrl: qcom: spmi-gpio: Add pm6125 compatible The pm6125 has 9 GPIOs with no holes inbetween. Signed-off-by: Marijn Suijten Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220511220613.1015472-4-marijn.suijten@somainline.org Signed-off-by: Linus Walleij commit f82a2c212d6ce1e776a3fc8af6ce951ed00842b0 Author: Marijn Suijten Date: Thu May 12 00:06:08 2022 +0200 dt-bindings: pinctrl: qcom-pmic-gpio: Add pm6125 compatible The pm6125 comes with 9 GPIOs, without holes. Signed-off-by: Marijn Suijten Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220511220613.1015472-3-marijn.suijten@somainline.org Signed-off-by: Linus Walleij commit 5b3353949e89d48b4faf54a9cc241ee5d70df615 Author: Luca Miccio Date: Fri May 13 14:19:38 2022 -0700 xen: add support for initializing xenstore later as HVM domain When running as dom0less guest (HVM domain on ARM) the xenstore event channel is available at domain creation but the shared xenstore interface page only becomes available later on. In that case, wait for a notification on the xenstore event channel, then complete the xenstore initialization later, when the shared page is actually available. The xenstore page has few extra field. Add them to the shared struct. One of the field is "connection", when the connection is ready, it is zero. If the connection is not-zero, wait for a notification. Signed-off-by: Luca Miccio Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220513211938.719341-2-sstabellini@kernel.org Signed-off-by: Juergen Gross commit 62db0fafa8fc0f6c9f901e7eefdfc6bbd9731ec9 Author: Stefano Stabellini Date: Fri May 13 14:19:37 2022 -0700 xen: sync xs_wire.h header with upstream xen Sync the xs_wire.h header file in Linux with the one in Xen. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220513211938.719341-1-sstabellini@kernel.org Signed-off-by: Juergen Gross commit 1591a65f55bca5f7e14f9fbca4bd082dc8f4680f Author: Maximilian Heyne Date: Tue May 17 16:24:25 2022 +0000 x86: xen: remove STACK_FRAME_NON_STANDARD from xen_cpuid Since commit 4d65adfcd119 ("x86: xen: insn: Decode Xen and KVM emulate-prefix signature"), objtool is able to correctly parse the prefixed instruction in xen_cpuid and emit correct orc unwind information. Hence, marking the function as STACKFRAME_NON_STANDARD is no longer needed. This commit is basically a revert of commit 983bb6d254c7 ("x86/xen: Mark xen_cpuid() stack frame as non-standard"). Signed-off-by: Maximilian Heyne Reviewed-by: Juergen Gross CC: Josh Poimboeuf Link: https://lore.kernel.org/r/20220517162425.100567-1-mheyne@amazon.de Signed-off-by: Juergen Gross commit 12f112c3e3e573a833010ef2e4469295ac7b6e82 Author: SeongJae Park Date: Wed Apr 20 07:27:34 2022 +0000 xen-blk{back,front}: Update contact points for buffer_squeeze_duration_ms and feature_persistent SeongJae is currently listed as a contact point for some blk{back,front} features, but he will not work for XEN for a while. This commit therefore updates the contact point to his colleague, Maximilian, who is understanding the context and actively working with the features now. Signed-off-by: SeongJae Park Signed-off-by: Maximilian Heyne Acked-by: Roger Pau Monné Link: https://lore.kernel.org/r/20220420072734.1692-1-sj@kernel.org Signed-off-by: Juergen Gross commit 68f4c6eba70df70a720188bce95c85570ddfcc87 Author: Zhihao Cheng Date: Tue May 10 21:38:05 2022 +0800 fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages Commit 505a666ee3fc ("writeback: plug writeback in wb_writeback() and writeback_inodes_wb()") has us holding a plug during wb_writeback, which may cause a potential ABBA dead lock: wb_writeback fat_file_fsync blk_start_plug(&plug) for (;;) { iter i-1: some reqs have been added into plug->mq_list // LOCK A iter i: progress = __writeback_inodes_wb(wb, work) . writeback_sb_inodes // fat's bdev . __writeback_single_inode . . generic_writepages . . __block_write_full_page . . . . __generic_file_fsync . . . . sync_inode_metadata . . . . writeback_single_inode . . . . __writeback_single_inode . . . . fat_write_inode . . . . __fat_write_inode . . . . sync_dirty_buffer // fat's bdev . . . . lock_buffer(bh) // LOCK B . . . . submit_bh . . . . blk_mq_get_tag // LOCK A . . . trylock_buffer(bh) // LOCK B . . . redirty_page_for_writepage . . . wbc->pages_skipped++ . . --wbc->nr_to_write . wrote += write_chunk - wbc.nr_to_write // wrote > 0 . requeue_inode . redirty_tail_locked if (progress) // progress > 0 continue; iter i+1: queue_io // similar process with iter i, infinite for-loop ! } blk_finish_plug(&plug) // flush plug won't be called Above process triggers a hungtask like: [ 399.044861] INFO: task bb:2607 blocked for more than 30 seconds. [ 399.046824] Not tainted 5.18.0-rc1-00005-gefae4d9eb6a2-dirty [ 399.051539] task:bb state:D stack: 0 pid: 2607 ppid: 2426 flags:0x00004000 [ 399.051556] Call Trace: [ 399.051570] __schedule+0x480/0x1050 [ 399.051592] schedule+0x92/0x1a0 [ 399.051602] io_schedule+0x22/0x50 [ 399.051613] blk_mq_get_tag+0x1d3/0x3c0 [ 399.051640] __blk_mq_alloc_requests+0x21d/0x3f0 [ 399.051657] blk_mq_submit_bio+0x68d/0xca0 [ 399.051674] __submit_bio+0x1b5/0x2d0 [ 399.051708] submit_bio_noacct+0x34e/0x720 [ 399.051718] submit_bio+0x3b/0x150 [ 399.051725] submit_bh_wbc+0x161/0x230 [ 399.051734] __sync_dirty_buffer+0xd1/0x420 [ 399.051744] sync_dirty_buffer+0x17/0x20 [ 399.051750] __fat_write_inode+0x289/0x310 [ 399.051766] fat_write_inode+0x2a/0xa0 [ 399.051783] __writeback_single_inode+0x53c/0x6f0 [ 399.051795] writeback_single_inode+0x145/0x200 [ 399.051803] sync_inode_metadata+0x45/0x70 [ 399.051856] __generic_file_fsync+0xa3/0x150 [ 399.051880] fat_file_fsync+0x1d/0x80 [ 399.051895] vfs_fsync_range+0x40/0xb0 [ 399.051929] __x64_sys_fsync+0x18/0x30 In my test, 'need_resched()' (which is imported by 590dca3a71 "fs-writeback: unplug before cond_resched in writeback_sb_inodes") in function 'writeback_sb_inodes()' seldom comes true, unless cond_resched() is deleted from write_cache_pages(). Fix it by correcting wrote number according number of skipped pages in writeback_sb_inodes(). Goto Link to find a reproducer. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215837 Cc: stable@vger.kernel.org # v4.3 Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220510133805.1988292-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe commit 4573240f0764ee79d7558d74fc535baa1e110d20 Author: Juergen Gross Date: Thu Apr 28 09:01:05 2022 +0200 xen/xenbus: eliminate xenbus_grant_ring() There is no external user of xenbus_grant_ring() left, so merge it into the only caller xenbus_setup_ring(). Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 360dc89d12404384519b43e4a5ad5e94f2c8394f Author: Juergen Gross Date: Thu Apr 28 09:01:05 2022 +0200 xen/sndfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify sndfront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Signed-off-by: Juergen Gross commit 2b3daf083aa8297c737c8cd8f896596d509ead35 Author: Juergen Gross Date: Thu Apr 28 09:01:05 2022 +0200 xen/usbfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify xen-hcd's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Acked-by: Greg Kroah-Hartman Signed-off-by: Juergen Gross commit caa427d252031e2f97228a474ff320fdc54171af Author: Juergen Gross Date: Thu Apr 28 09:01:04 2022 +0200 xen/scsifront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify scsifront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 0e6b139dbda9e11fefa84c3e4a3e24dd9dc55bcb Author: Juergen Gross Date: Thu Apr 28 09:01:04 2022 +0200 xen/pcifront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify pcifront's shared page creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit ae19265ca3eeb6cd8098773da2514ed53a6bd350 Author: Juergen Gross Date: Thu Apr 28 09:01:04 2022 +0200 xen/drmfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify drmfront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Signed-off-by: Juergen Gross commit 5e0afd8eab96486c13194fa9cbcf5fe320ac8d6b Author: Juergen Gross Date: Thu Apr 28 09:01:04 2022 +0200 xen/tpmfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify tpmfront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(), which are provided exactly for the use pattern as seen in this driver. Signed-off-by: Juergen Gross commit 46e20d43f579f39677835bf8e72c95182b3b4016 Author: Juergen Gross Date: Thu Apr 28 09:01:03 2022 +0200 xen/netfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify netfront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 47cbd5983347d41b1c41a632b1e45a660a351c68 Author: Juergen Gross Date: Thu Apr 28 09:01:03 2022 +0200 xen/blkfront: use xenbus_setup_ring() and xenbus_teardown_ring() Simplify blkfront's ring creation and removal via xenbus_setup_ring() and xenbus_teardown_ring(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 7050096d07755c53f71e486af18475050cc4e04b Author: Juergen Gross Date: Thu Apr 28 09:01:03 2022 +0200 xen/xenbus: add xenbus_setup_ring() service function Most PV device frontends share very similar code for setting up shared ring buffers: - allocate page(s) - init the ring admin data - give the backend access to the ring via grants Tearing down the ring requires similar actions in all frontends again: - remove grants - free the page(s) Provide service functions xenbus_setup_ring() and xenbus_teardown_ring() for that purpose. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 6fac592cca60dca0b2a524c303c83e958c2003bb Author: Juergen Gross Date: Thu Apr 28 09:59:01 2022 +0200 xen: update ring.h Update include/xen/interface/io/ring.h to its newest version. Switch the two improper use cases of RING_HAS_UNCONSUMED_RESPONSES() to XEN_RING_NR_UNCONSUMED_RESPONSES() in order to avoid the nasty XEN_RING_HAS_UNCONSUMED_IS_BOOL #define. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 888fd787f30dfe959fdd685c422187a428d2cf17 Author: Juergen Gross Date: Thu Apr 28 09:01:03 2022 +0200 xen/shbuf: switch xen-front-pgdir-shbuf to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Signed-off-by: Juergen Gross commit bd506c781207a52b0e212818d312d22e64db5cff Author: Juergen Gross Date: Thu Apr 28 09:01:03 2022 +0200 xen/dmabuf: switch gntdev-dmabuf to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 297ce02669676517d2bfaa57995007b989d88524 Author: Juergen Gross Date: Thu Apr 28 09:01:02 2022 +0200 xen/sound: switch xen_snd_front to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Signed-off-by: Juergen Gross commit cb5216319be122c671f2c86633b6fc47f4d7fa02 Author: Juergen Gross Date: Thu Apr 28 09:01:02 2022 +0200 xen/drm: switch xen_drm_front to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 only Signed-off-by: Juergen Gross commit edd81e7caa77a2772bb9ddb8562e2d45aeed2cc1 Author: Juergen Gross Date: Thu Apr 28 09:01:02 2022 +0200 xen/usb: switch xen-hcd to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Acked-by: Greg Kroah-Hartman Signed-off-by: Juergen Gross commit 70920be6ff0d7abe92311a678cb6c84fcec658ca Author: Juergen Gross Date: Thu Apr 28 09:01:02 2022 +0200 xen/scsifront: remove unused GRANT_INVALID_REF definition GRANT_INVALID_REF isn't used in scsifront, so remove it. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 145daab239a1a8e3fe4d7ed0f5d2ad651219d54d Author: Juergen Gross Date: Thu Apr 28 09:01:01 2022 +0200 xen/netfront: switch netfront to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 21b539711a404da1b23d6ebddd9c3c321ccdfe49 Author: Juergen Gross Date: Thu Apr 28 09:01:01 2022 +0200 xen/blkfront: switch blkfront to use INVALID_GRANT_REF Instead of using a private macro for an invalid grant reference use the common one. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 8c9eb0e3731d7140abc77cd80aeeeea8c2ff325e Author: Juergen Gross Date: Thu May 5 08:35:31 2022 +0200 xen/grant-table: never put a reserved grant on the free list Make sure a reserved grant is never put on the free list, as this could cause hard to debug errors. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 79c22318f89f3e6cafeabddd5894cad13c7e5957 Author: Juergen Gross Date: Thu May 5 08:49:52 2022 +0200 xen: update grant_table.h Update include/xen/interface/grant_table.h to its newest version. This allows to drop some private definitions in grant-table.c and include/xen/grant_table.h. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Author: Juergen Gross Date: Thu Apr 28 09:53:23 2022 +0200 xen/scsifront: harden driver against malicious backend Instead of relying on a well behaved PV scsi backend verify all meta data received from the backend and avoid multiple reads of the same data from the shared ring page. In case any illegal data from the backend is detected switch the PV device to a new "error" state and deactivate it for further use. Use the "lateeoi" variant for the event channel in order to avoid event storms blocking the guest. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220428075323.12853-5-jgross@suse.com Signed-off-by: Juergen Gross commit a2f6751d5af44d8c1cab93c2c410fd334c460339 Author: Juergen Gross Date: Thu Apr 28 09:53:22 2022 +0200 xen/scsifront: use new command result macros Add a translation layer for the command result values. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220428075323.12853-4-jgross@suse.com Signed-off-by: Juergen Gross commit 54aee68bb656ab0daf46c88423948dadd903a68e Author: Juergen Gross Date: Thu Apr 28 09:53:21 2022 +0200 xen/scsiback: use new command result macros Instead of using the kernel's values for the result of PV scsi operations use the values of the interface definition. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220428075323.12853-3-jgross@suse.com Signed-off-by: Juergen Gross commit 5ce9231c5b961596ebf948777c9c5a6981f067d9 Author: Juergen Gross Date: Thu Apr 28 09:53:20 2022 +0200 xen: update vscsiif.h Update include/xen/interface/io/vscsiif.h to its newest version. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220428075323.12853-2-jgross@suse.com Signed-off-by: Juergen Gross commit aeb84412037b89e06f45e382f044da6f200e12f8 Author: Kees Cook Date: Sun Feb 27 11:59:18 2022 -0800 x86/boot: Wrap literal addresses in absolute_pointer() GCC 11 (incorrectly[1]) assumes that literal values cast to (void *) should be treated like a NULL pointer with an offset, and raises diagnostics when doing bounds checking under -Warray-bounds. GCC 12 got "smarter" about finding these: In function 'rdfs8', inlined from 'vga_recalc_vertical' at /srv/code/arch/x86/boot/video-mode.c:124:29, inlined from 'set_mode' at /srv/code/arch/x86/boot/video-mode.c:163:3: /srv/code/arch/x86/boot/boot.h:114:9: warning: array subscript 0 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds] 114 | asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); | ^~~ This has been solved in other places[2] already by using the recently added absolute_pointer() macro. Do the same here. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 [2] https://lore.kernel.org/all/20210912160149.2227137-1-linux@roeck-us.net/ Signed-off-by: Kees Cook Signed-off-by: Borislav Petkov Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220227195918.705219-1-keescook@chromium.org commit c1318b39c7d36bd5139a9c71044ff2b2d3c6f9d8 Author: Boris Pismenny Date: Wed May 18 12:27:31 2022 +0300 tls: Add opt-in zerocopy mode of sendfile() TLS device offload copies sendfile data to a bounce buffer before transmitting. It allows to maintain the valid MAC on TLS records when the file contents change and a part of TLS record has to be retransmitted on TCP level. In many common use cases (like serving static files over HTTPS) the file contents are not changed on the fly. In many use cases breaking the connection is totally acceptable if the file is changed during transmission, because it would be received corrupted in any case. This commit allows to optimize performance for such use cases to providing a new optional mode of TLS sendfile(), in which the extra copy is skipped. Removing this copy improves performance significantly, as TLS and TCP sendfile perform the same operations, and the only overhead is TLS header/trailer insertion. The new mode can only be enabled with the new socket option named TLS_TX_ZEROCOPY_SENDFILE on per-socket basis. It preserves backwards compatibility with existing applications that rely on the copying behavior. The new mode is safe, meaning that unsolicited modifications of the file being sent can't break integrity of the kernel. The worst thing that can happen is sending a corrupted TLS record, which is in any case not forbidden when using regular TCP sockets. Sockets other than TLS device offload are not affected by the new socket option. The actual status of zerocopy sendfile can be queried with sock_diag. Performance numbers in a single-core test with 24 HTTPS streams on nginx, under 100% CPU load: * non-zerocopy: 33.6 Gbit/s * zerocopy: 79.92 Gbit/s CPU: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz Signed-off-by: Boris Pismenny Signed-off-by: Tariq Toukan Signed-off-by: Maxim Mikityanskiy Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20220518092731.1243494-1-maximmi@nvidia.com Signed-off-by: Paolo Abeni commit ffcb2fc86eb7ebc9f5524525fb57e1cccfbd1fc0 Author: Keerthy Date: Tue May 17 22:59:20 2022 +0530 thermal: k3_j72xx_bandgap: Add the bandgap driver support Add VTM thermal support. In the Voltage Thermal Management Module(VTM), K3 J72XX supplies a voltage reference and a temperature sensor feature that are gathered in the band gap voltage and temperature sensor (VBGAPTS) module. The band gap provides current and voltage reference for its internal circuits and other analog IP blocks. The analog-to-digital converter (ADC) produces an output value that is proportional to the silicon temperature. Currently reading temperatures only is supported. There are no active/passive cooling agent supported. J721e SoCs have errata i2128: https://www.ti.com/lit/pdf/sprz455 The VTM Temperature Monitors (TEMPSENSORs) are trimmed during production, with the resulting values stored in software-readable registers. Software should use these register values when translating the Temperature Monitor output codes to temperature values. It has an involved workaround. Software needs to read the error codes for -40C, 30C, 125C from the efuse for each device & derive a new look up table for adc to temperature conversion. Involved calculating slopes & constants using 3 different straight line equations with adc refernce codes as the y-axis & error codes in the x-axis. -40C to 30C 30C to 125C 125C to 150C With the above 2 line equations we derive the full look-up table to workaround the errata i2128 for j721e SoC. Tested temperature reading on J721e SoC & J7200 SoC. [daniel.lezcano@linaro.org: Generate look-up tables run-time] Signed-off-by: Daniel Lezcano Signed-off-by: Keerthy Link: https://lore.kernel.org/r/20220517172920.10857-3-j-keerthy@ti.com Signed-off-by: Daniel Lezcano commit 031c2952d1588d47829da3639eaaa5e35ffe4e6e Author: Keerthy Date: Tue May 17 22:59:19 2022 +0530 dt-bindings: thermal: k3-j72xx: Add VTM bindings documentation Add VTM bindings documentation. In the Voltage Thermal Management Module(VTM), K3 J72XX supplies a voltage reference and a temperature sensor feature that are gathered in the band gap voltage and temperature sensor (VBGAPTS) module. The band gap provides current and voltage reference for its internal circuits and other analog IP blocks. The analog-to-digital converter (ADC) produces an output value that is proportional to the silicon temperature. Signed-off-by: Keerthy Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220517172920.10857-2-j-keerthy@ti.com Signed-off-by: Daniel Lezcano commit 09700c504d8e63faffd2a2235074e8c5d130cb8f Author: Miaoqian Lin Date: Tue May 17 09:51:21 2022 +0400 thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: e20db70dba1c ("thermal: imx_sc: add i.MX system controller thermal support") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220517055121.18092-1-linmq006@gmail.com Signed-off-by: Daniel Lezcano commit 98a160e898c0f4a979af9de3ab48b4b1d42d1dbb Author: Yang Yingliang Date: Wed May 11 10:06:05 2022 +0800 thermal/core: Fix memory leak in __thermal_cooling_device_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888010080000 (size 264312): comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@....... backtrace: [<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969 [<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510 [<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586 [<00000000352b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927 [<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041 [<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211 [<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561 If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs(). Fixes: 8ea229511e06 ("thermal: Add cooling device's statistics in sysfs") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220511020605.3096734-1-yangyingliang@huawei.com Signed-off-by: Daniel Lezcano commit 30988d3b31b1e8972f202e93574978927b5c9d06 Author: Bjorn Andersson Date: Tue May 3 08:34:36 2022 -0700 dt-bindings: thermal: tsens: Add sc8280xp compatible The Qualcomm SC8280XP platform has three instances of the tsens block, add a compatible for these instances. Acked-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220503153436.960184-1-bjorn.andersson@linaro.org Signed-off-by: Daniel Lezcano commit b54d4dafc9fd97f1739eb06dd5a397ce69bbe00c Author: Bjorn Andersson Date: Mon May 2 09:45:04 2022 -0700 dt-bindings: thermal: lmh: Add Qualcomm sc8180x compatible Add compatible for the LMh blocks found in the Qualcomm sc8180x platform. Signed-off-by: Bjorn Andersson Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220502164504.3972938-2-bjorn.andersson@linaro.org Signed-off-by: Daniel Lezcano commit ef6673e8363a61ef941bae05c7913a32a104e20b Author: Bjorn Andersson Date: Mon May 2 09:45:03 2022 -0700 thermal/drivers/qcom/lmh: Add sc8180x compatible The LMh instances in the Qualcomm SC8180X platform looks to behave similar to those in SM8150, add additional compatibles to allow platform specific behavior to be added if needed. Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220502164504.3972938-1-bjorn.andersson@linaro.org Signed-off-by: Daniel Lezcano commit 2d37f5c90bdc659b329dac7cf6d165a4bbf34cb6 Author: Biju Das Date: Thu Apr 28 10:33:46 2022 +0100 thermal/drivers/rz2gl: Fix OTP Calibration Register values As per the latest RZ/G2L Hardware User's Manual (Rev.1.10 Apr, 2022), the bit 31 of TSU OTP Calibration Register(OTPTSUTRIM) indicates whether bit [11:0] of OTPTSUTRIM is valid or invalid. This patch updates the code to reflect this change. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220428093346.7552-1-biju.das.jz@bp.renesas.com Signed-off-by: Daniel Lezcano commit e126ce0bcc082382497219c323e1b941583c9036 Author: Biju Das Date: Sun May 1 09:19:30 2022 +0100 dt-bindings: thermal: rzg2l-thermal: Document RZ/G2UL bindings Document RZ/G2UL TSU bindings. The TSU block on RZ/G2UL is identical to one found on RZ/G2L SoC. No driver changes are required as generic compatible string "renesas,rzg2l-tsu" will be used as a fallback. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220501081930.23743-1-biju.das.jz@bp.renesas.com Signed-off-by: Daniel Lezcano commit 44b965d8c44e8e86a43e11fc46adfc60da540c77 Author: Corentin Labbe Date: Tue Apr 26 06:41:13 2022 +0000 thermal: thermal_of: fix typo on __thermal_bind_params Add a missing s to __thermal_bind_param kernel doc comment. This fixes the following sparse warnings: drivers/thermal/thermal_of.c:50: warning: expecting prototype for struct __thermal_bind_param. Prototype was for struct __thermal_bind_params instead Signed-off-by: Corentin Labbe Link: https://lore.kernel.org/r/20220426064113.3787826-1-clabbe@baylibre.com Signed-off-by: Daniel Lezcano commit cb4487d2b4043bbe98f60f2628387b40fa4896f8 Author: Jiapeng Chong Date: Wed Apr 27 11:06:19 2022 +0800 tools/thermal: remove unneeded semicolon Fix the following coccicheck warnings: ./tools/thermal/thermometer/thermometer.c:147:3-4: Unneeded semicolon. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20220427030619.81556-2-jiapeng.chong@linux.alibaba.com Signed-off-by: Daniel Lezcano commit f21b57eb12bfe0d38794145f976ca8127d8846db Author: Jiapeng Chong Date: Wed Apr 27 11:06:18 2022 +0800 tools/lib/thermal: remove unneeded semicolon Fix the following coccicheck warnings: ./tools/lib/thermal/commands.c:215:2-3: Unneeded semicolon. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20220427030619.81556-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Daniel Lezcano commit e20d136ec7d6f309989c447638365840d3424c8e Author: Zheng Yongjun Date: Mon Apr 25 09:29:29 2022 +0000 thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing. Fixes: 250e211057c72 ("thermal: broadcom: Add Stingray thermal driver") Signed-off-by: Zheng Yongjun Link: https://lore.kernel.org/r/20220425092929.90412-1-zhengyongjun3@huawei.com Signed-off-by: Daniel Lezcano commit 077df623c8344e4b50a7ba6c433f9d6857a94d6b Author: Daniel Lezcano Date: Wed Apr 20 18:09:32 2022 +0200 tools/thermal: Add thermal daemon skeleton This change provides a simple daemon skeleton. It is an example of how to use the thermal library which wraps all the complex code related to the netlink and transforms it into a callback oriented code. The goal of this skeleton is to give a base brick for anyone interested in writing its own thermal engine or as an example to rely on to write its own thermal monitoring implementation. In the future, it will evolve with more features and hopefully more logic. Signed-off-by: Daniel Lezcano Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20220420160933.347088-5-daniel.lezcano@linaro.org commit 110acbc6a4518145db3a1a9c0686d730bb258bf1 Author: Daniel Lezcano Date: Wed Apr 20 18:09:31 2022 +0200 tools/thermal: Add a temperature capture tool The 'thermometer' tool allows to capture the temperature of a set of thermal zones defined in a configuration file at a specified rate. It is designed to have the lowest possible overhead. It will write the captured temperature per thermal zone per file so making easier to write a gnuplot script. Signed-off-by: Daniel Lezcano Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20220420160933.347088-4-daniel.lezcano@linaro.org commit 3b7c5e8adf9ca64f8dd70279076de085ea6369d7 Author: Daniel Lezcano Date: Wed Apr 20 18:09:30 2022 +0200 tools/thermal: Add util library The next changes will provide a couple of tools using some common functions provided by this library. It provides basic wrappers for: - mainloop - logging - timestamp Signed-off-by: Daniel Lezcano Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20220420160933.347088-3-daniel.lezcano@linaro.org commit 47c4b0de080adc125526aa80221c4e3ffbf97b6d Author: Daniel Lezcano Date: Wed Apr 20 18:09:29 2022 +0200 tools/lib/thermal: Add a thermal library The thermal framework implements a netlink notification mechanism to be used by the userspace to have a thermal configuration discovery, trip point changes or violation, cooling device changes notifications, etc... This library provides a level of abstraction for the thermal netlink notification allowing the userspace to connect to the notification mechanism more easily. The library is callback oriented. Signed-off-by: Daniel Lezcano Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20220420160933.347088-2-daniel.lezcano@linaro.org commit bf70c577516b8d9fbe703371aa98bbea13661cec Author: Manaf Meethalavalappu Pallikunhi Date: Wed Mar 9 00:56:26 2022 +0530 thermal/drivers/thermal_of: Add change_mode ops support for thermal_of sensor The sensor driver which register through thermal_of interface doesn't have an option to get thermal zone mode change notification from thermal core. Add support for change_mode ops in thermal_of interface so that sensor driver can use this ops for mode change notification. Signed-off-by: Manaf Meethalavalappu Pallikunhi Link: https://lore.kernel.org/r/1646767586-31908-1-git-send-email-quic_manafm@quicinc.com Signed-off-by: Daniel Lezcano commit 106e0121e243de4da7d634338089a68a8da2abe9 Author: Stefan Wahren Date: Tue Apr 12 21:54:23 2022 +0200 thermal/drivers/bcm2711: Don't clamp temperature at zero The thermal sensor on BCM2711 is capable of negative temperatures, so don't clamp the measurements at zero. Since this was the only use for variable t, drop it. This change based on a patch by Dom Cobley, who also tested the fix. Fixes: 59b781352dc4 ("thermal: Add BCM2711 thermal driver") Signed-off-by: Stefan Wahren Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220412195423.104511-1-stefan.wahren@i2se.com Signed-off-by: Daniel Lezcano commit 2caf73969de6675318a711d0622406c8c66afc03 Author: Dmitry Baryshkov Date: Wed Apr 6 03:26:46 2022 +0300 thermal/drivers/tsens: Add compat string for the qcom,msm8960 On apq8064 (msm8960) platforms the tsens device is created manually by the gcc driver. Prepare the tsens driver for the qcom,msm8960-tsens device instantiated from the device tree. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220406002648.393486-3-dmitry.baryshkov@linaro.org Signed-off-by: Daniel Lezcano commit a63fa2b601f10fe6a393504a4959ddb04acdc91b Author: Dmitry Baryshkov Date: Wed Apr 6 03:26:45 2022 +0300 dt-bindings: thermal: qcom-tsens.yaml: add msm8960 compat string Add compatibility string for the thermal sensors on MSM8960/APQ8064 platforms. Signed-off-by: Dmitry Baryshkov Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220406002648.393486-2-dmitry.baryshkov@linaro.org Signed-off-by: Daniel Lezcano commit 9e5f5f15fef5efd6847b8802e509b67fce72e2fb Author: Massimiliano Minella Date: Fri Apr 1 17:13:51 2022 +0200 thermal/drivers/k3: Add hwmon support Expose the thermal sensors on K3 AM654 as hwmon devices, so that temperatures could be read using lm-sensors. Signed-off-by: Massimiliano Minella Link: https://lore.kernel.org/r/20220401151656.913166-1-massimiliano.minella@se.com Signed-off-by: Daniel Lezcano commit 96f6f333bcf082756a01a7dc5cc7d4898e11b31b Author: Jishnu Prakash Date: Sun Apr 3 18:47:49 2022 +0530 thermal/drivers/qcom: Add support for PMIC5 Gen2 ADCTM Add support for PMIC5 Gen2 ADC_TM, used on PMIC7 chips. It is a close counterpart of PMIC7 ADC and has the same functionality as PMIC5 ADC_TM, for threshold monitoring and interrupt generation. It is present on PMK8350 alone, like PMIC7 ADC and can be used to monitor up to 8 ADC channels, from any of the PMIC7 PMICs having ADC on a target, through PBS(Programmable Boot Sequence). Signed-off-by: Jishnu Prakash Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/1648991869-20899-5-git-send-email-quic_jprakash@quicinc.com Signed-off-by: Daniel Lezcano commit 7e70a89a3a08c515fe7e64ef3200d31faaf8d5ac Author: Jishnu Prakash Date: Sun Apr 3 18:47:48 2022 +0530 thermal/drivers/qcom: Add support for multiple generations of devices Refactor code to support multiple generations of ADC_TM devices by defining gen number, irq name and disable, configure, isr and init APIs in the individual data structs. Signed-off-by: Jishnu Prakash Reviewed-by: Jonathan Cameron Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/1648991869-20899-4-git-send-email-quic_jprakash@quicinc.com Signed-off-by: Daniel Lezcano commit 238e34ad7d5ce36939ac1442c98c7cbb7771f4de Author: Jishnu Prakash Date: Sun Apr 3 18:47:47 2022 +0530 iio: adc: qcom-vadc-common: add reverse scaling for PMIC5 Gen2 ADC_TM Add reverse scaling function for PMIC5 Gen2 ADC_TM, to convert temperature to raw ADC code, for setting thresholds for thermistor channels. Signed-off-by: Jishnu Prakash Acked-by: Jonathan Cameron Link: https://lore.kernel.org/r/1648991869-20899-3-git-send-email-quic_jprakash@quicinc.com Signed-off-by: Daniel Lezcano commit e46e003a4897385886f932013673ecfd317c8156 Author: Jishnu Prakash Date: Sun Apr 3 18:47:46 2022 +0530 dt-bindings: thermal: qcom: add PMIC5 Gen2 ADC_TM bindings Add documentation for PMIC5 Gen2 ADC_TM peripheral. It is used for monitoring ADC channel thresholds for PMIC7-type PMICs. It is present on PMK8350, like PMIC7 ADC and can be used to monitor up to 8 ADC channels, from any of the PMIC7 PMICs on a target, through PBS(Programmable Boot Sequence). Signed-off-by: Jishnu Prakash Reviewed-by: Jonathan Cameron Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/1648991869-20899-2-git-send-email-quic_jprakash@quicinc.com Signed-off-by: Daniel Lezcano commit 3277e022a1c31f5041753942b3d9006174ca7aa2 Author: Lad Prabhakar Date: Mon Jan 10 14:40:39 2022 +0000 thermal/drivers/rcar_thermal: Use platform_get_irq_optional() to get the interrupt platform_get_resource(pdev, IORESOURCE_IRQ, ..) relies on static allocation of IRQ resources in DT core code, this causes an issue when using hierarchical interrupt domains using "interrupts" property in the node as this bypasses the hierarchical setup and messes up the irq chaining. In preparation for removal of static setup of IRQ resource from DT core code use platform_get_irq_optional(). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220110144039.5810-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Daniel Lezcano commit feef7f32521eb169d7bcbb80291fc78bd39edb97 Author: Lad Prabhakar Date: Tue Mar 8 21:23:15 2022 +0000 dt-bindings: thermal: rzg2l-thermal: Document RZ/V2L bindings Document RZ/V2L TSU bindings. The TSU block on RZ/V2L is identical to one found on RZ/G2L SoC. No driver changes are required as generic compatible string "renesas,rzg2l-tsu" will be used as a fallback. Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220308212315.4551-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Daniel Lezcano commit b520cbe5be37b1b9b401c0b6ecbdae32575273db Author: Miaoqian Lin Date: Sun Apr 3 05:49:12 2022 +0000 rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe In the error handling path, the clk_prepare_enable() function call should be balanced by a corresponding 'clk_disable_unprepare()' call , as already done in the remove function. clk_disable_unprepare calls clk_disable() and clk_unprepare(). They will use IS_ERR_OR_NULL to check the argument. Fixes: ac05fba39cc5 ("rtc: gemini: Add optional clock handling") Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220403054912.31739-1-linmq006@gmail.com commit d3b43eb505bffb8e4cdf6800c15660c001553fe6 Author: Yang Yingliang Date: Thu May 5 20:50:43 2022 +0800 rtc: mt6397: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Fixes: fc2979118f3f ("rtc: mediatek: Add MT6397 RTC driver") Signed-off-by: Yang Yingliang Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220505125043.1594771-1-yangyingliang@huawei.com commit 069617295650ec2ba27a8f22da10056d3e1160b3 Author: Borislav Petkov Date: Wed May 18 14:33:15 2022 +0300 drm/i915/uc: Fix undefined behavior due to shift overflowing the constant Fix: In file included from :0:0: drivers/gpu/drm/i915/gt/uc/intel_guc.c: In function ‘intel_guc_send_mmio’: ././include/linux/compiler_types.h:352:38: error: call to ‘__compiletime_assert_1047’ \ declared with attribute error: FIELD_PREP: mask is not constant _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) and other build errors due to shift overflowing values. See https://lore.kernel.org/r/YkwQ6%2BtIH8GQpuct@zn.tnic for the gory details as to why it triggers with older gccs only. v2 by Jani: - Drop the i915_reg.h changes Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Cc: Ruiqi GONG Cc: Randy Dunlap Signed-off-by: Borislav Petkov Signed-off-by: Jani Nikula Reviewed-by: Michal Wajdeczko Link: https://patchwork.freedesktop.org/patch/msgid/20220518113315.1305027-2-jani.nikula@intel.com (cherry picked from commit 962bd34bb457f6353f333ce234c3fd34cad1c00a) commit 416e07a84f6ed883e0abd68c2fb868c80eea887b Author: Jani Nikula Date: Wed May 18 14:33:14 2022 +0300 drm/i915/reg: fix undefined behavior due to shift overflowing the constant Use REG_GENMASK() and REG_FIELD_PREP() to avoid errors due to -fsanitize=shift. References: https://lore.kernel.org/r/20220405151517.29753-12-bp@alien8.de Reported-by: Borislav Petkov Reported-by: Ruiqi GONG Cc: Randy Dunlap Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220518113315.1305027-1-jani.nikula@intel.com (cherry picked from commit 230fb39ff7e07bd0324c87acf08dd2c9b0bbcea8) commit 183f815d426b22c4424958403b096aebf3b060ca Author: Andi Shyti Date: Tue May 10 16:04:47 2022 +0200 drm/i915/gt: Fix use of static in macro mismatch The INTEL_GT_RPS_SYSFS_ATTR was creating to different structures but. When called with the "static" keyword this is affecting only the first structure, while the second is created as non static. Move the static keyword inside the macros to affect both the structures. Reported-by: Jani Nikula Fixes: 56a709cf77468 ("drm/i915/gt: Create per-tile RPS sysfs interfaces") Signed-off-by: Andi Shyti Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220510140447.80200-1-andi.shyti@linux.intel.com (cherry picked from commit 1ade30812abfdd1c161a155fd54b0dd594c217ee) Signed-off-by: Jani Nikula commit d91e9be0f0b05fd4df783d18d090c78ebd99f153 Author: Jani Nikula Date: Thu May 12 19:16:38 2022 +0300 drm/i915/audio: fix audio code enable/disable pipe logging Need to use pipe_name(pipe) instead of pipe directly. Fixes: 1f31e35f2e88 ("drm/i915/audio: unify audio codec enable/disable debug logging") Cc: Ville Syrjälä Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220512161638.272601-1-jani.nikula@intel.com (cherry picked from commit 945ae909aa76f55ac8c9e95feb3683512d39134a) commit e43d940f480b69ab98dd5d14e9fefdef8851db1a Author: Yinjun Zhang Date: Wed May 18 09:50:55 2022 +0200 nfp: flower: support ct merging when mangle action exists Current implementation of ct merging doesn't support the case that the fields mangling in pre_ct rules are matched in post_ct rules. This change is to support merging when mangling mac address, ip address, tos, ttl and l4 port. VLAN and MPLS mangling is not involved yet. Signed-off-by: Yinjun Zhang Signed-off-by: Louis Peens Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220518075055.130649-1-simon.horman@corigine.com Signed-off-by: Paolo Abeni commit b885aab3d39d1c81709e957324c7fb9aeac02c38 Author: Michael Trimarchi Date: Wed May 18 08:20:07 2022 +0200 net: fec: Avoid allocating rx buffer using ATOMIC in ndo_open Make ndo_open less sensitive to memory pressure. Signed-off-by: Michael Trimarchi Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20220518062007.10056-1-michael@amarulasolutions.com Signed-off-by: Paolo Abeni commit d87ad457f7e1b8d2492ca5b1531eb35030a1cc8f Author: Yang Yingliang Date: Fri May 13 18:05:41 2022 +0800 video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() In pxa3xx_gcu_probe(), the sequence of error lable is wrong, it will leads some resource leaked, so adjust the sequence to handle the error correctly, and if pxa3xx_gcu_add_buffer() fails, pxa3xx_gcu_free_buffers() need be called. In pxa3xx_gcu_remove(), add missing clk_disable_unpreprare(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit e60e8a73235ce5d42a2891c6989e8df1c8888c4a Author: Yang Li Date: Thu May 19 07:24:45 2022 +0800 rtc: rzn1: fix platform_no_drv_owner.cocci warning Remove .owner field if calls are used which set it automatically. ./drivers/rtc/rtc-rzn1.c:411:3-8: No need to set .owner here. The core will do it. Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220518232445.79156-1-yang.lee@linux.alibaba.com commit 40189b7368e509b21cf68f8a6c1aa6c6cdb01561 Author: Minghao Chi Date: Fri Apr 29 05:51:12 2022 +0000 video: fbdev: omapfb: simplify the return expression of nec_8048_connect() Simplify the return expression. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Signed-off-by: Helge Deller commit b93a85c145d9c745ae74ad43046e75bbf98adc12 Author: Minghao Chi Date: Fri Apr 29 05:47:51 2022 +0000 video: fbdev: omapfb: simplify the return expression of dsi_init_pll_data() Simplify the return expression. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Signed-off-by: Helge Deller commit b23789a59fa6f00e98a319291819f91fbba0deb8 Author: Miaoqian Lin Date: Thu May 12 15:59:08 2022 +0400 video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: d10715be03bd ("video: ARM CLCD: Add DT support") Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller commit 58606220a2f1407a7516c547f09a1ba7b4350a73 Author: Nathan Chancellor Date: Fri May 13 08:51:36 2022 +0100 drm/i915: Fix CFI violation with show_dynamic_id() When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). kobj_attr_show() uses container_of() to get the ->show() callback from the attribute it was passed, meaning the ->show() callback needs to be the same type as the ->show() callback in 'struct kobj_attribute'. However, show_dynamic_id() has the type of the ->show() callback in 'struct device_attribute', which causes a CFI violation when opening the 'id' sysfs node under drm/card0/metrics. This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the ->show() callback to still work. Change the type of show_dynamic_id() to match the ->show() callback in 'struct kobj_attributes' and update the type of sysfs_metric_id to match, which resolves the CFI violation. Fixes: f89823c21224 ("drm/i915/perf: Implement I915_PERF_ADD/REMOVE_CONFIG interface") Signed-off-by: Nathan Chancellor Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20220513075136.1027007-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 18fb42db05a0b93ab5dd5eab5315e50eaa3ca620) Signed-off-by: Jani Nikula commit 61e00044c674ef6831b366750c8516665cf0e810 Author: Imre Deak Date: Tue May 10 14:49:57 2022 +0300 drm/i915: Fix 'mixing different enum types' warnings in intel_display_power.c Fix the following sparse warnings: drivers/gpu/drm/i915/display/intel_display_power.c:2431:34: warning: mixing different enum types: drivers/gpu/drm/i915/display/intel_display_power.c:2431:34: unsigned int enum intel_display_power_domain drivers/gpu/drm/i915/display/intel_display_power.c:2431:34: int enum port drivers/gpu/drm/i915/display/intel_display_power.c:2442:37: warning: mixing different enum types: drivers/gpu/drm/i915/display/intel_display_power.c:2442:37: unsigned int enum intel_display_power_domain drivers/gpu/drm/i915/display/intel_display_power.c:2442:37: int enum port drivers/gpu/drm/i915/display/intel_display_power.c:2468:43: warning: mixing different enum types: drivers/gpu/drm/i915/display/intel_display_power.c:2468:43: unsigned int enum intel_display_power_domain drivers/gpu/drm/i915/display/intel_display_power.c:2468:43: unsigned int enum aux_ch drivers/gpu/drm/i915/display/intel_display_power.c:2479:35: warning: mixing different enum types: drivers/gpu/drm/i915/display/intel_display_power.c:2479:35: unsigned int enum intel_display_power_domain drivers/gpu/drm/i915/display/intel_display_power.c:2479:35: unsigned int enum aux_ch Fixes: 979e1b32e0e2 ("drm/i915: Sanitize the port -> DDI/AUX power domain mapping for each platform") Reported-by: Jani Nikula Cc: Jouni Högander Signed-off-by: Imre Deak Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220510114957.406070-1-imre.deak@intel.com (cherry picked from commit 7ecc3cc8a7b39f08eee9aea7b718187583342a70) Signed-off-by: Jani Nikula commit 43ab20c599f4dc4c3972a8386ef4ca3943b5f9cd Author: YueHaibing Date: Fri May 6 11:26:52 2022 +0800 drm/i915/gt: Fix build error without CONFIG_PM drivers/gpu/drm/i915/gt/intel_gt_sysfs_pm.c: In function ‘act_freq_mhz_show’: drivers/gpu/drm/i915/gt/intel_gt_sysfs_pm.c:276:20: error: implicit declaration of function ‘sysfs_gt_attribute_r_max_func’ [-Werror=implicit-function-declaration] 276 | u32 actual_freq = sysfs_gt_attribute_r_max_func(dev, attr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Move sysfs_gt_attribute_* macros out of #ifdef block to fix this. Fixes: 56a709cf7746 ("drm/i915/gt: Create per-tile RPS sysfs interfaces") Signed-off-by: YueHaibing Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20220506032652.1856-1-yuehaibing@huawei.com (cherry picked from commit 09708b6d82ef473de91c49d90f35e38b0db463f5) Signed-off-by: Jani Nikula commit c4b4d7047f16a8d138ce76da65faefb7165736f2 Author: Saurabh Sengar Date: Wed Apr 27 06:47:53 2022 -0700 video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 This patch fixes a bug where GEN1 VMs doesn't allow resolutions greater than 64 MB size (eg 7680x4320). Unnecessary PCI check limits Gen1 VRAM to legacy PCI BAR size only (ie 64MB). Thus any, resolution requesting greater then 64MB (eg 7680x4320) would fail. MMIO region assigning this memory shouldn't be limited by PCI bar size. Signed-off-by: Saurabh Sengar Reviewed-by: Dexuan Cui Signed-off-by: Helge Deller commit 47f33de4aafb2f5e43d480d590a939d0f1d566a9 Author: Lai Jiangshan Date: Tue Apr 12 20:49:08 2022 +0800 x86/sev: Mark the code returning to user space as syscall gap When returning to user space, %rsp is user-controlled value. If it is a SNP-guest and the hypervisor decides to mess with the code-page for this path while a CPU is executing it, a potential #VC could hit in the syscall return path and mislead the #VC handler. So make ip_within_syscall_gap() return true in this case. Signed-off-by: Lai Jiangshan Signed-off-by: Borislav Petkov Acked-by: Joerg Roedel Link: https://lore.kernel.org/r/20220412124909.10467-1-jiangshanlai@gmail.com commit 3f68e69520d3d52d66a6ad872a75b7d8f2ea7665 Author: Sunil V L Date: Thu May 19 10:45:12 2022 +0530 riscv/efi_stub: Add support for RISCV_EFI_BOOT_PROTOCOL Add support for getting the boot hart ID from the Linux EFI stub using RISCV_EFI_BOOT_PROTOCOL. This method is preferred over the existing DT based approach since it works irrespective of DT or ACPI. The specification of the protocol is hosted at: https://github.com/riscv-non-isa/riscv-uefi Signed-off-by: Sunil V L Acked-by: Palmer Dabbelt Reviewed-by: Heinrich Schuchardt Link: https://lore.kernel.org/r/20220519051512.136724-2-sunilvl@ventanamicro.com [ardb: minor tweaks for coding style and whitespace] Signed-off-by: Ard Biesheuvel commit 8dc7aa0a7246ad0f718d91d09b4d48460508627b Author: Joel Stanley Date: Wed Mar 2 10:49:27 2022 +0800 ARM: dts: aspeed: ast2600-evb: Enable GFX device Enable the GFX device with a framebuffer memory region. Signed-off-by: Joel Stanley Signed-off-by: Tommy Haung Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220302024930.18758-3-tommy_huang@aspeedtech.com Signed-off-by: Joel Stanley commit 4fa40bfa255df35f8ea5e4e03d05a8e8b221a117 Author: Joel Stanley Date: Wed Mar 2 10:49:26 2022 +0800 ARM: dts: aspeed: Add GFX node to AST2600 The GFX device is present in the AST2600 SoC. Signed-off-by: Joel Stanley Signed-off-by: Tommy Haung Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220302024930.18758-2-tommy_huang@aspeedtech.com Signed-off-by: Joel Stanley commit 0ef77237c5243aa620528daeaad0ba92094b5720 Author: Howard Chiu Date: Tue Mar 29 03:24:10 2022 +0000 ARM: dts: aspeed: ast2600-evb: Enable virtual hub Enable Aspeed VHub for HID emulation Signed-off-by: Howard Chiu Link: https://lore.kernel.org/r/SG2PR06MB23155E8A6193118544A7DBF3E61E9@SG2PR06MB2315.apcprd06.prod.outlook.com Signed-off-by: Joel Stanley commit 08daf2c89186452b4986b8a5f014f6478fe7e769 Author: Howard Chiu Date: Tue Mar 29 03:24:03 2022 +0000 ARM: dts: aspeed: ast2600-evb: Enable video engine Enable video engine and reserve memory for it. Signed-off-by: Howard Chiu Link: https://lore.kernel.org/r/SG2PR06MB23159B914BF7EF937FEDD2B5E61E9@SG2PR06MB2315.apcprd06.prod.outlook.com Signed-off-by: Joel Stanley commit f6b67950047bc34f08c33132f5614525459fbe8e Author: Brandon Wyman Date: Thu Apr 21 21:36:38 2022 +0000 ARM: dts: aspeed: everest, rainier: Add power-ffs-sync-history GPIO The IBM Everest and Rainier systems have a GPIO line that goes to the power supplies. It has a dual function: 1) Fans Full Speed, and 2) Sync input history. Signed-off-by: Brandon Wyman Link: https://lore.kernel.org/r/20220421213638.1151193-1-bjwyman@gmail.com Signed-off-by: Joel Stanley commit 7b46aa7c008d2becd5df46c174d8cb4239e24659 Author: Graeme Gregory Date: Fri Mar 25 12:02:47 2022 -0700 ARM: dts: aspeed: Add Nuvia DC-SCM BMC Add initial version of device tree for Nuvia DC-SCM BMC which is equipped with Aspeed AST2600 BMC SoC. Signed-off-by: Graeme Gregory Signed-off-by: Jae Hyun Yoo Link: https://lore.kernel.org/r/20220325190247.468079-1-quic_jaehyoo@quicinc.com Signed-off-by: Joel Stanley commit 244839d0fe6f9d1317ae4f415447e86baf943e9c Author: Potin Lai Date: Mon Apr 18 17:48:27 2022 +0800 ARM: dts: aspeed: bletchley: add sample averaging for ADM1278 set number of sample averaging to 128 for both PWR_AVG and VI_AVG Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Link: https://lore.kernel.org/r/20220418094827.6185-1-potin.lai@quantatw.com Signed-off-by: Joel Stanley commit 8c9e3743877812b7721a506fac056e4a71e11b66 Author: Potin Lai Date: Mon May 9 23:11:18 2022 +0800 ARM: dts: aspeed: bletchley: add eeprom node on each sled Add eeprom (24c26) on each sled for storing sled fru information. Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-7-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit 9495c6d570600e275253036aa993735db8bd2451 Author: Potin Lai Date: Mon May 9 23:11:17 2022 +0800 ARM: dts: aspeed: bletchley: add pca9536 node on each sled Add an ioexp node on each sled baseed on DVT schematic, address at 0x41. P0: SLEDX_SWD_MUX P1: SLEDX_XRES_SWD_N P2: SLEDX_CLKREQ_N P3: SLEDX_PCIE_PWR_EN Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-6-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit 60280a214a41d896093daf162e7273338ebd396c Author: Potin Lai Date: Mon May 9 23:11:16 2022 +0800 ARM: dts: aspeed: bletchley: update gpio0 line names Update GPIO line names based on DVT schematic Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-5-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit 86ec3af52d91292a457247f3e48bacd5d587a9d6 Author: Potin Lai Date: Mon May 9 23:11:15 2022 +0800 ARM: dts: aspeed: bletchley: Enable mdio0 bus Enable mdio0 bus based on DVT schematic. TODO: Add Marvell 88E6191 Switch Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-4-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit cc82dc2673e5ba6065732bbead74a9cb8e19e6c9 Author: Potin Lai Date: Mon May 9 23:11:14 2022 +0800 ARM: dts: aspeed: bletchley: switch spi2 driver to aspeed-smc Due to DVT schematic has stable spi signal, switch back to aspeed-smc driver for improving performance. Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-3-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit ad0e053b5b97282f241b32f0896e6090efe0cacb Author: Potin Lai Date: Mon May 9 23:11:13 2022 +0800 ARM: dts: aspeed: bletchley: enable ehci0 device node Enable ehci0 node for USB2 host feature Signed-off-by: Potin Lai Reviewed-by: Patrick Williams Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20220509151118.4899-2-potin.lai.pt@gmail.com Signed-off-by: Joel Stanley commit c9cb67c3a650ef880ddbfc5906e2b9f51726dd5c Author: Neal Liu Date: Wed May 18 14:20:42 2022 +0800 ARM: dts: aspeed: Add USB2.0 device controller node Add USB2.0 device controller(udc) node to device tree for AST2600. Signed-off-by: Neal Liu Link: https://lore.kernel.org/r/20220518062043.1075360-3-neal_liu@aspeedtech.com Signed-off-by: Joel Stanley commit 33b7af2f459df453feb0d44628d820c47fefe7a8 Author: Carl Yin(殷张成) Date: Thu May 19 02:34:43 2022 +0000 USB: serial: option: add Quectel BG95 modem The BG95 modem has 3 USB configurations that are configurable via the AT command AT+QCFGEXT="usbnet",["ecm"|"modem"|"rmnet"] which make the modem enumerate with the following interfaces, respectively: "modem": Diag + GNSS + Modem + Modem "ecm" : Diag + GNSS + Modem + ECM "rmnet": Diag + GNSS + Modem + QMI Don't support Full QMI messages (e.g WDS_START_NETWORK_INTERFACE) A detailed description of the USB configuration for each mode follows: +QCFGEXT: "usbnet","modem" -------------------------- T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0700 Rev= 0.00 S: Manufacturer=Quectel, Incorporated S: Product=Quectel LPWA Module S: SerialNumber=884328a2 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) At